Fix bugs in RunLengthDecode filter.

1 files changed, 7 insertions, 2 deletions

diff --git a/fitz/filt_basic.c b/fitz/filt_basic.c
index a0369282..14eefb19 100644
--- a/fitz/filt_basic.c
+++ b/fitz/filt_basic.c
@@ -331,19 +331,23 @@ readrld(fz_stream *stm, unsigned char *buf, int len)
 
 		if (state->run < 128)
 		{
-			while (p < ep && state->n--)
+			while (p < ep && state->n)
 			{
 				int c = fz_readbyte(state->chain);
 				if (c < 0)
 					return fz_throw("premature end of data in run length decode");
 				*p++ = c;
+				state->n--;
 			}
 		}
 
 		if (state->run > 128)
 		{
-			while (p < ep && state->n--)
+			while (p < ep && state->n)
+			{
 				*p++ = state->c;
+				state->n--;
+			}
 		}
 	}
 
@@ -364,6 +368,7 @@ fz_openrld(fz_stream *chain)
 	fz_rld *state;
 
 	state = fz_malloc(sizeof(fz_rld));
+	state->chain = chain;
 	state->run = 0;
 	state->n = 0;
 	state->c = 0;