lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression