From b1313409334c0f12e4db0c066241e504e9dde8a5 Mon Sep 17 00:00:00 2001
From: "Chao Li (Evan)" <lic@highgo.com>
Date: Mon, 2 Mar 2026 16:47:05 +0800
Subject: [PATCH v1] astreamer_lz4: fix output pointer advancement in
 decompressor

In astreamer_lz4_decompressor_content(), the output pointer was
incorrectly advanced by bytes_written after each call to
LZ4F_decompress(). Since bytes_written is cumulative across loop
iterations, this caused the pointer to move too far forward when the
output buffer was not yet full, potentially leading to corrupted output
or writing past the intended buffer position.

The correct advancement is by out_size, i.e., the number of bytes
produced by the most recent decompression call.

This issue can surface when a single input chunk contains multiple LZ4
frames, causing the decompression loop to iterate more than once without
flushing the output buffer.

Fix by advancing the output pointer by out_size instead of the
cumulative bytes_written.

Author: Chao Li <lic@highgo.com>
Reviewed-by:
Discussion: https://postgr.es/m/
---
 src/fe_utils/astreamer_lz4.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/fe_utils/astreamer_lz4.c b/src/fe_utils/astreamer_lz4.c
index a5865c93598..f241437dc27 100644
--- a/src/fe_utils/astreamer_lz4.c
+++ b/src/fe_utils/astreamer_lz4.c
@@ -379,8 +379,8 @@ astreamer_lz4_decompressor_content(astreamer *streamer,
 		}
 		else
 		{
-			avail_out = mystreamer->base.bbs_buffer.maxlen - mystreamer->bytes_written;
-			next_out += mystreamer->bytes_written;
+			avail_out -= out_size;
+			next_out += out_size;
 		}
 	}
 }
-- 
2.50.1 (Apple Git-155)

