No input validation in the IHDR as to the number of bits in the palette of the image. As I understand it, you just create an arbitrary image with the palette in the IHDR tweaked to a large number of  bits, and watch as the process dies while trying to malloc() enough space to handle a palette that large.<p><a href="http:&#x2F;&#x2F;seclists.org&#x2F;oss-sec&#x2F;2015&#x2F;q4&#x2F;264" rel="nofollow">http:&#x2F;&#x2F;seclists.org&#x2F;oss-sec&#x2F;2015&#x2F;q4&#x2F;264</a>