From 285790d685ef9d49547fb30f232b2cb017cbc912 Mon Sep 17 00:00:00 2001
From: bflatastic <bombayapirat@gmail.com>
Date: Sat, 24 Oct 2026 17:20:03 +0700
Subject: [PATCH] Security bounds: fix on landing #3938 (see the PR comment)

---
 crates/render/src/paint.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crates/render/src/paint.rs b/crates/render/src/paint.rs
index 2ecef8a20..f88c9a82c 100644
--- a/crates/render/src/paint.rs
+++ b/crates/render/src/paint.rs
@@ -102,7 +102,7 @@ pub(crate) fn decode_within_allowance(bytes: &[u8]) -> image::ImageResult<image:
         Ok(r)
     };
     let (w, h) = reader()?.into_dimensions()?;
-    let bytes = u64::from(w) * u64::from(h) * 4;
+    let bytes = (u64::from(w) * u64::from(h)).saturating_mul(4);
     // The images paints hold can't be evicted from the cache, so a document of many images held
     // them all at once: a new one is decoded only while those and it fit twice the allowance.
     let pinned = crate::images::store().pinned_bytes() as u64;