tree ed32cc1eb8e980a7c9ff4851c26a7e130c5354ea
parent a43c48fe781db54158a69f3e058a6740d8883e30
author Daniel Mueller <deso@posteo.net> 1492408425 -0700
committer Philip Tricca <philip.b.tricca@intel.com> 1493824815 -0700

fix off-by-one error in CheckOverflow

The overflow check as provided by CheckOverflow contains an off-by-one
error causing an out-of-bounds read by one byte to not be detected
properly. The used size should be calculated as
  usedSize = (INT64)(nextData - buffer) + size;
and not
  usedSize = (INT64)(nextData - buffer) - 1 + size;

For the latter case, consider the attempt of reading the very first two
bytes from a buffer of one byte size. 'usedSize' will be 1 (0x1000 -
0x1000 - 1 + 2). Because 'usedSize' is not greater than 'bufferSize'
(also 1), we will not detect the out-of-bounds read.
This change fixes the issue by removing the addend of -1.