png -- buffer overflow vulnerability on the row buffers

The starting offsets for the loops are calculated incorrectly which may cause a buffer overrun beyond the beginning of the row buffer. This will allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a buffer overflow attack on the row buffers.