From f9d5456962ee3b515939137a77b6f6785c4b303e Mon Sep 17 00:00:00 2001
From: Ralph Little <skelband@gmail.com>
Date: Fri, 6 Jun 2025 15:38:10 -0700
Subject: [PATCH] preview: added overflow check to buffer calculation

---
 src/preview.c | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/src/preview.c b/src/preview.c
index a343d57..a7749d6 100644
--- a/src/preview.c
+++ b/src/preview.c
@@ -1159,11 +1159,28 @@ restore_preview_image (Preview * p)
   p->image_height = height;
   if ((width == 0) || (height == 0))
     return;
-  p->image_data = malloc (3 * width * height);
-  p->preview_data = malloc (3 * width * height);
+
+  int data_size = 3 * width * height;
+
+  // Overflow check.
+  if ((data_size / width) / height != 3)
+    {
+      // overflow occurred. Ignore the image. The dimensions are probably corrupted.
+      return;
+    }
+
+  p->image_data = malloc (data_size);
   if (!p->image_data)
     return;
 
+  p->preview_data = malloc (data_size);
+  if (!p->preview_data)
+    {
+      free(p->image_data);
+      p->image_data = NULL;
+      return;
+    }
+
   nread = fread (p->image_data, 3, width * height, in);
 
   p->image_y = nread / width;