From 43e6efb0e52615ec34893fd962bcb7be8af9ebbc Mon Sep 17 00:00:00 2001
From: Albert Astals Cid <aacid@kde.org>
Date: Mon, 7 Sep 2026 17:50:13 +0200
Subject: [PATCH] ANIHandler::nextImageDelay: Protect against overflow

oss-fuzz:
 issue #558190560
 testcase #6629308500869120
---
 src/imageformats/ani.cpp | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/src/imageformats/ani.cpp b/src/imageformats/ani.cpp
index c8cc22b..ae24818 100644
--- a/src/imageformats/ani.cpp
+++ b/src/imageformats/ani.cpp
@@ -12,6 +12,7 @@
 #include <QScopeGuard>
 #include <QVariant>
 #include <QtEndian>
+#include <QtNumeric>
 
 #include <cstring>
 
@@ -267,7 +268,17 @@ int ANIHandler::nextImageDelay() const
         rate = m_displayRates.at(previousImage);
     }
 
-    return rate * 1000 / 60;
+    int delayNumerator;
+    if (qMulOverflow(rate, 1000, &delayNumerator)) {
+        int delay;
+        // We're losing a bit of precision by dividing first and multiplying later
+        // but this is most probably a broken file so not much of an issue
+        if (qMulOverflow(rate / 60, 1000, &delay)) {
+            return 0;
+        }
+        return delay;
+    }
+    return delayNumerator / 60;
 }
 
 bool ANIHandler::supportsOption(ImageOption option) const