Why Is the Patch Applied to png_combine_row Instead of png_read_IDAT_data? (PNG004)

[null1024-ws]

The CVE CVE-2015-0973 mentions a buffer overflow in png_read_IDAT_data, which suggests the vulnerability is related to handling large width values in IDAT data. However, the patch is applied to the png_combine_row function in pngrutil.c.

Could you clarify why the patch was placed in png_combine_row instead of addressing the issue directly in png_read_IDAT_data?

Understanding the reasoning behind this decision would help in evaluating the scope of the fix and its implications on other parts of the code.