about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--converter/ppm/ppmtowinicon.c6
-rw-r--r--doc/HISTORY3
2 files changed, 6 insertions, 3 deletions
diff --git a/converter/ppm/ppmtowinicon.c b/converter/ppm/ppmtowinicon.c
index e3c6a5c5..69baa2f6 100644
--- a/converter/ppm/ppmtowinicon.c
+++ b/converter/ppm/ppmtowinicon.c
@@ -402,9 +402,9 @@ newBitmap(unsigned int    const bpp,
           unsigned int    const rows,
           colorhash_table const cht) {
 
-    unsigned int const xByteCt = ROUNDUP(cols, 32)/8;
-       /* How wide the u1 string for each row should be -- Each byte is 8
-          pixels, but must be a multiple of 4 bytes.
+    unsigned int const xByteCt = ROUNDUP(cols * bpp, 32)/8;
+       /* How wide the u1 string for each row should be.  Pixels are packed
+          into bytes, padded to a multiple of 4 bytes.
        */
     ICON_bmp * icBitmapP;  /* malloc'ed */
     u1 ** rowData;  /* malloc'ed */
diff --git a/doc/HISTORY b/doc/HISTORY
index 4c1e786a..58c5e426 100644
--- a/doc/HISTORY
+++ b/doc/HISTORY
@@ -6,6 +6,9 @@ CHANGE HISTORY
 
 not yet  BJH  Release 11.06.00
 
+              ppmtowinicon: fix array overrun with 4 and 8 bits per pixel.
+              Broken in Netpbm 11.05 (December 2023).
+
               build: makeman: fix warning about backslashes in strings.
 
 23.12.28 BJH  Release 11.05.00