commit 6ad2a85e2fb1845c840c4a67584a8d346a5effde
author Nigel Tao <nigeltao@golang.org> Fri Feb 12 22:29:32 2016 +1100
committer Nigel Tao <nigeltao@golang.org> Fri Feb 12 22:29:32 2016 +1100
tree d530e9819aec38cfaee862b2bea1895fb7f70b9a
parent 5096ca2afaf180b77b2e1211ec6fe083a7f8fa94

Catch overflow when incrementing dst pointer.

decode.go

diff --git a/decode.go b/decode.go
index 011033c..0ac8e4f 100644
--- a/decode.go
+++ b/decode.go
@@ -121,11 +121,10 @@
 			return nil, errUnsupportedCopy4Tag
 		}
 
-		end := d + length
-		if offset > d || end > len(dst) {
+		if offset > d || length > len(dst)-d {
 			return nil, ErrCorrupt
 		}
-		for ; d < end; d++ {
+		for end := d + length; d != end; d++ {
 			dst[d] = dst[d-offset]
 		}
 	}