mirror of
https://github.com/wxWidgets/wxWidgets.git
synced 2026-08-21 06:19:36 +08:00
MarkLee131
edae38f44a
The PCX header's width and bytesperline are independent fields, never cross-validated. A header with width > bytesperline produces a small per-line buffer p and then reads p[i] for i < width past the buffer end (the 24-bit branch additionally reads p[i + 2 * bytesperline]). Reject the file when width exceeds bytesperline, or when either is non-positive. Closes #26441, #26443.