$OpenBSD: patch-src_kernel_qimage_cpp,v 1.1 2004/08/24 15:46:55 espie Exp $
--- src/kernel/qimage.cpp.orig	Mon Apr 19 11:36:05 2004
+++ src/kernel/qimage.cpp	Tue Aug 24 10:58:24 2004
@@ -4818,6 +4818,7 @@ bool read_dib( QDataStream& s, int offse
 	if ( comp == BMP_RLE8 ) {		// run length compression
 	    int x=0, y=0, b;
 	    register uchar *p = line[h-1];
+	    const uchar *endp = line[h-1]+w;
 	    while ( y < h ) {
 		if ( (b=d->getch()) == EOF )
 		    break;
@@ -4835,9 +4836,20 @@ bool read_dib( QDataStream& s, int offse
 			case 2:			// delta (jump)
 			    x += d->getch();
 			    y += d->getch();
+
+			    // Protection
+			    if ( (uint)x >= (uint)w )
+				x = w-1;
+			    if ( (uint)y >= (uint)h )
+				y = h-1;
+
 			    p = line[h-y-1] + x;
 			    break;
 			default:		// absolute mode
+			    // Protection
+			    if ( p + b > endp )
+				b = endp-p;
+
 			    if ( d->readBlock( (char *)p, b ) != b )
 				return FALSE;
 			    if ( (b & 1) == 1 )
@@ -4846,6 +4858,10 @@ bool read_dib( QDataStream& s, int offse
 			    p += b;
 		    }
 		} else {			// encoded mode
+		    // Protection
+		    if ( p + b > endp )
+			b = endp-p;
+
 		    memset( p, d->getch(), b ); // repeat pixel
 		    x += b;
 		    p += b;
