From b7e5d3e8ae24ce0a1e0988dc4b27b7da40072cf8 Mon Sep 17 00:00:00 2001
From: bibi samina <sam@bugqore.com>
Date: Thu, 27 Aug 2026 16:14:32 +0530
Subject: [PATCH] fix(pngimage): correct 16-bit sBIT handling in compare_read

compare_read fills sig_bits with one entry per colour component, but for 16-bit images the sBIT check looped once per byte and the big-endian expansion wrote sig_bits[2*b+1]/[2*b+0] starting from b == channels. A 16-bit RGBA image with an sBIT chunk drives b to 4 and stores two bytes past the 8-byte sig_bits array. Bound the check by the component count and expand into sig_bits[2*b-1]/[2*b-2] from sig_bits[b-1].
---
 contrib/libtests/pngimage.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/contrib/libtests/pngimage.c b/contrib/libtests/pngimage.c
index 0758352206..7fc32f21ce 100644
--- a/contrib/libtests/pngimage.c
+++ b/contrib/libtests/pngimage.c
@@ -1159,7 +1159,7 @@ compare_read(struct display *dp, int applied_transforms)
          {
             int b;
 
-            for (b=0; 8*b<bpp; ++b)
+            for (b=0; b*bit_depth<bpp; ++b)
             {
                /* libpng should catch this; if not there is a security issue
                 * because an app (like this one) may overflow an array. In fact
@@ -1188,10 +1188,10 @@ compare_read(struct display *dp, int applied_transforms)
             case 16: /* Two bytes per component, big-endian */
                for (b = (bpp >> 4); b > 0; --b)
                {
-                  unsigned int sig = (unsigned int)(0xffff0000 >> sig_bits[b]);
+                  unsigned int sig = (unsigned int)(0xffff0000 >> sig_bits[b-1]);
 
-                  sig_bits[2*b+1] = (png_byte)sig;
-                  sig_bits[2*b+0] = (png_byte)(sig >> 8); /* big-endian */
+                  sig_bits[2*b-1] = (png_byte)sig;
+                  sig_bits[2*b-2] = (png_byte)(sig >> 8); /* big-endian */
                }
                break;