mirror of
https://github.com/OpenEPaperLink/OpenEPaperLink.git
synced 2026-03-20 23:04:30 +01:00
Integer division (w*h)/8 truncates when w*h is not a multiple of 8, allocating one byte too few. spr2color then writes past the end of the buffer, corrupting the heap. Use (w*h+7)/8 to round up correctly. Triggered by any tag whose width*height is not divisible by 8.