Insufficient checks around R__unzip_header

[jblomer]

Check duplicate issues.

• Checked for duplicates

Description

ROOT compression blocks are typically unzipped in a loop where every iteration parses the compression block header followed by a call to R__unzip. Generally, the following checks are currently missing

• Before calling R__unzip_header, check that the input buffer size is at least as along as the header (9 bytes)
• After calling R__unzip_header and before calling R__unzip, check that the reported compressed and decompressed block size fit into the remaining enclosing input and output buffer sizes.

Many thanks to Pavel Kohout from AISLE for the original report!

Reproducer

Reproducible through corrupted / crafted source and target sizes in the compression header.

ROOT version

master and previous

Installation method

n/a

Operating system

n/a

Additional context

No response