Index: class.c ================================================================== --- class.c +++ class.c @@ -2076,21 +2076,21 @@ unsigned char*p; if(!data) return; for(i=0;i=0x4000) fatal("Malformed CLASS.DEF lump\n"); + if(n>=0x4000) fatal("Malformed CLASS.DEF lump (invalid class number %d)\n",n); i+=2; p=data+i; while(i=0x4100) fatal("Malformed CLASS.DEF lump\n"); + if(n<256 || n>=0x4100) fatal("Malformed CLASS.DEF lump (invalid message number %d)\n",n); n-=256; i+=2; p=data+i; while(i>8); + sqlite3_str_appendchar(s,1,(i+256)>>8); sqlite3_str_appendall(s,messages[i]); sqlite3_str_appendchar(s,1,0); } // End of data size=sqlite3_str_length(s);