Bounds-check unchecked input reads in fastlz1/fastlz2_decompress (OOB read)

[eobi]

Bound-check the two unchecked input reads in the decompressors

fastlz_decompress() is documented as "crash-proof against corrupted and/or malicious data",
and the decoders enforce that with the always-on FASTLZ_BOUND_CHECK macro. Two input reads are
missing that check, so a crafted/truncated stream reads one byte past the end of the input buffer
(CWE-125). A third read happens before the length is validated.

fastlz2_decompress — the code = *ip++; right after the if (len == 7-1) do { ... } while (code == 255); loop has no bound check (it is the only one of the function's input reads without
one). A 3-byte input 20 ff 38 reaches it with ip at the end of the buffer:

AddressSanitizer: heap-buffer-overflow READ of size 1 ... in fastlz2_decompress fastlz.c:449

fastlz1_decompress — the analogous ref -= *ip++; after its if (len == 7-1) { ...; len += *ip++; } block is likewise unchecked.

fastlz_decompress — reads the level byte *(const uint8_t*)input before checking
length >= 1, so a zero-length call over-reads by one byte.

Fix

Three lines, using the existing FASTLZ_BOUND_CHECK macro (this PR).

Verification

• Repro (cc -g -fsanitize=address poc.c fastlz.c && ./poc, PoC in the linked report): faults
  before, clean after.
• Round-trip: 4096 bytes compress → decompress is byte-identical after the fix.
• Re-fuzzed the patched build ~27M iterations under libFuzzer+ASan: no crash.

Found with a coverage-guided libFuzzer + ASan harness; happy to share it.