mirror of
https://github.com/OISF/suricata.git
synced 2026-10-12 02:07:10 +00:00
The on-demand buffer growth introduced for SWF decompression called lzma_decompress again from byte zero each time the output buffer filled. Because lzma-rs can buffer up to a dictionary before writing, a single SWF could be decoded repeatedly as the buffer grew, amplifying CPU use. This adds a depth-bounded Rust writer that asks C to grow the inspection buffer as decompressed bytes are emitted. This keeps a single lzma-rs stream alive, so the input is decoded only once. Ticket: #8829