diff --git a/src/basic/compress.c b/src/basic/compress.c
index 251eb02fbb..b2a42f44e9 100644
--- a/src/basic/compress.c
+++ b/src/basic/compress.c
@@ -739,6 +739,8 @@ static int decompress_blob_lz4(
         size = unaligned_read_le64(src);
         if (size < 0 || (unsigned) size != unaligned_read_le64(src))
                 return -EFBIG;
+        if (dst_max > 0 && (size_t) size > dst_max)
+                return -ENOBUFS;
         out = greedy_realloc(dst, size, 1);
         if (!out)
                 return -ENOMEM;