From ca69e74b62c819e4dee07fb50eb674ef39b8557a Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 27 Oct 2026 18:02:32 +0000
Subject: [PATCH] fix(raw): check opcode byte counts without overflow

---
 crates/raw/src/opcodes.rs       |  4 ++--
 crates/raw/src/opcodes/tests.rs | 14 ++++++++++++++
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/crates/raw/src/opcodes.rs b/crates/raw/src/opcodes.rs
index f7750aaac..4d3e463b0 100644
--- a/crates/raw/src/opcodes.rs
+++ b/crates/raw/src/opcodes.rs
@@ -381,7 +381,7 @@ fn parse_gain_map(area: Area, reader: &mut Rd<'_>) -> Option<Opcode> {
     let origin = [reader.finite_f64()?, reader.finite_f64()?];
     let map_planes = reader.u32()?;
     let count = (points_v as usize).checked_mul(points_h as usize)?.checked_mul(map_planes as usize)?;
-    if count == 0 || count * 4 > reader.remaining() {
+    if count == 0 || count > reader.remaining() / 4 {
         return None;
     }
     let gains = (0..count).map(|_| reader.f32()).collect::<Option<_>>()?;
@@ -390,7 +390,7 @@ fn parse_gain_map(area: Area, reader: &mut Rd<'_>) -> Option<Opcode> {
 
 fn parse_delta_scale(id: u32, area: Area, reader: &mut Rd<'_>) -> Option<Opcode> {
     let count = reader.u32()? as usize;
-    if count * 4 > reader.remaining() {
+    if count > reader.remaining() / 4 {
         return None;
     }
     let values: Vec<f32> = (0..count).map(|_| reader.f32()).collect::<Option<_>>()?;
diff --git a/crates/raw/src/opcodes/tests.rs b/crates/raw/src/opcodes/tests.rs
index e63a0bf56..d1be999e9 100644
--- a/crates/raw/src/opcodes/tests.rs
+++ b/crates/raw/src/opcodes/tests.rs
@@ -1,5 +1,19 @@
 use super::*;
 
+#[test]
+fn reject_opcode_counts_whose_bytes_exceed_the_remaining_data() {
+    let mut gain_map = Vec::new();
+    for value in [u32::MAX, 1] {
+        gain_map.extend_from_slice(&value.to_be_bytes());
+    }
+    gain_map.extend(be(&[1.0, 1.0, 0.0, 0.0]));
+    gain_map.extend_from_slice(&1u32.to_be_bytes());
+    assert!(parse_gain_map(Area::default(), &mut Rd { d: &gain_map, p: 0 }).is_none());
+
+    let delta_count = u32::MAX.to_be_bytes();
+    assert!(parse_delta_scale(10, Area::default(), &mut Rd { d: &delta_count, p: 0 }).is_none());
+}
+
 pub(crate) struct ListWriter(pub Vec<u8>, pub u32);
 
 impl ListWriter {