Restore fix for #51, but in a different form

The check for end > len(dst) was removed to fix #167, but this caused
a new bug, #189. It's restored in a form that avoids both.

Fixes #189, #191.

internal/lz4block/decode_other.go

@@ -48,11 +48,14 @@ func decodeBlock(dst, src, dict []byte) (ret int) {
 					mLen += 4
 					if offset := u16(src[si:]); mLen <= offset && offset < di {
 						i := di - offset
-						end := i + 18
-						copy(dst[di:], dst[i:end])
-						si += 2
-						di += mLen
-						continue
+						// The remaining buffer may not hold 18 bytes.
+						// See https://github.com/pierrec/lz4/issues/51.
+						if end := i + 18; end <= uint(len(dst)) {
+							copy(dst[di:], dst[i:end])
+							si += 2
+							di += mLen
+							continue
+						}
 					}
 				}
 			case lLen == 0xF: