From 20a4b7686bfeda6551c739f4a4f1feaf63979375 Mon Sep 17 00:00:00 2001
From: Jorge Barredo Ferreira <[EMAIL REDACTED]>
Date: Mon, 6 Apr 2026 19:29:38 +0200
Subject: [PATCH] Fix heap-buffer-overflow WRITE in LBM palette (CWE-122)
When nbplanes > 8 without HAM flag, nbrcolorsfinal exceeds 256,
causing writes past the palette buffer. Reject nbplanes > 8 for
paletted images.
(cherry picked from commit 2fe0746733c9f280d2c344bce231dd70fdf3bdb8)
---
src/IMG_lbm.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/src/IMG_lbm.c b/src/IMG_lbm.c
index bbe46965b..5da775a11 100644
--- a/src/IMG_lbm.c
+++ b/src/IMG_lbm.c
@@ -234,6 +234,13 @@ SDL_Surface *IMG_LoadLBM_IO(SDL_IOStream *src )
nbplanes = bmhd.planes;
+ /* Sanity check: nbplanes must not exceed 8 for paletted images.
+ Higher values cause 1<<nbplanes to exceed the 256-entry palette. */
+ if ( !pbm && nbplanes > 8 && nbplanes != 24 && flagHAM == 0 ) {
+ SDL_SetError("LBM: invalid number of bitplanes (%u)", nbplanes);
+ goto done;
+ }
+
if ( pbm ) /* File format : 'Packed Bitmap' */
{
bytesperline *= 8;