Test for buffer overrun when unpacking RLE.

This commit is contained in:
Andy McFadden 2006-12-02 20:05:56 +00:00
parent cced2e7ab4
commit 8aab8caff1
1 changed files with 5 additions and 0 deletions

View File

@ -1248,6 +1248,11 @@ Nu_ExpandRLE(LZWExpandState* lzwState, const uchar* inbuf,
if (uch == rleEscape) {
uch = *inbuf++;
count = *inbuf++;
if (outbuf + count >= outbufend) {
/* don't overrun buffer */
Assert(outbuf != outbufend);
break;
}
while (count-- >= 0)
*outbuf++ = uch;
} else {