Function LZ4_decompress_safe 

pub unsafe extern "C" fn LZ4_decompress_safe(
    src: *const c_char,
    dst: *mut c_char,
    compressedSize: c_int,
    dstCapacity: c_int,
) -> c_int

LZ4_decompress_safe(): decompresses the complete compressed block of compressedSize bytes from src into the dstCapacity byte buffer dst. Returns the number of bytes written to dst, or a negative value if dst is too small or src is malformed.

This never reads outside of src or writes outside of dst, even if src is malformed.