add error check to RL decompression

1 files changed, 6 insertions, 0 deletions

diff --git a/tools/gbagfx/rl.c b/tools/gbagfx/rl.c
index e90ad808b..968c9347e 100644
--- a/tools/gbagfx/rl.c
+++ b/tools/gbagfx/rl.c
@@ -33,6 +33,9 @@ unsigned char *RLDecompress(unsigned char *src, int srcSize, int *uncompressedSi
             int length = (flags & 0x7F) + 3;
             unsigned char data = src[srcPos++];
 
+            if (destPos + length > destSize)
+                goto fail;
+
             for (int i = 0; i < length; i++)
                 dest[destPos++] = data;
         }
@@ -40,6 +43,9 @@ unsigned char *RLDecompress(unsigned char *src, int srcSize, int *uncompressedSi
         {
             int length = (flags & 0x7F) + 1;
 
+            if (destPos + length > destSize)
+                goto fail;
+
             for (int i = 0; i < length; i++)
                 dest[destPos++] = src[srcPos++];
         }