}
if (buck_type == BUCKET_TYPE_V33_LIZARD) // decompression
{
- /* FIXME: Add checks for len<4 and other format violations */
+ if (ptr + 4 > end)
+ RET_ERR(EINVAL);
len = GET_U32(ptr);
ptr += 4;
byte *new_ptr = lizard_decompress_safe(ptr, buf->lizard, len);
struct odes *obj_read_bucket(struct buck2obj_buf *buf, struct mempool *pool, uns buck_type, uns buck_len, struct fastbuf *body, uns *body_start);
/* If body_start != NULL, then only the header is parsed and *body_start is
* set to the position of the body. This function does a plenty of optimizations
- * and if the body fastbuf is overwritable (body->can_overwrite), it can keep the
+ * and if the body fastbuf is overwritable (body->can_overwrite_buffer), it can keep the
* attribute values stored on their original locations in the fastbuf's buffer.
* However, no such things are performed when reading the header only.
*/