Reported

October 16, 2026

Issued

October 26, 2026

Package

zstd-safe (crates.io)

Type

INFO Unsound

Categories

• memory-corruption

Keywords

#seekable #null-pointer

References

• https://github.com/gyscos/zstd-rs/commit/a9626069d6f2e90b782b8f627f57a361cfe8ef85
• https://github.com/gyscos/zstd-rs/pull/384

Patched

• >=8.2.0

Unaffected

• <7.2.2

Affected Functions

Version

zstd_safe::seekable::SeekTable::frame_decompressed_size

• >=7.2.2, <8.2.0

zstd_safe::seekable::Seekable::decompress

• >=7.2.2, <8.2.0

zstd_safe::seekable::Seekable::decompress_frame

• >=7.2.2, <8.2.0

zstd_safe::seekable::Seekable::frame_decompressed_size

• >=7.2.2, <8.2.0

zstd_safe::seekable::Seekable::offset_to_frame_index

• >=7.2.2, <8.2.0

Description

Seekable did not record whether it was initialized. On a fresh Seekable, or one whose init_buff() failed, decompress, offset_to_frame_index and frame_decompressed_size made the C library read a NULL seek table. After a failed re-initialization, decompress returned data from the refused buffer using the previous seek table.

Separately, frame_decompressed_size(num_frames()), on Seekable and SeekTable, read one entry past the end of the seek table.

The flaw was corrected by refusing to use a Seekable until an initialization succeeded, and by checking the frame index.

Advisory available under CC0-1.0 license.