Repository navigation
RUSTSEC-2026-0404: Double free in DCtx::try_clone #63
Description
Double free in
DCtx::try_clone
| Details | |
|---|---|
| Status | unsound |
| Package | zstd-safe |
| Version | 7.2.4 |
| URL | gyscos/zstd-rs@cee6529 |
| Date | 2026-10-16 |
DCtx::try_clone (experimental feature, deprecated) is a plain copy of the
C context. A context owning a dictionary (from load_dictionary,
ref_prefix or init_using_dict) or a dictionary table (ref_ddict with
RefMultipleDDicts) ended up with both copies freeing it. A context cloned
mid-frame resumed on uninitialized stream state. The clone also silently lost
the WindowLogMax limit.
The flaw was corrected by refusing to clone such contexts, and by carrying
over the parameters the copy leaves out.
See advisory page for additional details.
Activity