commit a76d84043bcda3f36c60422e274b7edcd38fd972
Author: Simon Budig <simon@gimp.org>
Date:   Wed Dec 9 16:05:05 2009 +0100

    SGI: fix out of bounds writes
    
    The functions read_rle8() and read_rle16() didn't check if the addresses
    to which they wrote are in bounds when expanding runlength encoded data.

diff --git a/plug-ins/file-sgi/sgi-lib.c b/plug-ins/file-sgi/sgi-lib.c
index 7fd61d0..c26e24e 100644
--- a/plug-ins/file-sgi/sgi-lib.c
+++ b/plug-ins/file-sgi/sgi-lib.c
@@ -680,7 +680,7 @@ read_rle8(sgi_t *sgip,		/* I - SGI image to read from */
       return (-1);
     length ++;
 
-    count = ch & 127;
+    count = MIN (ch & 127, xsize);
     if (count == 0)
       break;
 
@@ -725,7 +725,7 @@ read_rle16(sgi_t *sgip,		/* I - SGI image to read from */
       return (-1);
     length ++;
 
-    count = ch & 127;
+    count = MIN (ch & 127, xsize);
     if (count == 0)
       break;
 
