detect buffer overflows in RleUncompress
@@ -117,6 +117,11 @@ rleUncompress (int inLength, int maxLength, const signed char in[], char out[])
if (0 > (maxLength -= count + 1))
return 0;
+ // check the input buffer is big enough to contain
+ // byte to be duplicated
+ if (inLength < 0)
+ return 0;
+
memset(out, *(char*)in, count+1);
out += count+1;
