1 matches found
PT-2026-125060
ZDICT trainFromBuffer is never told the length of the samples buffer, so train from buffer checked that the sample sizes add up to it. With overflow checks off, as in release builds, that sum wrapped around: sizes totalling 2^64 plus the buffer length passed the check, and the trainer read past t...
5.9AI score
SaveExploits0References5
20