From ad39298f6d641a8dcaf5074dc9c3e71dad6a9ab5 Mon Sep 17 00:00:00 2001
From: Pierre-Eric Pelloux-Prayer <pierre-eric@lanedo.com>
Date: Wed, 12 Mar 2014 17:02:58 +0100
Subject: [PATCH] broadway: make sure color/delta run length do not overflow

Fixes bug 723045.
---
 gdk/broadway/broadway-buffer.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/gdk/broadway/broadway-buffer.c b/gdk/broadway/broadway-buffer.c
index f1ce426d41..a03e12cdbc 100644
--- a/gdk/broadway/broadway-buffer.c
+++ b/gdk/broadway/broadway-buffer.c
@@ -228,7 +228,9 @@ encode_pixel (struct encoder *encoder, guint32 color, guint32 prev_color)
       (encoder->delta != delta &&
        encoder->delta_run > encoder->color_run) ||
 
-      (encoder->delta != delta && encoder->color != color))
+      (encoder->delta != delta && encoder->color != color) ||
+
+      (encoder->delta_run == 0xFFFFF || encoder->color_run == 0xFFFFF))
     {
       encode_run (encoder);