int HexInStream::overrun(int itemSize, int nItems, bool wait) {
  if (itemSize > bufSize)
    throw Exception("HexInStream overrun: max itemSize exceeded");

  if (end - ptr != 0)
    memmove(start, ptr, end - ptr);

  end -= ptr - start;
  offset += ptr - start;
  ptr = start;

  while (end < ptr + itemSize) {
    int n = in_stream.check(2, 1, wait);
    if (n == 0) return 0;
    const U8* iptr = in_stream.getptr();
    const U8* eptr = in_stream.getend();
    int length = min((eptr - iptr)/2, start + bufSize - end);

    U8* optr = (U8*) end;
    for (int i=0; i<length; i++) {
      int v = 0;
      readHexAndShift(iptr[i*2], &v);
      readHexAndShift(iptr[i*2+1], &v);
      optr[i] = v;
    }

    in_stream.setptr(iptr + length*2);
    end += length;
  }

  if (itemSize * nItems > end - ptr)
    nItems = (end - ptr) / itemSize;

  return nItems;
}
The software writes data past the end, or before the beginning, of the intended buffer.