This patch hardens two image loaders against malformed input.
Sun Raster (RAS): prevents dimension truncation and related out-of-bounds access by using wider counters and checking allocation-size arithmetic. Commit: https://github.com/danoli3/FreeImage/commit/d474400d1434624fd3fc6f0503a6ac0a7fbc1b0b
IFF/LBM PBM RLE: bounds decoded writes to the scanline and handles truncated input and no-op runs so malformed files cannot overrun the buffer or hang the decoder. Commits: https://github.com/danoli3/FreeImage/commit/38fbe82 and https://github.com/danoli3/FreeImage/commit/ad068d2
These are robustness and denial-of-service hardening changes. The IFF bounds fix is related to the heap overflow reported in FreeImage issue #156 and addressed in PR #161; the truncated-input and hang handling is follow-up work. These changes are distinct from the earlier #156 heap-overflow fix.
Anonymous
Reported-by: Tristan Madani (Talence Security) @TristanInSec