fix LZW data alloc size calculation

Author: dloebl

src/cgif_raw.c

@@ -300,7 +300,7 @@ static uint32_t create_byte_list_block(uint8_t *byteList, uint8_t *byteListBlock
 /* create all LZW raster data in GIF-format */
 static int LZW_GenerateStream(LZWResult* pResult, const uint32_t numPixel, const uint8_t* pImageData, const uint16_t initDictLen, const uint8_t initCodeLen){
   LZWGenState* pContext;
-  uint32_t     lzwPos, bytePos;
+  uint32_t     lzwPos, bytePos, entriesPerCycle, maxResets;
   uint32_t     bytePosBlock;
   int          r;
   // TBD recycle LZW tree list and map (if possible) to decrease the number of allocs
@@ -310,7 +310,11 @@ static int LZW_GenerateStream(LZWResult* pResult, const uint32_t numPixel, const
   pContext->pTreeMap   = malloc(((MAX_DICT_LEN / 2) + 1) * (initDictLen * sizeof(uint16_t))); // TBD check return value of malloc
   pContext->numPixel   = numPixel;
   pContext->pImageData = pImageData;
-  pContext->pLZWData   = malloc(sizeof(uint16_t) * (numPixel + 2)); // TBD check return value of malloc
+  // Buffer must hold at max (conservative upper bound): 1 initial clear + numPixel data codes + N reset clears + 1 termination
+  // where N = max dictionary resets = ceil(numPixel / (MAX_DICT_LEN - initDictLen - 2))
+  entriesPerCycle = MAX_DICT_LEN - initDictLen;
+  maxResets = (numPixel + entriesPerCycle - 1) / entriesPerCycle;
+  pContext->pLZWData   = malloc(sizeof(uint16_t) * (numPixel + 2 + maxResets));  // TBD check return value of malloc
   pContext->LZWPos     = 0;
 
   // actually generate the LZW sequence.