lvm: fix two more potential data-dependent alloc overflows

It appears to be possible to make a (possibly invalid) lvm PV with a
metadata size field that overflows our type when adding it to the
address we've allocated.  Even if it doesn't, it may be possible to do
so with the math using the outcome of that as an operand.  Check them
both.

Signed-off-by: Peter Jones <pjones@redhat.com>
Signed-off-by: Darren Kenny <darren.kenny@oracle.com>

Patch-Name: lvm-overflow.patch