--- /n/sources/plan9/sys/src/cmd/jpg/readbmp.c	Tue Mar 23 06:00:02 2004
+++ /sys/src/cmd/jpg/readbmp.c	Tue Sep 22 00:00:00 2026
@@ -40,6 +40,10 @@
  enough to guarantee bug-free decoding. caveat emptor!
 */
 
+enum {
+	Maxpixels = 1<<28,
+};
+
 static short
 r16(Biobuf*b)
 {
@@ -504,6 +508,10 @@
 	*height = bmih.height;
 	colours = bmih.bpp;
 
+	if(*width <= 0 || *height == 0 ||
+	   (vlong)*width * abs(*height) > Maxpixels)
+		sysfatal("bad image size %dx%d", *width, *height);
+
 	Bseek(b, bmfh.offbits, 0);
 
 	if ((buf = calloc(sizeof(Rgb), *width * abs(*height))) == nil)
--- /n/sources/plan9/sys/src/cmd/jpg/readppm.c	Wed Jun  7 17:23:05 2000
+++ /sys/src/cmd/jpg/readppm.c	Tue Sep 22 00:00:00 2026
@@ -138,6 +138,10 @@
 	return nil;
 }
 
+enum {
+	Maxpixels = 1<<28,
+};
+
 typedef struct Pix	Pix;
 struct Pix {
 	char magic;
@@ -184,7 +188,7 @@
 
 	wid = Bgetint(b);
 	ht = Bgetint(b);
-	if(wid <= 0 || ht <= 0)
+	if(wid <= 0 || ht <= 0 || (vlong)wid * ht > Maxpixels)
 		goto Error;
 	a->r = Rect(0,0,wid,ht);
 
--- /n/sources/plan9/sys/src/cmd/jpg/readtga.c	Tue Feb  3 06:00:08 2009
+++ /sys/src/cmd/jpg/readtga.c	Tue Sep 22 00:00:00 2026
@@ -14,6 +14,7 @@
 
 enum {
 	HdrLen = 18,
+	Maxpixels = 1<<28,
 };
 
 typedef struct {
@@ -338,6 +339,11 @@
 		ar->chandesc = CRGB;
 	}
 
+	if(h->width <= 0 || h->height <= 0 ||
+	   (vlong)h->width * h->height > Maxpixels){
+		werrstr("ReadTGA: bad image size %dx%d", h->width, h->height);
+		goto Error;
+	}
 	ar->chanlen = h->width*h->height;
 	ar->r = Rect(0, 0, h->width, h->height);
 	for (c = 0; c < ar->nchans; c++)