--- deadwood-3.2.02/src/DwCompress.c	2012-02-29 01:59:53.000000000 -0600
+++ deadwood-3.2.03/src/DwCompress.c	2012-03-20 08:04:31.000000000 -0600
@@ -1,4 +1,4 @@
-/* Copyright (c) 2009-2010 Sam Trenholme
+/* Copyright (c) 2009-2012 Sam Trenholme
  *
  * TERMS
  *
@@ -41,7 +41,7 @@
         }
 
         t = offset;
-        if(t > in->len) {
+        if(t < 0 || t > in->len) {
                 return -1;
         }
         if(*(in->str + t) < 64) { /* Not a compression pointer */
@@ -68,7 +68,7 @@
 int32_t dwc_finish_name(dw_str *out, int32_t *delta, int32_t offset,
             int compress_followed, int32_t t) {
 
-        if(dw_assert_sanity(out) == -1) {
+        if(dw_assert_sanity(out) == -1 || offset < 0) {
                 return -1;
         }
 
@@ -98,7 +98,8 @@
         dw_str *tmp = 0;
 
         if(dw_assert_sanity(in) == -1 || dw_assert_sanity(out) == -1 ||
-                        dw_assert_sanity(q) == -1 || delta == 0) {
+                        dw_assert_sanity(q) == -1 || delta == 0 ||
+			where_dname < 0) {
                 return -1;
         }
 
@@ -214,7 +215,8 @@
         int32_t rdo = 0, rdlength = 0, delta = 0;
 
         if(dw_assert_sanity(in) == -1 || dw_assert_sanity(out) == -1 ||
-                        dw_assert_sanity(q) == -1) {
+                        dw_assert_sanity(q) == -1 || desc < 0 ||
+			offset < 0) {
                 return -1;
         }
 
@@ -236,6 +238,9 @@
                 delta = 0;
                 offset = dwc_decomp_dname(in,out,q,&delta,
                           offset);
+		if(offset < 0) {
+			goto catch_dwc_decomp_rddata;
+		}
                 rdlength = dw_fetch_u16(out,rdo);
                 rdlength += delta;
                 dw_put_u16(out,rdlength,rdo);
@@ -274,7 +279,7 @@
 
         if(dw_assert_sanity(in) == -1 || dw_assert_sanity(out) == -1 ||
                         dw_assert_sanity(q) == -1 ||
-                        dw_assert_sanity(stack) == -1) {
+                        dw_assert_sanity(stack) == -1 || offset < 0) {
                 return -1;
         }
 
@@ -378,7 +383,7 @@
         int c = 0, noloop = 0;
 
         if(dw_assert_sanity(a) == -1 || dw_assert_sanity(b) == -1 ||
-           a_o > a->len || b_o > b->len) {
+           a_o > a->len || b_o > b->len || a_o < 0 || b_o < 0) {
                 return -1;
         }
 
@@ -420,7 +425,8 @@
 
         place = c_o;
 
-        if(dw_assert_sanity(u) == -1 || dw_assert_sanity(c) == -1) {
+        if(dw_assert_sanity(u) == -1 || dw_assert_sanity(c) == -1 ||
+			u_o < 0 || u_o > u->len || c_o < 0 || c_o > c->len) {
                 return -1;
         }
 
@@ -505,7 +511,8 @@
         int count = 0, in_q_string = 0, len = 0;
         int32_t place = 0;
 
-        if(dw_assert_sanity(b) == -1 || dw_assert_sanity(h) == -1) {
+        if(dw_assert_sanity(b) == -1 || dw_assert_sanity(h) == -1 ||
+			b_o < 0 || b_o > b->len || h_o < 0 || h_o > h->len) {
                 return -1;
         }
         place = h_o;
@@ -574,7 +581,7 @@
         }
 
         for(count = 0; count < 300; count++) { /* Infinite loop protection */
-                if(place > dns->len) {
+                if(place > dns->len || place < 0) {
                         return -1; /* Error */
                 }
                 len=*(dns->str + place);
@@ -619,7 +626,8 @@
         int in_q = 0; /* Whether we're in the question string or not */
         int count = 0; /* Infinite loop protection */
 
-        if(dw_assert_sanity(u) == -1 || dw_assert_sanity(c) == -1) {
+        if(dw_assert_sanity(u) == -1 || dw_assert_sanity(c) == -1 ||
+			u_o < 0 || u_o > u->len) {
                 return -1;
         }
 
@@ -668,7 +676,8 @@
         dw_str *tmp = 0;
 
         if(dw_assert_sanity(u) == -1 || dw_assert_sanity(c) == -1 ||
-                        dw_assert_sanity(s) == -1) {
+                        dw_assert_sanity(s) == -1 || u_o < 0 ||
+			u_o > u->len) {
                 return -1;
         }
 
@@ -737,7 +746,8 @@
         int lead = 0, ndnames = 0, tail = 0;
 
         if(dw_assert_sanity(u) == -1 || dw_assert_sanity(c) == -1 ||
-                        dw_assert_sanity(s) == -1) {
+                        dw_assert_sanity(s) == -1 || desc < 0 ||
+			offset < 0 || offset > u->len) {
                 return -1;
         }
 
