Use-after-free with CParameter::StableInBuffer

OutBuffer::around_pos exposes uninitialized memory

Out-of-bounds read with an out-of-range InBuffer::pos

Double free in DCtx::try_clone

Seekable::decompress sets a Vec length beyond its capacity for offsets past the end

Use-after-free when changing a multithreaded context with an unfinished frame

Heap buffer overflow in CCtx::try_clone on a multithreaded context

Out-of-bounds read in train_from_buffer when sample sizes overflow

Seekable reads a NULL or out-of-bounds seek table

Uninitialized memory exposed when streaming decompression of a legacy frame fails

Use-after-free through init_using_cdict and init_using_ddict

Use-after-free of a dictionary after a one-shot call on a context with an open stream