From: Philippe Antoine <contact@catenacyber.fr>
Date: Thu, 1 Jul 2021 13:04:58 +0000 (+0200)
Subject: swf: right input length for decompression
X-Git-Tag: suricata-5.0.8~5
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e52c8507627f70e4606c0eb034e90630d3f9969c;p=thirdparty%2Fsuricata.git

swf: right input length for decompression

Also when compress_depth reaches buffer_len

Bug: #4536.
(cherry picked from commit f211a330ddfbac8a6d0b85ea5f2ee0fcc1ccad3d)
---

diff --git a/src/util-file-decompression.c b/src/util-file-decompression.c
index f7b5d00b02..3eea38c55d 100644
--- a/src/util-file-decompression.c
+++ b/src/util-file-decompression.c
@@ -97,7 +97,7 @@ int FileSwfDecompression(const uint8_t *buffer, uint32_t buffer_len,
     }
 
     uint32_t compressed_data_len = 0;
-    if (compress_depth > 0 && compress_depth <= buffer_len) {
+    if (compress_depth > 0 && compress_depth <= buffer_len - offset) {
         compressed_data_len = compress_depth;
     } else {
         compressed_data_len = buffer_len - offset;