diff --git a/ChangeLog b/ChangeLog
index 1ef5876..2927f96 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2005-06-28  Johannes E. Schindelin  <Johannes.Schindelin@gmx.de>
+	* libvncclient/zrle.c: fix handling of raw and fill subtypes
+	  (off-by-one and off-by-many bug)
+
 2005-06-27  Karl Runge <runge@karlrunge.com>
 	* libvncserver/main.c: move deferUpdateTime and maxRectsPerUpdate
 	  defaults to before rfbProcessArguments().
diff --git a/TODO b/TODO
index c29e71b..10cf756 100644
--- a/TODO
+++ b/TODO
@@ -1,7 +1,6 @@
 immediate:
 ----------
 
-fix ZRLE errors (-9)
 VisualNaCro testing
 test IRIX -overlay (x11vnc)
 java vncviewer doesn't do colour cursors?
diff --git a/libvncclient/zrle.c b/libvncclient/zrle.c
index 53ae6f1..9061910 100644
--- a/libvncclient/zrle.c
+++ b/libvncclient/zrle.c
@@ -229,6 +229,7 @@ static int HandleZRLETile(rfbClient* client,
 					((CARDBPP*)client->frameBuffer)[j+i] = UncompressCPixel(buffer);
 #else
 			CopyRectangle(client, buffer, x, y, w, h);
+			buffer+=w*h*REALBPP/8;
 #endif
 			break;
 		}
@@ -241,6 +242,8 @@ static int HandleZRLETile(rfbClient* client,
 				
 			FillRectangle(client, x, y, w, h, color);
 
+			buffer+=REALBPP/8;
+
 			break;
 		}
 		case 2 ... 127: /* packed Palette */