1 files changed, 5 insertions, 0 deletions

diff --git a/applypatch/bspatch.c b/applypatch/bspatch.c
index 2e80f81d0..1dc7ab10b 100644
--- a/applypatch/bspatch.c
+++ b/applypatch/bspatch.c
@@ -205,6 +205,11 @@ int ApplyBSDiffPatchMem(const unsigned char* old_data, ssize_t old_size,
         ctrl[1] = offtin(buf+8);
         ctrl[2] = offtin(buf+16);
 
+        if (ctrl[0] < 0 || ctrl[1] < 0) {
+            printf("corrupt patch (negative byte counts)\n");
+            return 1;
+        }
+
         // Sanity check
         if (newpos + ctrl[0] > *new_size) {
             printf("corrupt patch (new file overrun)\n");