2 results · Feed
-
High 7.5
Decompression bomb in `ruzstd`: a tiny input can exhaust memory (OOM)
A crafted `.zst` input under 128 KB can force `ruzstd` to allocate several gigabytes at once, crashing the process with an out-of-memory condition. Since `ruzstd` is a decoder for untrusted input, a single small file is enough to take down anything decoding i…
-
Medium —
`ruzstd` uninit and out-of-bounds memory reads
Affected versions of `ruzstd` miscalculate the length of the allocated and init section of its internal `RingBuffer`, leading to uninitialized or out-of-bounds reads in `copy_bytes_overshooting` of up to 15 bytes. This may result in up to 15 bytes of memory c…