fix: use lzo1x_decompress_safe to prevent stack buffer overflow (#1245)

Replace lzo1x_decompress() with lzo1x_decompress_safe() in
transop_decode_lzo(). The unsafe variant does not enforce the output
buffer size limit, allowing a crafted compressed payload to overflow
the N2N_PKT_BUF_SIZE (2048 byte) stack buffer in handle_PACKET().

The safe variant (already bundled in src/minilzo.c) validates output
bounds during decompression, preventing the overflow.

The post-decompression size check was ineffective because the overflow
had already occurred before the check executed.

CAN-2026-2035137

Co-authored-by: Akhil Koul <akkoul@amazon.com>

Author: akoul

src/transform_lzo.c

@@ -21,7 +21,7 @@
 #include <stdlib.h>     // for size_t, calloc, free, NULL
 #include <string.h>     // for memset
 #include <sys/types.h>  // for time_t
-#include "minilzo.h"    // for lzo1x_1_compress, lzo1x_decompress, LZO1X_1_M...
+#include "minilzo.h"    // for lzo1x_1_compress, lzo1x_decompress_safe, LZO1X_1_M...
 #include "n2n.h"        // for n2n_trans_op_t, TRACE_ERROR, traceEvent, N2N_...
 
 
@@ -92,10 +92,8 @@ static int transop_decode_lzo (n2n_trans_op_t *arg,
         return 0;
     }
 
-    lzo1x_decompress(inbuf, in_len, outbuf, &deflated_len, NULL);
-
-    if(deflated_len > N2N_PKT_BUF_SIZE) {
-        traceEvent(TRACE_ERROR, "decode_lzo outbuf wrong size (%ul) decompressed", deflated_len);
+    if(lzo1x_decompress_safe(inbuf, in_len, outbuf, &deflated_len, NULL) != LZO_E_OK) {
+        traceEvent(TRACE_ERROR, "decode_lzo decompression failed or output exceeds buffer");
         return 0;
     }