Zstd safe: Double free

`DCtx::try_clone` (`experimental` feature, deprecated) is a plain copy of the C context. A context owning a dictionary (from `load_dictionary`, `ref_prefix` or `init_using_dict`) or a dictionary table (`ref_ddict` with `RefMultipleDDicts`) ended up with both copies freeing it. A context cloned mid-frame resumed on uninitialized stream state. The clone also silently lost the `WindowLogMax` limit. The flaw was corrected by refusing to clone such contexts, and by carrying over the parameters the copy leaves out.

• crates.io/crates/zstd-safe (opens in a new tab)
• rustsec.org/advisories/RUSTSEC-2026-0404.html (opens in a new tab)
• github.com/gyscos/zstd-rs/commit/cee6529b553ec600a8e152aaca15a91598820ecf (opens in a new tab)
• github.com/gyscos/zstd-rs/pull/384 (opens in a new tab)

• Zstd safe: Use-after-free when changing a multithreaded context with an unfinished frameUnratedVulnerability2026-10-16
• Zstd safe: Out-of-bounds read with an out-of-range `InBuffer::pos`UnratedVulnerability2026-10-16
• Zstd safe: Uninitialized memory exposed when streaming decompression of a legacy frame failsUnratedVulnerability2026-10-16
• Zstd safe: Heap buffer overflowUnratedVulnerability2026-10-16
• Zstd safe: Out-of-bounds readUnratedVulnerability2026-10-16