From d7961a2fcf721df39677a38ff4449106b8067cc4 Mon Sep 17 00:00:00 2001
From: Lilith River <lilith@imazen.io>
Date: Tue, 7 Apr 2026 08:21:22 -0600
Subject: [PATCH] fix: prevent u16 overflow panic in Group3 fax run-length
 decode

Fuzz testing found that crafted TIFF files with corrupt Group3 fax data
could cause a u16 addition overflow when accumulating run lengths. Use
checked_add and break on overflow (treating as corrupt data) instead of
panicking.
---
 src/decoder/stream.rs | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/decoder/stream.rs b/src/decoder/stream.rs
index 9fb5e4e..01dc70a 100644
--- a/src/decoder/stream.rs
+++ b/src/decoder/stream.rs
@@ -448,7 +448,7 @@ impl Group3Reader {
     ) -> Option<u16> {
         let mut sum = 0u16;
         while let Some(n) = decoder(reader) {
-            sum += n;
+            sum = sum.checked_add(n)?;
             if n < 64 {
                 return Some(sum);
             }
@@ -475,7 +475,10 @@ impl Read for Group3Reader {
                 };
                 match run {
                     Some(len) => {
-                        a0 += len;
+                        a0 = match a0.checked_add(len) {
+                            Some(v) => v,
+                            None => break, // overflow = corrupt data
+                        };
                         transitions.push(a0);
                         is_white = !is_white;
                     }