brush masks: more protection against buffer overflows