$OpenBSD: patch-wav_c,v 1.1 2004/07/31 14:18:14 naddy Exp $
--- wav.c.orig	Fri Jul 30 19:33:34 2004
+++ wav.c	Fri Jul 30 19:36:08 2004
@@ -917,6 +917,8 @@ int st_wavstartread(ft_t ft) 
 		} else if(strncmp(magic,"ICRD",4) == 0){
 			st_readdw(ft,&len); 
 			len = (len + 1) & ~1;
+			if (len > 254)
+			    break;
 			st_reads(ft,text,len);
 			if (strlen(ft->comment) + strlen(text) < 254)
 			{
@@ -926,6 +928,8 @@ int st_wavstartread(ft_t ft) 
 		} else if(strncmp(magic,"ISFT",4) == 0){
 			st_readdw(ft,&len); 
 			len = (len + 1) & ~1;
+			if (len > 254)
+			    break;
 			st_reads(ft,text,len);
 			if (strlen(ft->comment) + strlen(text) < 254)
 			{
