swf: right input length for decompression

Also when compress_depth reaches buffer_len

Bug: #4536.

diff --git a/src/util-file-decompression.c b/src/util-file-decompression.c
index f7b5d00b027332b5656ccb8a48366bd4b71782a0..3eea38c55d886dee5bfe2fcf9008a98e58996e88 100644 (file)
--- a/src/util-file-decompression.c
+++ b/src/util-file-decompression.c
@@ -97,7 +97,7 @@ int FileSwfDecompression(const uint8_t *buffer, uint32_t buffer_len,
     }
 
     uint32_t compressed_data_len = 0;
-    if (compress_depth > 0 && compress_depth <= buffer_len) {
+    if (compress_depth > 0 && compress_depth <= buffer_len - offset) {
         compressed_data_len = compress_depth;
     } else {
         compressed_data_len = buffer_len - offset;