diff
9   runLength = (*pbOrderHdr) & g_MaskRegularRunLength;
10  if (runLength == 0) {
+11    if (pbOrderHdr + 1 >= pbEnd)
+12      return ERROR_INVALID_DATA; // Or appropriate error code
+13    // Now safe to use pbOrderHdr + 1
14  }
15  if (!buffer_within_range(pbOrderHdr, 1, pbEnd))
