Description
With `CParameter::StableInBuffer(true)` (`experimental` feature), the C
library keeps a pointer to the input of one streaming call and reads from it
in later calls, including `flush_stream` and `end_stream`, which take no
input. An `InBuffer` only borrows its slice for one call, so safe code could
free it in between, and freed memory was compressed into the frame. The C
library behaves this way since zstd 1.5.4, whether bundled or linked from the
system.
The flaw was corrected by refusing to enable the parameter.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | zstd-safe | >= 4.1.0, < 7.4.0 · >= 8.0.0-0, < 8.2.0 | 7.4.0, 8.2.0 | RUSTSEC-2026-0395 |