Sanity check for input buffer overruns in RLE uncompress
@@ -129,6 +129,11 @@ rleUncompress (int inLength, int maxLength, const signed char in[], char out[])
if (0 > (maxLength -= count))
return 0;
+ // check the input buffer is big enough to contain
+ // 'count' bytes of remaining data
+ if (inLength < 0)
+ return 0;
+
memcpy(out, in, count);
out += count;
in += count;
