From 21ea83027ef012f2a79508eae6b7d2e66481a451 Mon Sep 17 00:00:00 2001
From: Alibek Omarov <a1ba.omarov@gmail.com>
Date: Thu, 30 Oct 2025 17:27:56 +0500
Subject: [PATCH] engine: imagelib: fix buffer overflow when the amount of
 colors in palette reported by BMP header are higher than 256

Thanks to @veygax for report!
---
 engine/common/imagelib/img_bmp.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/engine/common/imagelib/img_bmp.c b/engine/common/imagelib/img_bmp.c
index ab13c85c..07eb473b 100644
--- a/engine/common/imagelib/img_bmp.c
+++ b/engine/common/imagelib/img_bmp.c
@@ -102,7 +102,15 @@ qboolean Image_LoadBMP( const char *name, const byte *buffer, fs_offset_t filesi
 			bhdr.colors = 256;
 			cbPalBytes = ( 1 << bhdr.bitsPerPixel ) * sizeof( rgba_t );
 		}
-		else cbPalBytes = bhdr.colors * sizeof( rgba_t );
+		else
+		{
+			if( bhdr.colors > 256 )
+			{
+				Con_DPrintf( S_WARN "%s: %s palette have too many colors (%u), clamping to 256\n", __func__, name, bhdr.colors );
+				bhdr.colors = 256;
+			}
+			cbPalBytes = bhdr.colors * sizeof( rgba_t );
+		}
 	}
 
 	estimatedSize = ( buf_p - buffer ) + cbPalBytes;