From 1db4690bde3a349df046f85a4ee9a71af8492216 Mon Sep 17 00:00:00 2001
From: Alx Sa <cmyk.student@gmail.com>
Date: Tue, 16 Jun 2026 02:13:03 +0000
Subject: [PATCH] plug-ins: Mitigate issue #16492

Resolves #16492
Similar to 53cdb27f, we ensure that
multiplying two gushorts in the FLI plug-in
does not overflow by casting one of them
to a larger datatype size.
---
 plug-ins/file-fli/fli-gimp.c | 26 ++++++++++++++++++++++----
 plug-ins/file-fli/fli.c      |  8 +++++---
 2 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/plug-ins/file-fli/fli-gimp.c b/plug-ins/file-fli/fli-gimp.c
index b31c78d2c70..d2b876cc7d1 100644
--- a/plug-ins/file-fli/fli-gimp.c
+++ b/plug-ins/file-fli/fli-gimp.c
@@ -542,8 +542,17 @@ load_image (GFile    *file,
 
   image = gimp_image_new (fli_header.width, fli_header.height, GIMP_INDEXED);
 
-  fb  = g_malloc (fli_header.width * fli_header.height);
-  ofb = g_malloc (fli_header.width * fli_header.height);
+  fb  = g_try_malloc ((gsize) fli_header.width * fli_header.height);
+  ofb = g_try_malloc ((gsize) fli_header.width * fli_header.height);
+  if (! fb || ! ofb)
+    {
+      g_set_error (error, G_FILE_ERROR, 0,
+                   _("Memory could not be allocated."));
+      fclose (fp);
+      g_free (fb);
+      g_free (ofb);
+      return FALSE;
+    }
 
   /*
    * Skip to the beginning of requested frames:
@@ -802,8 +811,17 @@ export_image (GFile      *file,
     }
   fseek (fp, 128, SEEK_SET);
 
-  fb = g_malloc (fli_header.width * fli_header.height);
-  ofb = g_malloc (fli_header.width * fli_header.height);
+  fb  = g_try_malloc ((gsize) fli_header.width * fli_header.height);
+  ofb = g_try_malloc ((gsize) fli_header.width * fli_header.height);
+  if (! fb || ! ofb)
+    {
+      g_set_error (error, G_FILE_ERROR, 0,
+                   _("Memory could not be allocated."));
+      fclose (fp);
+      g_free (fb);
+      g_free (ofb);
+      return FALSE;
+    }
 
   /* initialize with bg color */
   memset (fb, bg, fli_header.width * fli_header.height);
diff --git a/plug-ins/file-fli/fli.c b/plug-ins/file-fli/fli.c
index 1aba31e8f90..cffb487def7 100644
--- a/plug-ins/file-fli/fli.c
+++ b/plug-ins/file-fli/fli.c
@@ -883,7 +883,7 @@ fli_read_black (FILE          *f,
                 guchar        *framebuf,
                 GError       **error)
 {
-  memset (framebuf, 0, fli_header->width * fli_header->height);
+  memset (framebuf, 0, (gsize) fli_header->width * fli_header->height);
 
   return TRUE;
 }
@@ -1178,7 +1178,8 @@ fli_read_lc (FILE          *f,
   gushort  yc, firstline, numline;
   guchar  *pos;
 
-  memcpy (framebuf, old_framebuf, fli_header->width * fli_header->height);
+  memcpy (framebuf, old_framebuf,
+          (gint64) fli_header->width * fli_header->height);
 
   if (! fli_read_short (f, &firstline, error) ||
       ! fli_read_short (f, &numline, error))
@@ -1432,7 +1433,8 @@ fli_read_lc_2 (FILE          *f,
   guchar  *pos;
   guint32  len_read;
 
-  memcpy (framebuf, old_framebuf, fli_header->width * fli_header->height);
+  memcpy (framebuf, old_framebuf,
+          (gint64) fli_header->width * fli_header->height);
   yc = 0;
 
   if (! fli_read_short (f, &numline, error))
-- 
GitLab