16c0dbf lzma: Make sure we don't dereference past array

1 file Authored by Konrad Rzeszutek Wilk 3 years ago, Committed by Daniel Kiper 3 years ago,
    lzma: Make sure we don't dereference past array
    
    The two dimensional array p->posSlotEncoder[4][64] is being dereferenced
    using the GetLenToPosState() macro which checks if len is less than 5,
    and if so subtracts 2 from it. If len = 0, that is 0 - 2 = 4294967294.
    Obviously we don't want to dereference that far out so we check if the
    position found is greater or equal kNumLenToPosStates (4) and bail out.
    
    N.B.: Upstream LZMA 18.05 and later has this function completely rewritten
    without any history.
    
    Fixes: CID 51526
    
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
    
        
file modified
+8 -2