From 26b18c51848df5297413141d6493ce8f9570928a Mon Sep 17 00:00:00 2001
From: Lilith River <lilith@imazen.io>
Date: Thu, 9 Apr 2026 04:46:05 -0600
Subject: [PATCH] fix: prevent shift overflow panic in ColorMap size validation

`1usize << bits_per_sample` panics when bits_per_sample >= 64.
Use checked_shl to return a LimitsExceeded error instead.

Found by fuzzing decode_comprehensive with a BE TIFF containing
PhotometricInterpretation=RGBPalette and BitsPerSample=83.
---
 src/decoder/image.rs                             |   5 +++--
 .../oor_panic/colormap-shl-overflow.tiff         | Bin 0 -> 1036 bytes
 2 files changed, 3 insertions(+), 2 deletions(-)
 create mode 100644 tests/fuzz_images/oor_panic/colormap-shl-overflow.tiff

diff --git a/src/decoder/image.rs b/src/decoder/image.rs
index 59c7521..1b51b51 100644
--- a/src/decoder/image.rs
+++ b/src/decoder/image.rs
@@ -454,8 +454,9 @@ impl Image {
             match tag_reader.find_tag(Tag::ColorMap)? {
                 Some(v) => {
                     let map = v.into_u16_vec()?;
-                    let expected_len = 3usize
-                        .checked_mul(1usize << bits_per_sample)
+                    let expected_len = 1usize
+                        .checked_shl(bits_per_sample as u32)
+                        .and_then(|n| n.checked_mul(3))
                         .ok_or(TiffError::LimitsExceeded)?;
                     if map.len() != expected_len {
                         return Err(TiffError::FormatError(
diff --git a/tests/fuzz_images/oor_panic/colormap-shl-overflow.tiff b/tests/fuzz_images/oor_panic/colormap-shl-overflow.tiff
new file mode 100644
index 0000000000000000000000000000000000000000..d2905df3785817a0e0aab0bc18d298763a234dc5
GIT binary patch
literal 1036
zcmebEWzb?^V76jmWn^&`6?6>+fyhwL&`<{#2SFD>K@cxgoPmXbfq@aI(11~jMKm-7
zq{=}=04N9qEDWL{jt)Sr#fj;MlXSCV-e$j8x{nno1JuEy#VEtT3}yp)j2cij6Oe7l
z03;b4fohBx9l+u|Aj6;lsG7mOD6t?T6R4CItW*pr&BG`Na|{CqqY#qOqEPma|NsBJ
z{Qu`aP#fcVAc5j|2AH#y7^UHCkP{(*8>pV36G7f$@Bm_<FOz|O&P?u)LHHZ!Mw|f@
z3iO==$R?l(prC}ifKt~0T>=VoV(b<K*$sArCn$uVY;7Q$3Ca!zxeyE(K@MePgNg%n
a4Z?^3dV4e=fziZ5ZW;o{DloEv!3Y4%7HDAr

literal 0
HcmV?d00001