CVE-2021-3695: GRUB2 PNG loader heap overflow in 16-bit grayscale conversion (d1 += 4 stride bug)

GRUB2's PNG image loader (grub-core/video/readers/png.c) has a heap buffer overflow in grub_png_convert_image() when decoding a 16-bit grayscale PNG without an alpha channel. The bitmap output buffer is allocated for 3 bytes/pixel (GRUB_VIDEO_BLIT_FORMAT_RGB_888 — RGB without alpha), but the conversion loop for the 16-bit gray without alpha case (case 2, is_16bit=1) uses d1 += 4 (4 bytes/pixel stride), writing N-1 extra bytes beyond the end of the heap buffer for an N-pixel image. Any image larger than 1x1 triggers this overflow. CVE-2021-3695.