From 785320a5273c7fac5fd5ce5cfd21e6a3785e07b4 Mon Sep 17 00:00:00 2001 From: Sjef Verhoeven PE5PVB <76666293+PE5PVB@users.noreply.github.com> Date: Sat, 14 Feb 2026 15:29:21 +0100 Subject: [PATCH] Fix buffer overflow in ucPixels for RGBA images at max width DecodePNG() aligns pCurr and pPrev to 16-byte boundaries within ucPixels, adding up to 15 bytes of padding per line. The default PNG_MAX_BUFFERED_PIXELS value did not account for this alignment overhead, causing a buffer overflow into ucFileBuf when decoding RGBA (color type 6) images at the maximum supported width (320px on Arduino, 2048px on Linux/Mac). For a 320px wide RGBA image: - iPitch = 1280, each line needs 1281 bytes (iPitch + filter byte) - With alignment: 15 + 1281 + 15 + 1281 = 2592 bytes needed - Old buffer size: ((320*4+1)*2) = 2562 bytes (30 bytes short) The overflow corrupts ucFileBuf (the file read buffer immediately following ucPixels in the PNGIMAGE struct), causing zlib decompression errors after a few scanlines. This results in only the top portion of the image being rendered. Adding 16 bytes per line to the default accounts for worst-case alignment padding. Co-Authored-By: Claude Opus 4.6 --- src/PNGdec.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/PNGdec.h b/src/PNGdec.h index 1c99542..22474d0 100644 --- a/src/PNGdec.h +++ b/src/PNGdec.h @@ -53,9 +53,9 @@ // but can be overidden with a macro defined at compile time #ifndef PNG_MAX_BUFFERED_PIXELS #if defined( __LINUX__ ) || defined ( __MACH__ ) -#define PNG_MAX_BUFFERED_PIXELS ((2048*4 + 1)*2) +#define PNG_MAX_BUFFERED_PIXELS ((2048*4 + 1 + 16)*2) #else // Arduino? -#define PNG_MAX_BUFFERED_PIXELS ((320*4 + 1)*2) +#define PNG_MAX_BUFFERED_PIXELS ((320*4 + 1 + 16)*2) #endif // __LINUX__ #endif