pngminus: prevent row pointer allocation overflow

[soul-sol]

Summary

Reject PNM heights whose row-pointer array size cannot be represented by size_t before allocating the array. On 32-bit systems, a crafted height can otherwise wrap the allocation to four bytes and the following loop immediately writes beyond it.

Fixes #825.

Verification

• Reproduced the original heap-buffer-overflow with AddressSanitizer on i386 Debian.
• Confirmed the same input is rejected before allocation after the patch with no sanitizer finding.
• Built shared and static libpng on ARM64 Ubuntu 24.04.
• Ran the full ARM64 CTest suite: 37/37 passed.
• Compiled pnm2png as strict C90 with warnings treated as errors, excluding one pre-existing tautological-comparison warning.
• git diff --check passes.
• Ran the full i386 CTest suite under emulation: 37/37 passed.

[jbowler]

@ctruta why check "height" against width? The original code seems totally bogus to me. So far as I can see there is no check on "width"; the row_bytes calculation on line 360 of 1.8 HEAD clearly overflows.

Old code with no maintainer.