diff -up cups-1.2.4/filter/image-sgilib.c.CVE-2008-3639 cups-1.2.4/filter/image-sgilib.c --- cups-1.2.4/filter/image-sgilib.c.CVE-2008-3639 2005-10-02 05:25:52.000000000 +0100 +++ cups-1.2.4/filter/image-sgilib.c 2008-09-30 13:03:01.000000000 +0100 @@ -610,13 +610,14 @@ read_rle8(FILE *fp, /* I - Fi if (ch & 128) { for (i = 0; i < count; i ++, row ++, xsize --, length ++) - *row = getc(fp); + if (xsize > 0) + *row = getc(fp); } else { ch = getc(fp); length ++; - for (i = 0; i < count; i ++, row ++, xsize --) + for (i = 0; i < count && xsize > 0; i ++, row ++, xsize --) *row = ch; } } @@ -655,14 +656,15 @@ read_rle16(FILE *fp, /* I - F if (ch & 128) { for (i = 0; i < count; i ++, row ++, xsize --, length ++) - *row = getshort(fp); + if (xsize > 0) + *row = getshort(fp); } else { ch = getshort(fp); length ++; - for (i = 0; i < count; i ++, row ++, xsize --) - *row = ch; + for (i = 0; i < count && xsize > 0; i ++, row ++, xsize --) + *row = ch; } }