Hi, I think there's a bug here.

Per the [BlockFile docstring](/blob/master/src/binwalk/core/common.py#L256), `read_block()` can return **more** than `dlen` bytes of data, by peeking, and this is intended feature.

However, we don't want the peek'd bytes injected into the stream being decompressed -- as the next `read_block()` call will pull them again!

Take a ~1.5 MiB deflated file to test: `binwalk -X` will extract a slighly larger file than a plain `zlib.decompress(-15)` would. (This, exactly, was how this bug bite me.)

Hope this fix is simple enough to be merged easily! Cheers.

Signed-off-by: Icenowy Zheng <icenowy@aosc.xyz>

Reference: http://wwwimages.adobe.com/content/dam/Adobe/en/devnet/swf/pdf/swf-file-format-spec.pdf Chapter 2 "The SWF header"

Signed-off-by: Icenowy Zheng <icenowy@aosc.xyz>

extractor: Improved warning for when the external extractor is not found, for issues such as devttys0/binwalk#245

Removed excessive size field validation for LZMA signatures; their compression is already validated, which is a better metric anyway.