diff options
| -rw-r--r-- | converter/pbm/pbmtog3.c | 2 | ||||
| -rw-r--r-- | doc/HISTORY | 3 |
2 files changed, 4 insertions, 1 deletions
diff --git a/converter/pbm/pbmtog3.c b/converter/pbm/pbmtog3.c index 4e4ec0fd..f0fd1252 100644 --- a/converter/pbm/pbmtog3.c +++ b/converter/pbm/pbmtog3.c @@ -440,7 +440,7 @@ main(int argc, MALLOCARRAY_NOFAIL(bitrow, pbm_packed_bytes(cols) + sizeof(wordint)); - MALLOCARRAY_NOFAIL(milepost, readcols + 1); + MALLOCARRAY_NOFAIL(milepost, readcols + 2); initOutStream(cmdline.reversebits); puteol(); diff --git a/doc/HISTORY b/doc/HISTORY index d5375275..44e97390 100644 --- a/doc/HISTORY +++ b/doc/HISTORY @@ -16,6 +16,9 @@ not yet BJH Release 10.71.00 negative values (should be clipped to zero). Introduced in Netpbm 10.68 (September 2014). + pbmtog3: Fix buffer overrun. Introduced in Netpbm 10.23 + (July 2004). + cameratopam: Fix arithmetic underflow in JPEG processing; unknown effect. |