Commit b428adfa authored by Simon Budig's avatar Simon Budig Committed by Nils Philippsen

SGI: fix out of bounds writes

The functions read_rle8() and read_rle16() didn't check if the addresses
to which they wrote are in bounds when expanding runlength encoded data.
(cherry picked from commit 4d9724f2)
parent 88dfad9d
...@@ -681,7 +681,7 @@ read_rle8(sgi_t *sgip, /* I - SGI image to read from */ ...@@ -681,7 +681,7 @@ read_rle8(sgi_t *sgip, /* I - SGI image to read from */
return (-1); return (-1);
length ++; length ++;
count = ch & 127; count = MIN (ch & 127, xsize);
if (count == 0) if (count == 0)
break; break;
...@@ -726,7 +726,7 @@ read_rle16(sgi_t *sgip, /* I - SGI image to read from */ ...@@ -726,7 +726,7 @@ read_rle16(sgi_t *sgip, /* I - SGI image to read from */
return (-1); return (-1);
length ++; length ++;
count = ch & 127; count = MIN (ch & 127, xsize);
if (count == 0) if (count == 0)
break; break;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment