> Having bounds checks on the destination buffer would have avoided the problem. Since the access to the buffer happens inside libpng, this means libpng should

> Having bounds checks on the destination buffer would have avoided the problem. Since the access to the buffer happens inside libpng, this means libpng should have bounds checks compiled in according to your argument. (Hoping that the compiler can elide them by seeing through the library interface is but wishful thinking.) Would you rather have a slower version of libpng that defends against screwups of the calling code, or a faster version that assumes the calling code is sane? Not an obvious choice to me.