SDL_image: Validate GIMP image offsets for non-RLE XCF images

SDL Commits
1 
From 760c986552eafa759bfc5834c014dd7481384f76 Mon Sep 17 00:00:00 2001
From: Sam Lantinga <[EMAIL REDACTED]>
Date: Fri, 21 Aug 2026 10:52:05 -0700
Subject: [PATCH] Validate GIMP image offsets for non-RLE XCF images

Fixes https://github.com/libsdl-org/SDL_image/issues/754
---
 src/IMG_xcf.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/IMG_xcf.c b/src/IMG_xcf.c
index 52b9d03e4..d8e6b7d95 100644
--- a/src/IMG_xcf.c
+++ b/src/IMG_xcf.c
@@ -605,6 +605,11 @@ static unsigned char *load_xcf_tile_none (SDL_IOStream *src, size_t len, int bpp
 {
     unsigned char *load = NULL;
 
+    if (len < (x * y * bpp)) {
+        SDL_SetError("Gimp image invalid tile offsets");
+        return NULL;
+    }
+
     load = (unsigned char *)SDL_malloc(len);
     if (load != NULL) {
         if (SDL_ReadIO(src, load, len) != len) {
@@ -997,7 +1002,10 @@ SDL_Surface *IMG_LoadXCF_IO(SDL_IOStream *src)
         layer = read_xcf_layer(src, head);
         if (layer != NULL) {
             if (layer->visible) {
-                do_layer_surface(lays, src, head, layer, load_tile);
+                if (do_layer_surface(lays, src, head, layer, load_tile) != 0) {
+                    error = SDL_GetError();
+                    goto done;
+                }
                 rs.x = 0;
                 rs.y = 0;
                 rs.w = layer->width;