lz4: Fix pointer overflow

diff --git a/grub-core/fs/zfs/zfs_lz4.c b/grub-core/fs/zfs/zfs_lz4.c
index 1212a8986cae23d455d08a7051c9571d1422ccb1..2f73449f0d4c63cadc7b5b4388250a4d474594b6 100644 (file)
--- a/grub-core/fs/zfs/zfs_lz4.c
+++ b/grub-core/fs/zfs/zfs_lz4.c
@@ -184,6 +184,8 @@ LZ4_uncompress_unknownOutputSize(const char *source,
                        }
                }
                /* copy literals */
+               if ((grub_addr_t) length > ~(grub_addr_t)op)
+                 goto _output_error;
                cpy = op + length;
                if ((cpy > oend - COPYLENGTH) ||
                    (ip + length > iend - COPYLENGTH)) {