Fix panic if too many elements specified in DefBuffer

If a buffer was created with a given size, but a greater number of elements
were then specified, we attempted to copy them all, causing a panic. This
would only be done by broken/malicious AML. Fix this by capping the copied
elements at the specified buffer size.

Author: IsaacWoods

src/aml/mod.rs

@@ -663,11 +663,18 @@ where
                             Argument::PkgLength(pkg_length),
                             Argument::Object(buffer_size),
                         ]);
-                        let buffer_size = buffer_size.clone().unwrap_transparent_reference().as_integer()?;
+                        let buffer_size =
+                            buffer_size.clone().unwrap_transparent_reference().as_integer()? as usize;
 
                         let buffer_len = pkg_length - (context.current_block.pc - start_pc);
-                        let mut buffer = vec![0; buffer_size as usize];
-                        buffer[0..buffer_len].copy_from_slice(
+                        let mut buffer = vec![0; buffer_size];
+
+                        /*
+                         * Copy the supplied elements into the buffer, avoiding a pathological case
+                         * where more elements are supplied than the buffer's size
+                         */
+                        let to_copy = usize::min(buffer_size, buffer_len);
+                        buffer[0..to_copy].copy_from_slice(
                             &context.current_block.stream()
                                 [context.current_block.pc..(context.current_block.pc + buffer_len)],
                         );