commit 96cec681b0a97b2ccc369ccde072c44fba915e0f
Author: Nils Philippsen <nils@redhat.com>
Date:   Thu Dec 3 16:18:58 2009 +0100

    SGI: fix out of bounds writes
    
    The functions read_rle8() and read_rle16() didn't check if the addresses
    to which they wrote are in bounds when expanding runlength encoded data.

diff --git a/plug-ins/file-sgi/sgi-lib.c b/plug-ins/file-sgi/sgi-lib.c
index 7fd61d0..3931bf3 100644
--- a/plug-ins/file-sgi/sgi-lib.c
+++ b/plug-ins/file-sgi/sgi-lib.c
@@ -686,14 +686,14 @@ read_rle8(sgi_t *sgip,		/* I - SGI image to read from */
 
     if (ch & 128)
     {
-      for (i = 0; i < count; i ++, row ++, xsize --, length ++)
+      for (i = 0; i < count && xsize > 0; i ++, row ++, xsize --, length ++)
         *row = getc(sgip->file);
     }
     else
     {
       ch = getc(sgip->file);
       length ++;
-      for (i = 0; i < count; i ++, row ++, xsize --)
+      for (i = 0; i < count && xsize > 0; i ++, row ++, xsize --)
         *row = ch;
     };
   };
@@ -731,14 +731,14 @@ read_rle16(sgi_t *sgip,		/* I - SGI image to read from */
 
     if (ch & 128)
     {
-      for (i = 0; i < count; i ++, row ++, xsize --, length ++)
+      for (i = 0; i < count && xsize > 0; i ++, row ++, xsize --, length ++)
         *row = getshort(sgip);
     }
     else
     {
       ch = getshort(sgip);
       length ++;
-      for (i = 0; i < count; i ++, row ++, xsize --)
+      for (i = 0; i < count && xsize > 0; i ++, row ++, xsize --)
         *row = ch;
     };
   };
