[utilities/konsole/release/26.08] src: Fix kitty graphics byteCount overflow

Git commit ffa3a18953446f0922aaf7c431ecaa7904327586 by Akseli Lahtinen.
Committed on 04/08/2026 at 07:40.
Pushed by akselmo into branch 'release/26.08'.

Fix kitty graphics byteCount overflow

Very large kitty graphics sequence values will cause
the buffer to overflow and crash konsole.

This adds bounds check for it.


(cherry picked from commit 0703fd92c82d83cf535f9434bd6d3216b7a4ebde)

Co-authored-by: Jeff Quast <[email protected]>

M  +7    -1    src/Vt102Emulation.cpp

https://invent.kde.org/utilities/konsole/-/commit/ffa3a18953446f0922aaf7c431ecaa7904327586

diff --git a/src/Vt102Emulation.cpp b/src/Vt102Emulation.cpp
index 9d36205f2..45ce4ab69 100644
--- a/src/Vt102Emulation.cpp
+++ b/src/Vt102Emulation.cpp
@@ -2491,7 +2491,13 @@ void Vt102Emulation::processGraphicsToken(int tokenSize)
             uint32_t byteCount = 0;
             if (keys['f'] == 24 || keys['f'] == 32) {
                 int bpp = keys['f'] / 8;
-                byteCount = bpp * keys['s'] * keys['v'];
+                qint64 bc = bpp * keys['s'] * keys['v'];
+                if (bc < 0 || bc > 0xFFFFFFFFu) {
+                    qCWarning(KonsoleDebug) << "image byteCount overflow:" << bc;
+                    imageData.clear();
+                    return;
+                }
+                byteCount = uint32_t(bc);
             } else {
                 byteCount = 8 * 1024 * 1024;
             }