Fix uninitialized memory read in PCX loader (planes=3, bpp=8)

[fuowang]

Prevent information disclosure caused by reading uninitialized heap memory when width > bytes_per_line in 8-bit 3-plane PCX images. The existing MAX over-allocation only masked the out-of-bounds read but did not prevent uninitialized bytes from leaking into pixel data.

Add a validation check that rejects images where width exceeds bytes_per_line, as each plane provides only bytes_per_line bytes but the BGR expansion loop indexes by width.

CWE-457 (use of uninitialized variable)
Found during academic security research.

Fixes: #49

[danoli3]

Thank you! Will look into merging soon

…

On Thu, 9 Jul 2026 at 1:45 pm, Shuo Wang ***@***.***> wrote: Prevent information disclosure caused by reading uninitialized heap memory when width > bytes_per_line in 8-bit 3-plane PCX images. The existing MAX over-allocation only masked the out-of-bounds read but did not prevent uninitialized bytes from leaking into pixel data. Add a validation check that rejects images where width exceeds bytes_per_line, as each plane provides only bytes_per_line bytes but the BGR expansion loop indexes by width. CWE-457 (use of uninitialized variable) Found during academic security research. Fixes: #49 <#49> ------------------------------ You can view, comment on, or merge this pull request online at: #50 Commit Summary - a4473a4 <a4473a4> Fix uninitialized memory read in PCX loader (planes=3, bpp=8) File Changes (1 file <https://github.com/danoli3/FreeImage/pull/50/files>) - *M* Source/FreeImage/PluginPCX.cpp <https://github.com/danoli3/FreeImage/pull/50/files#diff-a371d0ea779cd5a5358b60ba395d77b685046d51757a7b7f14cae99cbd84de50> (7) Patch Links: - https://github.com/danoli3/FreeImage/pull/50.patch - https://github.com/danoli3/FreeImage/pull/50.diff — Reply to this email directly, view it on GitHub <#50?email_source=notifications&email_token=AAGK2HFW5MAIDPSU6G3BUS35D4IMLA5CNFSNUABEM5UWIORPF5TWS5BNNB2WEL2QOVWGYUTFOF2WK43UF42DAMJZGEZTMMZZG2THEZLBONXW5KTTOVRHGY3SNFRGKZFFMV3GK3TUVRTG633UMVZF6Y3MNFRWW>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAGK2HCA6QK36RT4VSLDR2L5D4IMLAVCNFSNUABEKJSXA33TNF2G64TZHMZDGNRUHE2TQNJ3JFZXG5LFHM2DQNBSHE3DONBYGOQXMAQ> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>