An invalid write may occur in optipng before version 0.7.6 while processing bitmap images due to `crt_row’ being (inc|dec)remented without any boundary checking when encountering delta escapes.