• src/list.c (from_header): Check for the end of field after leading byte (0x80 or 0xff) of base-256 encoded header value.

If the 12 byte long mtime header field is set to a value consisting of 11 whitespaces (or '\0' and 10 whitespaces)
followed by 0xff or 0x80 byte, heap buffer overflow occurs.

In the base-256 decoding routine, the where pointer gets incremented after reading the leading byte (0x80 or 0xff),
but no check for the end of the field is done before further reading. This may lead to out-of-bounds read and a jump
depending on unitialised value. In this case the existing check does not kick in, because the
where is already > lim.

Patch fixing this problem is attached.