From e5ece43a25579f3ac07a79cf19483fdf4f83b238 Mon Sep 17 00:00:00 2001
From: solim <7576268+soul-sol@users.noreply.github.com>
Date: Tue, 28 Jul 2026 21:18:48 +0900
Subject: [PATCH] pngminus: prevent row pointer allocation overflow

Signed-off-by: solim <7576268+soul-sol@users.noreply.github.com>
---
 contrib/pngminus/pnm2png.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/contrib/pngminus/pnm2png.c b/contrib/pngminus/pnm2png.c
index 052fd3272c..b711d79276 100644
--- a/contrib/pngminus/pnm2png.c
+++ b/contrib/pngminus/pnm2png.c
@@ -366,7 +366,8 @@ BOOL do_pnm2png (png_struct *png_ptr, png_info *info_ptr,
   }
 
   if ((row_bytes == 0) ||
-      ((size_t) height > (size_t) (-1) / (size_t) row_bytes))
+      ((size_t) height > (size_t) (-1) / (size_t) row_bytes) ||
+      ((size_t) height > (size_t) (-1) / sizeof (png_byte *)))
   {
     /* too big */
     return FALSE;