Description
`Seekable` did not record whether it was initialized. On a fresh `Seekable`,
or one whose `init_buff()` failed, `decompress`, `offset_to_frame_index` and
`frame_decompressed_size` made the C library read a NULL seek table. After a
failed re-initialization, `decompress` returned data from the refused buffer
using the previous seek table.
Separately, `frame_decompressed_size(num_frames())`, on `Seekable` and
`SeekTable`, read one entry past the end of the seek table.
The flaw was corrected by refusing to use a `Seekable` until an
initialization succeeded, and by checking the frame index.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | zstd-safe | >= 7.2.2, < 7.4.0 · >= 8.0.0-0, < 8.2.0 | 7.4.0, 8.2.0 | RUSTSEC-2026-0396 |