diff -urNp a/IlmImf/ImfRleCompressor.cpp b/IlmImf/ImfRleCompressor.cpp --- a/IlmImf/ImfRleCompressor.cpp 2020-06-02 12:29:00.823667417 +0200 +++ b/IlmImf/ImfRleCompressor.cpp 2020-06-02 12:32:51.134011377 +0200 @@ -135,6 +135,11 @@ rleUncompress (int inLength, int maxLeng if (0 > (maxLength -= count)) return 0; + // check the input buffer is big enough to contain + // 'count' bytes of remaining data + if (inLength < 0) + return 0; + while (count-- > 0) *out++ = *(char *) (in++); }