From 53cdb27fa2b1676d11e9677c9975b5ad7b61b2ee Mon Sep 17 00:00:00 2001
From: Alx Sa <cmyk.student@gmail.com>
Date: Mon, 15 Jun 2026 04:37:14 +0000
Subject: [PATCH] plug-ins: Mitigate issue #16493

Resolves #16493
It is possible for an invalid TIM file to set both
the number of colors and number of CLUTs to the
maximum gushort value. In that case, when multiplied
they may overflow the size of a guint. To prevent this,
the "clut_size" variable is changed to a gsize datatype.
This allows the code to flow through to other checks
without risking an overflow.

Origin: https://gitlab.gnome.org/GNOME/gimp/-/commit/53cdb27fa2b1676d11e9677c9975b5ad7b61b2ee
---
 plug-ins/common/file-tim.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plug-ins/common/file-tim.c b/plug-ins/common/file-tim.c
index baa8ed9f08c..6a0dafcb841 100644
--- a/plug-ins/common/file-tim.c
+++ b/plug-ins/common/file-tim.c
@@ -483,7 +483,7 @@ load_image (GFile        *file,
      if (num_colors > 0)
       {
         gboolean  promote_to_rgb = FALSE;
-        guint     clut_size      = num_colors * num_cluts;
+        gsize     clut_size      = num_colors * num_cluts;
         gushort  *clut_data;
         guchar   *color_map;
         guint32   image_offset;
-- 
GitLab