Is there any exposure to CVE-2019-17543?

Hi

A dependency vulnerability scanner that I'm using (Whitesource) flagged this library as being vulnerable to CVE-2019-17543, and I'm trying to evaluate if this is a legitimate risk for us.

https://github.com/lz4/lz4/issues/801 makes it sound like this underlying issue is very hard to trigger, which makes me think that perhaps `golz4` is safe, because of the way it exposes the `lz4` API. However, I'm not confident enough in my own understanding of the issue to be certain about this.

Would you consider updating the version of `lz4` that is bundled here to include the fix for this issue? That would surely resolve the issue, and would likely include other performance, etc benefits. It may include risks, too, though.

I'd love to hear your thoughts on this!

Review how golz4 bundles and exposes the underlying lz4 library, then compare that dependency with the fix for CVE-2019-17543 and the behavior described in lz4 issue 801. Done means determining whether golz4 is exposed and, if appropriate, updating the bundled lz4 version; no specific files or tests are named.

Written by the indexing model from the issue text.