zlib: Zstd decompression silently accepts truncated input

[Archkon]

Version

latest main branch

Platform

7.1.3-arch1-3

Subsystem

zlib

What steps will reproduce the bug?

  const assert = require('node:assert');
  const zlib = require('node:zlib');

  const compressed = zlib.zstdCompressSync('hello world');
  const truncated = compressed.subarray(0, compressed.length / 2);

  const actual = zlib.zstdDecompressSync(truncated);
  console.log(actual.toString()); // "h"

How often does it reproduce? Is there a required condition?

Every time

What is the expected behavior? Why is that the expected behavior?

With the default finishFlush: ZSTD_e_end, both APIs should report an unexpected end of file error when the Zstd frame is incomplete.While other decompress api in zlib module would throw "unexpeted of EOF" for imcomplete input so I just assume this is a kind of implementation problem.

What do you see instead?

zstdDecompress() and zstdDecompressSync() currently succeed when the input ends before a complete Zstd frame has been received.

Additional information

No response