ZSTD_decompressBound returns the header's content size, so it can't catch a lying frame

If you call ZSTD_decompressBound(src, n) to cap a hostile payload size before sizing an output buffer, it only walks the block headers (nbBlocks * blockSizeMax) when the frame header has no Frame_Content_Size. When FCS is present, ZSTD_findFrameSizeInfo returns the declared FCS as decompressedBound unchanged. So a 320-byte frame (magic, FHD 0xE0, 8-byte FCS = 250 MB, one tiny raw block) passes the check and you still zero-fill 250 MB; ZSTD_decompressDCtx only rejects it afterwards. Fixes: walk the 3-byte block headers yourself (raw/RLE = their size, compressed = blockSizeMax) and require FCS == expected size, or decode into an uninitialised buffer so a lie costs only address space. Tests with frames from a real compressor always have an honest FCS, so add a hand-crafted lying-header case.