Commit 08776094 for xz

commit 0877609467a81fb831a3bcbcea732d20582a58b9
Author: Lasse Collin <lasse.collin@tukaani.org>
Date:   Tue Jul 21 12:58:45 2026 +0300

    liblzma: Fix input_size_max in lzma_index_buffer_decode()

    If *in_pos > 0, the condition became more relaxed than it needed to be.

    Fixes: 5005914f1acf ("liblzma: Index decoder: Reject an obviously-bad Number of>
    Fixes: 0352dc7929b1 ("liblzma: Silence a compiler warning")

diff --git a/src/liblzma/common/index_decoder.c b/src/liblzma/common/index_decoder.c
index 6bd0b574..be22d5a5 100644
--- a/src/liblzma/common/index_decoder.c
+++ b/src/liblzma/common/index_decoder.c
@@ -367,11 +367,10 @@ lzma_index_buffer_decode(lzma_index **i, uint64_t *memlimit,
 		return LZMA_PROG_ERROR;

 	// Initialize the decoder.
-	// in_size64 is to silence gcc -Wtype-limits on 32-bit targets.
 	lzma_index_coder coder;
-	const uint64_t in_size64 = in_size;
+	const uint64_t input_size_max = in_size - *in_pos;
 	return_if_error(index_decoder_reset(&coder, allocator, i, *memlimit,
-			my_min(in_size64, LZMA_BACKWARD_SIZE_MAX)));
+			my_min(input_size_max, LZMA_BACKWARD_SIZE_MAX)));

 	// Store the input start position so that we can restore it in case
 	// of an error.