broadway: make sure color/delta run length do not overflow

Fixes bug 723045.

diff --git a/gdk/broadway/broadway-buffer.c b/gdk/broadway/broadway-buffer.c
index f1ce426d41f28311143e3689085a1aca59c1f33e..a03e12cdbc3b1193567ea887e6191c54b3787d06 100644 (file)
--- a/gdk/broadway/broadway-buffer.c
+++ b/gdk/broadway/broadway-buffer.c
@@ -228,7 +228,9 @@ encode_pixel (struct encoder *encoder, guint32 color, guint32 prev_color)
       (encoder->delta != delta &&
        encoder->delta_run > encoder->color_run) ||
 
-      (encoder->delta != delta && encoder->color != color))
+      (encoder->delta != delta && encoder->color != color) ||
+
+      (encoder->delta_run == 0xFFFFF || encoder->color_run == 0xFFFFF))
     {
       encode_run (encoder);