1 matches found
`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end
ZSTDseekabledecompress shortens the requested length to the end of the data without checking that the offset is before it. For an offset past the end, it returns a wrapped-around length without writing anything, and Seekable::decompress passed that length to Vec::setlen. With the seekable feature...
6.2AI score
SaveExploits0Affected Software1
20