PR7691662.diff   [plain text]

--- lib/rtapelib.c.orig	2010-10-04 15:49:08.000000000 -0700
+++ lib/rtapelib.c	2010-10-04 15:51:05.000000000 -0700
@@ -570,7 +570,8 @@
 
   sprintf (command_buffer, "R%lu\n", (unsigned long) length);
   if (do_command (handle, command_buffer) == -1
-      || (status = get_status (handle)) == SAFE_READ_ERROR)
+      || (status = get_status (handle)) == SAFE_READ_ERROR
+      || status > length)
     return SAFE_READ_ERROR;
 
   for (counter = 0; counter < status; counter += rlen, buffer += rlen)