Commit b428adfa authored by Simon Budig's avatar Simon Budig Committed by Nils Philippsen

SGI: fix out of bounds writes

The functions read_rle8() and read_rle16() didn't check if the addresses
to which they wrote are in bounds when expanding runlength encoded data.
(cherry picked from commit 4d9724f2)
parent 88dfad9d
......@@ -681,7 +681,7 @@ read_rle8(sgi_t *sgip, /* I - SGI image to read from */
return (-1);
length ++;
count = ch & 127;
count = MIN (ch & 127, xsize);
if (count == 0)
break;
......@@ -726,7 +726,7 @@ read_rle16(sgi_t *sgip, /* I - SGI image to read from */
return (-1);
length ++;
count = ch & 127;
count = MIN (ch & 127, xsize);
if (count == 0)
break;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment