1 files changed, 13 insertions, 1 deletions
diff --git a/fitz/filt_faxd.c b/fitz/filt_faxd.c
index d5d636f6..463d9de1 100644
--- a/fitz/filt_faxd.c
+++ b/fitz/filt_faxd.c
@@ -218,11 +218,23 @@ find_changing(const unsigned char *line, int x, int w)
 		 * we started from) */
 		m = mask[x & 7];
 	}
+	/* We have 'w' pixels (bits) in line. The last pixel that can be
+	 * safely accessed is the (w-1)th bit of line.
+	 * By taking W = w>>3, we know that the first W bytes of line are
+	 * full, with w&7 stray bits following. */
 	W = w>>3;
 	x >>= 3;
-	a = line[x];
+	a = line[x]; /* Safe as x < w => x <= w-1 => x>>3 <= (w-1)>>3 */
 	b = a ^ (a>>1);
 	b &= m;
+	if (x >= W)
+	{
+		/* Within the last byte already */
+		x = (x<<3) + clz[b];
+		if (x > w)
+			x = w;
+		return x;
+	}
 	while (b == 0)
 	{
 		if (++x >= W)