diff options
| author | giraffedata <giraffedata@9d0c8265-081b-0410-96cb-a4ca84ce46f8> | 2019-03-02 16:35:41 +0000 |
|---|---|---|
| committer | giraffedata <giraffedata@9d0c8265-081b-0410-96cb-a4ca84ce46f8> | 2019-03-02 16:35:41 +0000 |
| commit | 3351c949459463cae01db691a6de4943bc455269 (patch) | |
| tree | 7cd5caecd1c37468c3c31a5affa725baef4a78c9 /converter/other/pamtopng.c | |
| parent | 5f5c0037b20895c4cb55f732d1002f46c8413b50 (diff) | |
| download | netpbm-mirror-3351c949459463cae01db691a6de4943bc455269.tar.gz netpbm-mirror-3351c949459463cae01db691a6de4943bc455269.tar.xz netpbm-mirror-3351c949459463cae01db691a6de4943bc455269.zip | |
fix buffer overrun
git-svn-id: http://svn.code.sf.net/p/netpbm/code/trunk@3556 9d0c8265-081b-0410-96cb-a4ca84ce46f8
Diffstat (limited to 'converter/other/pamtopng.c')
| -rw-r--r-- | converter/other/pamtopng.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/converter/other/pamtopng.c b/converter/other/pamtopng.c index bb24562a..fd0d89fa 100644 --- a/converter/other/pamtopng.c +++ b/converter/other/pamtopng.c @@ -579,6 +579,9 @@ writeRaster(const struct pam * const pamP, struct pngx * const pngxP, int const bitDepth) { + unsigned int const rowSz = + pamP->width * pamP->depth * (MAX(1, bitDepth/8)); + tuple * tupleRow; png_byte * pngRow; unsigned int row; @@ -587,8 +590,7 @@ writeRaster(const struct pam * const pamP, tupleRow = pnm_allocpamrow(pamP); - MALLOCARRAY(pngRow, pamP->width * 8); - /* sufficient to store a 16-bit RGB+A row */ + MALLOCARRAY(pngRow, rowSz); if (pngRow == NULL) pm_error("Unable to allocate space for PNG pixel row for " |