From 0af1741e24bac24f0bf2774f8bca13b3c04670b2 Mon Sep 17 00:00:00 2001
From: bflatastic <bombayapirat@gmail.com>
Date: Sat, 17 Oct 2026 12:48:36 +0700
Subject: [PATCH] Crop Image: the RGBA size check can't overflow on a huge
 header

---
 crates/engine/src/cmd/menucmds.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crates/engine/src/cmd/menucmds.rs b/crates/engine/src/cmd/menucmds.rs
index 23e49a039..464def21b 100644
--- a/crates/engine/src/cmd/menucmds.rs
+++ b/crates/engine/src/cmd/menucmds.rs
@@ -672,7 +672,7 @@ fn trim_image(s: &mut Session, id: NodeId, im: ImageObject) -> Result<Value> {
     // The image's size as RGBA, read from its header, is held to that allowance before anything
     // is decoded (#1717).
     let (w, h) = reader()?.into_dimensions().map_err(|e| bad(C, format!("the image's pixels can't be read: {e}")))?;
-    if u64::from(w) * u64::from(h) * 4 > crate::cmd::fileio::MAX_RASTER_ALLOC {
+    if u64::from(w) * u64::from(h) > crate::cmd::fileio::MAX_RASTER_ALLOC / 4 {
         return Err(bad(C, format!("an image of {w} × {h} pixels is too large to draw")));
     }
     let mut reader = reader()?;