f_compress_file()/f_uncompress_file() strcpy()'d the check_valid_path()
result (no length bound) into a fixed 1024-byte outname[] stack buffer;
an arbitrarily long path overflowed it before any filesystem check ran.
Also fixed f_compress_file()'s !real_output_file branch, which called
FREE_MSTR(output_file) unconditionally even when output_file was the
2-argument form's stack-owned string, not one we allocated.
f_uncompress() accumulated decompressed size into a plain `int len`
across the whole inflate() loop with no bound, only rejecting an
oversized result via allocate_buffer()'s cap *after* fully expanding it
-- letting a small, highly compressible input drive unbounded
intermediate allocation/copy work (and, past ~2GB output, overflow
`len` itself). Now checks `len` against __MAX_BUFFER_SIZE__ every
iteration and bails out immediately.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YTPLudxra3u1andNyWJEQG
