"Fix integer overflow in write_is_viewer"
https://github.com/mupen64plus/mupen64plus-core/pull/1123

Index: src/device/cart/is_viewer.c
--- src/device/cart/is_viewer.c.orig
+++ src/device/cart/is_viewer.c
@@ -55,13 +55,15 @@ void write_is_viewer(void* opaque, uint32_t address, u
     {
         if (word > 0)
         {
-            /* make sure we don't overflow the buffer */
-            if (is_viewer->buffer_pos + word > IS_BUFFER_SIZE)
+            /* make sure we don't overflow the integer or the buffer  */
+            if (is_viewer->buffer_pos > IS_BUFFER_SIZE 
+                || word > IS_BUFFER_SIZE
+                || is_viewer->buffer_pos + word > IS_BUFFER_SIZE )
             {
                 /* reset buffer */
                 memset(is_viewer->output_buffer, 0, IS_BUFFER_SIZE);
                 is_viewer->buffer_pos = 0;
-                DebugMessage(M64MSG_WARNING, "IS64: prevented buffer overflow, cleared buffer");
+                DebugMessage(M64MSG_WARNING, "IS64: prevented integer overflow, cleared buffer");
                 return;
             }
 
