NetPlay: bound LZO decompression output

NetPlay save synchronization decoded remote LZO blocks with the unsafe
decoder and no output capacity. A malicious host could overflow a client
buffer with a block larger than its declared size.

Use the bounds-checking decoder, validate the declared output length, and
grow buffer results only after each checked block has been decoded.

0 files changed, 0 insertions, 0 deletions