3 results · Feed
-
Unscored —
Out-of-bounds read when training a dictionary from inconsistent sample sizes
`ZDICT_trainFromBuffer` is never told the length of the samples buffer. Before 0.4.10, `zstd::dict::from_continuous` (initially `train_dict`) called it directly: up to 0.2.1 without checking the sample sizes against the buffer at all, and from 0.3.0 with a su…
-
Unscored —
Uninitialized memory exposed by `write::Decoder` on a corrupt legacy frame
From 0.4.22 to 0.7.x, the writer behind `zstd::stream::write::Decoder` set its output buffer's length to its full capacity before each decompression call, then to the position the call reported, and only checked for an error afterwards. When decompression fai…
-
Unscored —
Data from an abandoned stream leaks into the next stream on a reused context
The `with_context` constructors of the stream encoders and decoders used the borrowed context as it was. When a stream was abandoned on a context, for example an encoder dropped before `finish()` after an error, whatever it left there was carried into the nex…