--- /n/sources/plan9/sys/src/cmd/jpg/readtga.c	Tue Feb  3 06:00:08 2009
+++ /sys/src/cmd/jpg/readtga.c	Wed Sep 23 00:00:00 2026
@@ -141,11 +141,14 @@
 			len += 1;	/* run of zero is meaningless */
 			if(luma(bp, l, 1) != 1)
 				break;
-			for(i = 0; i < len && got < num; i++)
-				l[i+1] = *l;
+			for(i = 1; i < len && got+i < num; i++)
+				l[i] = *l;
+			len = i;
 		}
 		else{
 			len += 1;	/* raw block of zero is meaningless */
+			if(got+len > num)
+				len = num-got;
 			if(luma(bp, l, len) != len)
 				break;
 		}
@@ -212,14 +215,17 @@
 			len += 1;	/* run of zero is meaningless */
 			if(rgba(bp, bpp, r, g, b, 1) != 1)
 				break;
-			for(i = 0; i < len-1 && got < num; i++){
-				r[i+1] = *r;
-				g[i+1] = *g;
-				b[i+1] = *b;
+			for(i = 1; i < len && got+i < num; i++){
+				r[i] = *r;
+				g[i] = *g;
+				b[i] = *b;
 			}
+			len = i;
 		}
 		else{
 			len += 1;	/* raw block of zero is meaningless */
+			if(got+len > num)
+				len = num-got;
 			if(rgba(bp, bpp, r, g, b, len) != len)
 				break;
 		}