RootCauseunvalidated
grub_png_convert_image() advances destination pointer by 4 bytes per pixel for 16-bit gray images — the destination bitmap is allocated as RGB_888 (3 bytes/pixel). Tension: causing heap OOB write of width*height bytes past the bitmap buffer. Outcome: stride mismatch.
ece40128-c356-45b3-92c6-42fbd35d4ed9
grub_png_convert_image() advances destination pointer by 4 bytes per pixel for 16-bit gray images — the destination bitmap is allocated as RGB_888 (3 bytes/pixel). Tension: causing heap OOB write of width*height bytes past the bitmap buffer. Outcome: stride mismatch.