diff -up tiff-4.0.9/libtiff/tif_getimage.c.CVE-2026-4775 tiff-4.0.9/libtiff/tif_getimage.c
--- tiff-4.0.9/libtiff/tif_getimage.c.CVE-2026-4775	2026-04-20 14:46:44.329742232 +0200
+++ tiff-4.0.9/libtiff/tif_getimage.c	2026-04-20 14:46:44.337742095 +0200
@@ -1900,7 +1900,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr4
     uint32* cp1 = cp+w+toskew;
     uint32* cp2 = cp1+w+toskew;
     uint32* cp3 = cp2+w+toskew;
-    int32 incr = 3*w+4*toskew;
+	const tmsize_t incr = 3 * (tmsize_t)w + 4 * (tmsize_t)toskew;
 
     (void) y;
     /* adjust fromskew */
@@ -2004,7 +2004,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr4
 DECLAREContigPutFunc(putcontig8bitYCbCr42tile)
 {
     uint32* cp1 = cp+w+toskew;
-    int32 incr = 2*toskew+w;
+    const tmsize_t incr = 2 * (tmsize_t)toskew + w;
 
     (void) y;
     fromskew = (fromskew / 4) * (4*2+2);
@@ -2130,7 +2130,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr4
 DECLAREContigPutFunc(putcontig8bitYCbCr22tile)
 {
 	uint32* cp2;
-	int32 incr = 2*toskew+w;
+	const tmsize_t incr = 2 * (tmsize_t)toskew + w;
 	(void) y;
 	fromskew = (fromskew / 2) * (2*2+2);
 	cp2 = cp+w+toskew;
@@ -2225,7 +2225,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr2
 DECLAREContigPutFunc(putcontig8bitYCbCr12tile)
 {
 	uint32* cp2;
-	int32 incr = 2*toskew+w;
+	const tmsize_t incr = 2 * (tmsize_t)toskew + w;
 	(void) y;
 	fromskew = (fromskew / 1) * (1 * 2 + 2);
 	cp2 = cp+w+toskew;