c
< 	if (!buffer_within_range(pbOrderHdr, 1, pbEnd))
---
> 	if (!buffer_within_range(pbOrderHdr, 1, pbEnd) || runLength > (pbEnd - pbOrderHdr - 1))
