RUSTSEC-2026-0398: Seekable::decompress sets a Vec length beyond its capacity for offsets past the end #29

Seekable::decompress sets a Vec length beyond its capacity for offsets past the end

ZSTD_seekable_decompress shortens the requested length to the end of the
data without checking that the offset is before it. For an offset past the
end, it returns a wrapped-around length without writing anything, and
Seekable::decompress passed that length to Vec::set_len.

With the seekable feature, whoever supplies the archive, or chooses the
offset, can leave the caller's Vec<u8> with a length far beyond its
capacity. Reading it then discloses neighbouring heap memory, and appending
to it corrupts memory. Offsets near u64::MAX can also hang the call.

The flaw was corrected by clamping requests to the end of the data, and by
checking every count reported by the C library against the buffer capacity.

See advisory page for additional details.