From 6d3651ac4df88efb68e013d21061de9846e83fe8 Mon Sep 17 00:00:00 2001
From: Dmitry Kazakov <dimula73@gmail.com>
Date: Mon, 8 Sep 2025 15:35:51 +0200
Subject: [PATCH] Fix a crash in KisTgaImport

---
 plugins/impex/tga/kis_tga_import.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/plugins/impex/tga/kis_tga_import.cpp b/plugins/impex/tga/kis_tga_import.cpp
index 8bb838a8470..b3e1058c859 100644
--- a/plugins/impex/tga/kis_tga_import.cpp
+++ b/plugins/impex/tga/kis_tga_import.cpp
@@ -153,6 +153,11 @@ static bool loadTGA(QDataStream & s, const TgaHeader & tga, QImage &img)
             uint count = (c & 0x7f) + 1;
             num -= count * pixel_size;
 
+            if (num < 0) {
+                dbgFile << "This TGA file is broken: the number of pixels left to read and the number of RLE pixels do not agree" << ppVar(num) << ppVar(count) << ppVar(pixel_size);
+                return false;
+            }
+
             if (c & 0x80) {
                 // RLE pixels.
                 Q_ASSERT(pixel_size <= 8);
-- 
GitLab