From 1c74f1416205b3c6fd5d55a8da7b0dcc36854a8e Mon Sep 17 00:00:00 2001
From: Andrew Tridgell <andrew@tridgell.net>
Date: Tue, 23 Feb 2021 13:54:49 +1100
Subject: [PATCH] AP_ROMFS: fixed range check in tinflate

this could cause valid compressed data to fail decompression
---
 libraries/AP_ROMFS/tinflate.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libraries/AP_ROMFS/tinflate.cpp b/libraries/AP_ROMFS/tinflate.cpp
index bf9bb19635..16bb5d5161 100644
--- a/libraries/AP_ROMFS/tinflate.cpp
+++ b/libraries/AP_ROMFS/tinflate.cpp
@@ -353,7 +353,7 @@ static int tinf_decode_trees(TINF_DATA *d, TINF_TREE *lt, TINF_TREE *dt)
 
       /* special code length 16-18 are handled here */
       length = tinf_read_bits(d, lbits, lbase);
-      if (num + length >= hlimit) return TINF_DATA_ERROR;
+      if (num + length > hlimit) return TINF_DATA_ERROR;
       for (; length; --length)
       {
          lengths[num++] = fill_value;