diff --git a/module/zfs/lz4.c b/module/zfs/lz4.c
index 497296e35..5c3c6cdb1 100644
--- a/module/zfs/lz4.c
+++ b/module/zfs/lz4.c
@@ -907,6 +907,9 @@ LZ4_uncompress_unknownOutputSize(const char *source, char *dest, int isize,
 		}
 		/* copy literals */
 		cpy = op + length;
+		/* CORNER-CASE: cpy might overflow. */
+		if (cpy < op)
+			goto _output_error;	/* cpy was overflowed, bail! */
 		if ((cpy > oend - COPYLENGTH) ||
 		    (ip + length > iend - COPYLENGTH)) {
 			if (cpy > oend)