Commit bdae0681a for imagemagick.org
commit bdae0681ad1e572defe62df85834218f01e6d670
Author: Dirk Lemstra <dirk@lemstra.org>
Date: Tue Dec 2 22:49:12 2025 +0100
Added extra check to avoid an overflow on 32-bit machines (GHSA-6hjr-v6g4-3fm8)
diff --git a/coders/tim.c b/coders/tim.c
index db60f32e6..b87e06d2c 100644
--- a/coders/tim.c
+++ b/coders/tim.c
@@ -231,7 +231,8 @@ static Image *ReadTIMImage(const ImageInfo *image_info,ExceptionInfo *exception)
(void) ReadBlobLSBShort(image);
width=ReadBlobLSBShort(image);
height=ReadBlobLSBShort(image);
- image_size=2*width*height;
+ if (HeapOverflowSanityCheckGetSize(2*width,height,&image_size) != MagickFalse)
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
if (image_size > GetBlobSize(image))
ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
bytes_per_line=width*2;