Only decode as many rows as fit in the output buffer in the fax decoder, thus allowing garbage data at the end of fax images with no RTC and no Rows count.

1 files changed, 4 insertions, 0 deletions

diff --git a/fitz/filt_faxd.c b/fitz/filt_faxd.c
index 66410660..e4a81724 100644
--- a/fitz/filt_faxd.c
+++ b/fitz/filt_faxd.c
@@ -684,6 +684,10 @@ eol:
 			eatbits(fax, (8 - fax->bidx) & 7);
 	}
 
+	/* no more space in output, don't decode the next line yet */
+	if (p == buf + len)
+		return p - buf;
+
 	goto loop;
 
 rtc: