From 02abd996b02e9dba177f1f1ae08799baea649707 Mon Sep 17 00:00:00 2001
From: rootvector2 <dxbnaveed.k@gmail.com>
Date: Mon, 1 Jun 2026 13:20:40 +0530
Subject: [PATCH] fix 32-bit overflow in ICC CICP tag-count bounds check

---
 lib/extras/enc/jpegli.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/extras/enc/jpegli.cc b/lib/extras/enc/jpegli.cc
index 280b8661..08a9bbce 100644
--- a/lib/extras/enc/jpegli.cc
+++ b/lib/extras/enc/jpegli.cc
@@ -148,7 +148,7 @@ bool FindCICPTag(const uint8_t* icc_data, size_t len, bool is_first_chunk,
       return false;
     }
     uint32_t tag_count = LoadBE32(&icc_data[128]);
-    if (len < 132 + 12 * tag_count) {
+    if (len < 132 + static_cast<uint64_t>(12) * tag_count) {
       return false;
     }
     for (uint32_t i = 0; i < tag_count; ++i) {