1 files changed, 3 insertions, 0 deletions

diff --git a/lib/decompress_unlzma.c b/lib/decompress_unlzma.c
index f30c899241ef..476c65af9709 100644
--- a/lib/decompress_unlzma.c
+++ b/lib/decompress_unlzma.c
@@ -522,6 +522,9 @@ static inline int INIT process_bit1(struct writer *wr, struct rc *rc,
                         cst->rep0 = pos_slot;
                 if (++(cst->rep0) == 0)
                         return 0;
+                if (cst->rep0 > wr->header->dict_size
+                                || cst->rep0 > get_pos(wr))
+                        return -1;
         }
 
         len += LZMA_MATCH_MIN_LEN;