Fix panic on out-of-range LZ offset in decodeReader.copyBytes (#63)
A crafted archive can encode an LZ back-reference whose offset exceeds d.size+d.w. In that case (d.size + d.w - offset) is negative and Go's % keeps the sign, so the source index i becomes negative and the byte-by-byte copy d.win[i:d.w] panics with "slice bounds out of range". Compute the source index with a wrap that is always non-negative, mirroring the normalization already done for length on the preceding line. Valid archives keep offset < d.size so their decoding is unchanged; corrupt input now decodes to data that fails the checksum instead of crashing the reader. Co-authored-by: Chris (ChrisJr404) <11917633+ChrisJr404@users.noreply.github.com>
C
ChrisJr404 committed
0e391676b41b339c48c1fc938cbeca9e445a6ea2
Parent: e0ef93a
Committed by GitHub <noreply@github.com>
on 8/22/2026, 5:19:39 AM