From 3351c949459463cae01db691a6de4943bc455269 Mon Sep 17 00:00:00 2001
From: giraffedata <giraffedata@9d0c8265-081b-0410-96cb-a4ca84ce46f8>
Date: Sat, 2 Mar 2019 16:35:41 +0000
Subject: fix buffer overrun

git-svn-id: http://svn.code.sf.net/p/netpbm/code/trunk@3556 9d0c8265-081b-0410-96cb-a4ca84ce46f8
---
 converter/other/pamtopng.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'converter/other/pamtopng.c')

diff --git a/converter/other/pamtopng.c b/converter/other/pamtopng.c
index bb24562a..fd0d89fa 100644
--- a/converter/other/pamtopng.c
+++ b/converter/other/pamtopng.c
@@ -579,6 +579,9 @@ writeRaster(const struct pam * const pamP,
             struct pngx *      const pngxP,
             int                const bitDepth) {
 
+    unsigned int const rowSz =
+        pamP->width * pamP->depth * (MAX(1, bitDepth/8));
+
     tuple * tupleRow;
     png_byte * pngRow;
     unsigned int row;
@@ -587,8 +590,7 @@ writeRaster(const struct pam * const pamP,
 
     tupleRow = pnm_allocpamrow(pamP);
 
-    MALLOCARRAY(pngRow, pamP->width * 8);
-        /* sufficient to store a 16-bit RGB+A row */
+    MALLOCARRAY(pngRow, rowSz);
 
     if (pngRow == NULL)
         pm_error("Unable to allocate space for PNG pixel row for "
-- 
cgit 1.4.1