Re: "corrupted size vs. prev_size"

[Lars Ingebrigtsen]

Found it!

It's this bit:

          for (y = 0; y < subimg_height; ++y)
            for (x = 0; x < subimg_width; ++x)
              {
                int c = raster[y * subimg_width + x];
                if (transparency_color_index != c || disposal != DISPOSE_DO_NOT)
                  {
                    *(pixmap + x + subimg_left + (y + subimg_top) * width) =
                      pixel_colors[c];
                  }
              }

On some images, this calculation writes outside the pixmap area.

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no