GRUB2 PNG Loader Heap Buffer Overflow Due to Off-by-One in Size Calculation

GRUB2 PNG loader heap buffer overflow: buffer allocated at line 321 with size image_height * row_bytes, but code expects to write image_height * (row_bytes + 1) bytes including PNG filter bytes