From e52c8507627f70e4606c0eb034e90630d3f9969c Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Thu, 1 Jul 2021 15:04:58 +0200 Subject: [PATCH] swf: right input length for decompression Also when compress_depth reaches buffer_len Bug: #4536. (cherry picked from commit f211a330ddfbac8a6d0b85ea5f2ee0fcc1ccad3d) --- src/util-file-decompression.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util-file-decompression.c b/src/util-file-decompression.c index f7b5d00b02..3eea38c55d 100644 --- a/src/util-file-decompression.c +++ b/src/util-file-decompression.c @@ -97,7 +97,7 @@ int FileSwfDecompression(const uint8_t *buffer, uint32_t buffer_len, } uint32_t compressed_data_len = 0; - if (compress_depth > 0 && compress_depth <= buffer_len) { + if (compress_depth > 0 && compress_depth <= buffer_len - offset) { compressed_data_len = compress_depth; } else { compressed_data_len = buffer_len - offset; -- 2.47.2