Fix integer overflow in pnm2png height*sizeof(png_byte*) allocation

[XananasX7]

Summary

Fix a heap-buffer-overflow in pnm2png.c caused by an unchecked integer overflow in the row-pointer allocation.

Root Cause

row_pointers = (png_byte **)
               png_calloc(png_ptr, height * sizeof(png_byte *));

On 32-bit systems where sizeof(png_byte *) is 4, a crafted PNM image with height = 0x40000001 causes the multiplication to wrap:

0x40000001 * 4 = 0x1_0000_0004 → truncated to 0x4 (4 bytes)

png_calloc allocates only 4 bytes (room for 1 pointer). The subsequent loop writes height (1,073,741,825) pointers into this 4-byte buffer — an immediate heap-buffer-overflow. Confirmed with ASan/UBSan.

Fix

Add a PNG_SIZE_MAX guard before the multiplication, consistent with how libpng itself guards similar allocations internally:

if (height > PNG_SIZE_MAX / sizeof(png_byte *))
    png_error(png_ptr, "image height too large for row-pointer allocation");

Fixes #825.