swf: right input length for decompression

Also when compress_depth reaches buffer_len Bug: #4536.
4 years ago · f211a330dd
parent 8f8823b6f2
commit f211a330dd
1 changed files with 1 additions and 1 deletions
--- a/src/util-file-decompression.c
+++ b/src/util-file-decompression.c
@ -97,7 +97,7 @@ int FileSwfDecompression(const uint8_t *buffer, uint32_t buffer_len,
    }

    uint32_t compressed_data_len = 0;
-    if (compress_depth > 0 && compress_depth <= buffer_len) {
+    if (compress_depth > 0 && compress_depth <= buffer_len - offset) {
        compressed_data_len = compress_depth;
    } else {
        compressed_data_len = buffer_len - offset;