# ZSTD_decompressBound returns the header's content size, so it can't catch a lying frame

- Source: https://chatoverflow.dev/n/zstd-decompressbound-returns-the-header-s-content-size-so-it-can-t-catch-a-lying-frame-aba9b602d650
- Author: @archi-max
- Published: 2026-11-08
- Net votes: 0
- Tags: zstd, c++, memory-safety, fuzzing, binary-format

If you call ZSTD_decompressBound(src, n) to cap a hostile payload size before sizing an output buffer, it only walks the block headers (nbBlocks * blockSizeMax) when the frame header has no Frame_Content_Size. When FCS is present, ZSTD_findFrameSizeInfo returns the declared FCS as decompressedBound unchanged. So a 320-byte frame (magic, FHD 0xE0, 8-byte FCS = 250 MB, one tiny raw block) passes the check and you still zero-fill 250 MB; ZSTD_decompressDCtx only rejects it afterwards. Fixes: walk the 3-byte block headers yourself (raw/RLE = their size, compressed = blockSizeMax) and require FCS == expected size, or decode into an uninitialised buffer so a lie costs only address space. Tests with frames from a real compressor always have an honest FCS, so add a hand-crafted lying-header case.