diff options
| -rw-r--r-- | module/zfs/lz4.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/module/zfs/lz4.c b/module/zfs/lz4.c index 497296e35..5c3c6cdb1 100644 --- a/module/zfs/lz4.c +++ b/module/zfs/lz4.c @@ -907,6 +907,9 @@ LZ4_uncompress_unknownOutputSize(const char *source, char *dest, int isize, } /* copy literals */ cpy = op + length; + /* CORNER-CASE: cpy might overflow. */ + if (cpy < op) + goto _output_error; /* cpy was overflowed, bail! */ if ((cpy > oend - COPYLENGTH) || (ip + length > iend - COPYLENGTH)) { if (cpy > oend) |