File libpng16-CVE-2026-22695.patch of Package libpng16.42243

Index: libpng-1.6.8/pngread.c
===================================================================
--- libpng-1.6.8.orig/pngread.c
+++ libpng-1.6.8/pngread.c
@@ -3116,9 +3116,11 @@ png_image_read_direct_scaled(png_voidp a
        argument);
    png_imagep image = display->image;
    png_structrp png_ptr = image->opaque->png_ptr;
+   png_inforp info_ptr = image->opaque->info_ptr;
    png_bytep local_row = png_voidcast(png_bytep, display->local_row);
    png_bytep first_row = png_voidcast(png_bytep, display->first_row);
    ptrdiff_t row_bytes = display->row_bytes;
+   size_t copy_bytes = png_get_rowbytes(png_ptr, info_ptr);
    int passes;
 
    /* Handle interlacing. */
@@ -3148,7 +3150,7 @@ png_image_read_direct_scaled(png_voidp a
          png_read_row(png_ptr, local_row, NULL);
 
          /* Copy from local_row to user buffer. */
-         memcpy(output_row, local_row, (size_t)row_bytes);
+         memcpy(output_row, local_row, copy_bytes);
          output_row += row_bytes;
       }
    }