Description of problem:
pnmrotate: free(): invalid pointer 0x8a27be0!

Version-Release number of selected component (if applicable):
netpbm-progs-10.19-7

How reproducible:
#!/bin/bash
echo P2\ 1 1\ 255\ 0\ > tmp.pgm
pnmscale 4 tmp.pgm | pnmrotate 10 > tmp1.pgm

Steps to Reproduce:
see above
  
Actual results:
pnmrotate: outrows=5 bgxel red=0
pnmrotate: top left pixel red = 0
pnmrotate: outrows=5 bgxel red=0
pnmrotate: top left pixel red = 0
pnmrotate: outrows=5 bgxel red=0
pnmrotate: top left pixel red = 0
pnmrotate: outrows=5 bgxel red=0
pnmrotate: top left pixel red = 0
pnmrotate: outrows=5 bgxel red=0
pnmrotate: top left pixel red = 0
free(): invalid pointer 0x8330be0!


Expected results:
cat tmp1.pgm
P5
6 5
255


Additional info:
I'm - submitting this on behalf of a professor who often uses netpbm
package. I'm -in certainly not experienced user of netpbm, but I
think- I fixed it with the the small modification, for now. Likewise,
you'll find the program fixed in 10.22 . Plugging netpbm-10.22 as
source for -rebuilding the SRPM via netpbm.spec
fails -because of several patches included in netpbm-10.19 etc.
The user considers the netpbm-progs to be broken -likely because
he has shell scripts -that fail because of this problem. 
: root@regulus editor; diff -Naur pnmrotate.c pnmrotate.c.orig
--- pnmrotate.c 2004-06-15 09:48:35.403519181 -0500
+++ pnmrotate.c.orig    2004-06-15 09:47:57.226359735 -0500
@@ -342,8 +342,8 @@
     for (outrow = 0; outrow < outrows; ++outrow)
         outxels[outrow][col] = bgxel;

-/* pm_message("outrows=%d bgxel red=%d", outrows, PPM_GETR(bgxel));
-pm_message("top left pixel red = %d", PPM_GETR(outxels[0][0])); */
+pm_message("outrows=%d bgxel red=%d", outrows, PPM_GETR(bgxel));
+pm_message("top left pixel red = %d", PPM_GETR(outxels[0][0]));
     prevxel = bgxel;
     for (inrow = 0; inrow < inrows; ++inrow) {
         int const outrow = inrow + intnew0;
@@ -633,7 +633,7 @@
     }

     pnm_freerow( newxelrow );
-    pnm_freearray( temp2xels, newrows );
+    pnm_freearray( temp2xels, rows );
     pm_close( stdout );

     exit( 0 );