SDL_image: Fix out-of-bounds read in PCX loader. (1bcd8)

From 1bcd894bfe5a540c6eeeda964964c4d74e765384 Mon Sep 17 00:00:00 2001
From: Ozkan Sezer <[EMAIL REDACTED]>
Date: Sat, 17 Jul 2021 01:32:00 +0300
Subject: [PATCH] Fix out-of-bounds read in PCX loader.

Closes: https://github.com/libsdl-org/SDL_image/issues/164
---
 IMG_pcx.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/IMG_pcx.c b/IMG_pcx.c
index fd2e039..c406eff 100644
--- a/IMG_pcx.c
+++ b/IMG_pcx.c
@@ -222,12 +222,14 @@ SDL_Surface *IMG_LoadPCX_RW(SDL_RWops *src)
  		} else if(src_bits == 24) {
 			/* de-interlace planes */
 			Uint8 *innerSrc = buf;
+			Uint8 *end1 = buf+bpl;
 			int plane;
 			for(plane = 0; plane < pcxh.NPlanes; plane++) {
 				int x;
 				Uint8 *dst = row + plane;
+				Uint8 *end2= row + surface->pitch;
 				for(x = 0; x < width; x++) {
-					if (dst >= row+surface->pitch) {
+					if (innerSrc >= end1 || dst >= end2) {
 						error = "decoding out of bounds (corrupt?)";
 						goto done;
 					}