Fix potential uninitialised data in LZS decompression

A compressed sequence with an offset of zero is encodeable via an 11-bit
offset, as 1000000000000. But would end up copying dst[outlen] to itself.

Spotted by Coverity.

Signed-off-by: David Woodhouse <dwmw2@infradead.org>

lzs.c

@@ -126,7 +126,7 @@ int lzs_decompress(unsigned char *dst, int dstlen, const unsigned char *src, int
 				}
 			}
 		}
-		if (offset > outlen)
+		if (!offset || offset > outlen)
 			return -EINVAL;
 		if (length + outlen > dstlen)
 			return -EFBIG;

tests/lzstest.c

@@ -34,6 +34,16 @@ int lzs_compress(unsigned char *dst, int dstlen, const unsigned char *src, int s
 #define NR_PKTS 2048
 #define MAX_PKT 65536
 
+/*
+ * Compressed data can encode an 11-bit offset of zero, which is invalid.
+ * 10 00000000000 00   110000000
+ * Compr offset  len   end marker
+ *
+ * In bytes:
+ * 1000.0000 0000.0001 1000.0000
+ */
+static const unsigned char zero_ofs[] = { 0x80, 0x01, 0x80 };
+
 int main(void)
 {
 	int i, j, ret;
@@ -44,6 +54,16 @@ int main(void)
 
 	srand(0xdeadbeef);
 
+	uncomprbuf[0] = 0x5a;
+	uncomprbuf[1] = 0xa5;
+
+	ret = lzs_decompress(uncomprbuf, 3, zero_ofs, sizeof(zero_ofs));
+	if (ret != -EINVAL) {
+		fprintf(stderr, "Decompressing zero-offset should have failed -EINVAL: %d, bytes %08x %08x\n",
+			ret, uncomprbuf[0], uncomprbuf[1]);
+		exit(1);
+	}
+
 	for (i = 0; i < NR_PKTS; i++) {
 		if (i)
 			pktlen = (rand() % MAX_PKT) + 1;