SIGN IN SIGN UP

Fix panic on out-of-range LZ offset in decodeReader.copyBytes (#63)

A crafted archive can encode an LZ back-reference whose offset exceeds
d.size+d.w. In that case (d.size + d.w - offset) is negative and Go's %
keeps the sign, so the source index i becomes negative and the
byte-by-byte copy d.win[i:d.w] panics with "slice bounds out of range".

Compute the source index with a wrap that is always non-negative, mirroring
the normalization already done for length on the preceding line. Valid
archives keep offset < d.size so their decoding is unchanged; corrupt input
now decodes to data that fails the checksum instead of crashing the reader.

Co-authored-by: Chris (ChrisJr404) <11917633+ChrisJr404@users.noreply.github.com>
C
ChrisJr404 committed
0e391676b41b339c48c1fc938cbeca9e445a6ea2
Parent: e0ef93a
Committed by GitHub <noreply@github.com> on 8/22/2026, 5:19:39 AM