From 7f33857ee00d46a996fa299506c952cf8b65edad Mon Sep 17 00:00:00 2001
From: Xin LI <delphij@FreeBSD.org>
Date: Tue, 1 Jul 2014 21:16:27 +0000
Subject: [PATCH] 4936 lz4 could theoretically overflow a pointer with a
 certain input Reviewed by: Saso Kiselkov <skiselkov.ml@gmail.com> Reviewed
 by: Keith Wesolowski <keith.wesolowski@joyent.com> Approved by: Gordon Ross
 <gordon.ross@nexenta.com>

illumos/illumos-gate@58d0718061c87e3d647c891ec5281b93c08dba4e
---
 uts/common/fs/zfs/lz4.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/uts/common/fs/zfs/lz4.c b/uts/common/fs/zfs/lz4.c
index 40cb0711e08..656360a6f2e 100644
--- a/uts/common/fs/zfs/lz4.c
+++ b/uts/common/fs/zfs/lz4.c
@@ -960,6 +960,9 @@ real_LZ4_uncompress(const char *source, char *dest, int osize)
 		}
 		/* copy literals */
 		cpy = op + length;
+		/* CORNER-CASE: cpy might overflow. */
+		if (cpy < op)
+			goto _output_error;	/* cpy was overflowed, bail! */
 		if unlikely(cpy > oend - COPYLENGTH) {
 			if (cpy != oend)
 				/* Error: we must necessarily stand at EOF */
@@ -1075,6 +1078,9 @@ LZ4_uncompress_unknownOutputSize(const char *source, char *dest, int isize,
 		}
 		/* copy literals */
 		cpy = op + length;
+		/* CORNER-CASE: cpy might overflow. */
+		if (cpy < op)
+			goto _output_error;	/* cpy was overflowed, bail! */
 		if ((cpy > oend - COPYLENGTH) ||
 		    (ip + length > iend - COPYLENGTH)) {
 			if (cpy > oend)