Sanity check for input buffer overruns in RLE uncompress

Signed-off-by: Peter Hillman <peterh@wetafx.co.nz>

OpenEXR/IlmImf/ImfRle.cpp

@@ -129,6 +129,11 @@ rleUncompress (int inLength, int maxLength, const signed char in[], char out[])
 	    if (0 > (maxLength -= count))
 		return 0;
 
+        // check the input buffer is big enough to contain
+        // 'count' bytes of remaining data
+        if (inLength < 0)
+          return 0;
+
         memcpy(out, in, count);
         out += count;
         in  += count;