https://github.com/ImageMagick/ImageMagick/issues/1716

diff --git a/coders/png.c b/coders/png.c
index 4411a72c211283b1b40f0b4bc68206a586405d3e..7cb098da965d0020c89810ed76d3f89184218d57 100644 (file)
--- a/coders/png.c
+++ b/coders/png.c
@@ -11390,11 +11390,11 @@ static MagickBooleanType WriteOnePNGImage(MngInfo *mng_info,
       (void) LogMagickEvent(CoderEvent,GetMagickModule(),
         "    Allocating %.20g bytes of memory for pixels",(double) rowbytes);
     }
-  pixel_info=AcquireVirtualMemory(rowbytes,sizeof(*ping_pixels));
+  pixel_info=AcquireVirtualMemory(rowbytes+256,sizeof(*ping_pixels));
   if (pixel_info == (MemoryInfo *) NULL)
     png_error(ping,"Allocation of memory for pixels failed");
   ping_pixels=(unsigned char *) GetVirtualMemoryBlob(pixel_info);
-  (void) memset(ping_pixels,0,rowbytes*sizeof(*ping_pixels));
+  (void) memset(ping_pixels,0,(rowbytes+256)*sizeof(*ping_pixels));
   /*
     Initialize image scanlines.
   */