Fix LZ4 decompressor data leak when match offset is zero

When match offset is zero, the decompressor copies
pre-existing data from the decompression buffer.

Author: martint

src/main/java/io/airlift/compress/v3/lz4/Lz4RawDecompressor.java

@@ -114,7 +114,7 @@ public static int decompress(
             input += SIZE_OF_SHORT;
 
             long matchAddress = output - offset;
-            if (matchAddress < outputAddress) {
+            if (matchAddress < outputAddress || matchAddress >= output) {
                 throw new MalformedInputException(input - inputAddress, "offset outside destination buffer");
             }
 

src/test/java/io/airlift/compress/v3/lz4/AbstractTestLz4.java

@@ -63,6 +63,6 @@ void testMatchLengthOverflow()
         byte[] data = buffer.toByteArray();
 
         assertThatThrownBy(() -> getDecompressor().decompress(data, 0, data.length, new byte[2048], 0, 2048))
-                .hasMessageMatching("Malformed input.*|Unknown error occurred.*");
+                .hasMessageMatching("Malformed input.*|Unknown error occurred.*|offset outside destination buffer.*");
     }
 }

src/test/java/io/airlift/compress/v3/lz4/TestLz4.java

@@ -15,9 +15,13 @@
 
 import io.airlift.compress.v3.Compressor;
 import io.airlift.compress.v3.Decompressor;
+import io.airlift.compress.v3.MalformedInputException;
 import io.airlift.compress.v3.thirdparty.JPountzLz4Compressor;
 import io.airlift.compress.v3.thirdparty.JPountzLz4Decompressor;
 import net.jpountz.lz4.LZ4Factory;
+import org.junit.jupiter.api.Test;
+
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
 
 class TestLz4
         extends AbstractTestLz4
@@ -45,4 +49,13 @@ protected Decompressor getVerifyDecompressor()
     {
         return new JPountzLz4Decompressor(LZ4Factory.fastestInstance());
     }
+
+    @Test
+    void testZeroMatchOffset()
+    {
+        byte[] compressed = new byte[] {15, 0, 0, -1, -1, -118, 49, -1, -1, 0};
+        assertThatThrownBy(() -> getDecompressor().decompress(compressed, 0, compressed.length, new byte[1024], 0, 1024))
+                .isInstanceOf(MalformedInputException.class)
+                .hasMessageContaining("offset outside destination buffer: offset=3");
+    }
 }