popi patchlevel 3

[nelson at PEAR.ECS.CLARKSON.EDU]

The routine ImgAlloc found in io.c seems to have a bug.  First it mallocs
an array of pointers, then fills that array in with more malloced pointers.
Now, since the array is accessed using the y coordinate, you would think
that the size of the array would be related to Ysize.  Instead, a reference
is made to Xsize (See below).  This seems wrong to me.
-russ


pixel_t **
ImgAlloc()
{
    pixel_t		**img,
    			**linep,
			**imgend;

    noerr = TRUE;
    if ((img = (pixel_t **) LINT_CAST(Emalloc((unsigned)Xsize * sizeof(pixel_t *)))) == 0)
	return (pixel_t **) 0;

    imgend = &img[Ysize];
    for (linep = img; linep != imgend; ++linep)
	*linep = (pixel_t *) Emalloc((unsigned)Xsize * sizeof (pixel_t));