Cherry pick underflow fix.

third_party/brotli/dec/decode.c

 /* Copyright 2013 Google Inc. All Rights Reserved.
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
    You may obtain a copy of the License at
 
    http://www.apache.org/licenses/LICENSE-2.0
 
    Unless required by applicable law or agreed to in writing, software
    distributed under the License is distributed on an "AS IS" BASIS,
@@ skipping 1682 matching lines @@
              "len: %d bytes left: %d\n", pos, s->distance_code, i,
              s->meta_block_remaining_len));
       return BROTLI_FAILURE();
     }
   } else {
     const uint8_t *ringbuffer_end_minus_copy_length =
         s->ringbuffer_end - i;
     uint8_t* copy_src = &s->ringbuffer[
         (pos - s->distance_code) & s->ringbuffer_mask];
     uint8_t* copy_dst = &s->ringbuffer[pos];
+    /* Check for possible underflow and clamp the pointer to 0. */
+    if (PREDICT_FALSE(s->ringbuffer_end < (const uint8_t*)0 + i)) {
+      ringbuffer_end_minus_copy_length = 0;
+    }
     /* update the recent distances cache */
     s->dist_rb[s->dist_rb_idx & 3] = s->distance_code;
     ++s->dist_rb_idx;
     s->meta_block_remaining_len -= i;
     if (PREDICT_FALSE(s->meta_block_remaining_len < 0)) {
       BROTLI_LOG(("Invalid backward reference. pos: %d distance: %d "
              "len: %d bytes left: %d\n", pos, s->distance_code, i,
              s->meta_block_remaining_len));
       return BROTLI_FAILURE();
     }
@@ skipping 625 matching lines @@
 void BrotliSetCustomDictionary(
     size_t size, const uint8_t* dict, BrotliState* s) {
   s->custom_dict = dict;
   s->custom_dict_size = (int) size;
 }
 
 
 #if defined(__cplusplus) || defined(c_plusplus)
 }    /* extern "C" */
 #endif