Zstd safe: Out-of-bounds read with an out-of-range `InBuffer::pos`

`InBuffer`'s fields are public, so safe code can set `pos` past the end of `src`. The position was passed to the C library unchecked, and `ZSTD_seekable_compressStream`, unlike the other streaming functions, does not validate it: it read past the end of the input slice, by up to the frame size, and compressed that memory into the output. The flaw was corrected by checking the position before every call into the C library.

• crates.io/crates/zstd-safe (opens in a new tab)
• rustsec.org/advisories/RUSTSEC-2026-0405.html (opens in a new tab)
• github.com/gyscos/zstd-rs/commit/20d397c0d68d8b4300c5493875ebfa10e355fcdd (opens in a new tab)
• github.com/gyscos/zstd-rs/pull/384 (opens in a new tab)

• Zstd safe: Use-after-free when changing a multithreaded context with an unfinished frameUnratedVulnerability2026-10-16
• Zstd safe: Double freeUnratedVulnerability2026-10-16
• Zstd safe: Uninitialized memory exposed when streaming decompression of a legacy frame failsUnratedVulnerability2026-10-16
• Zstd safe: Heap buffer overflowUnratedVulnerability2026-10-16
• Zstd safe: Out-of-bounds readUnratedVulnerability2026-10-16