Fix: Heap OOB read in pt_decompress

GHSL-2026-139
Credit: discovered and reported by GHSL team member @JarLob

Remediation: require in->size >= 14

Author: mcmilk

C/zstdmt/lizard-mt_decompress.c

@@ -328,6 +328,10 @@ static void *pt_decompress(void *arg)
 		if (in->size < 40 && ctx->frames == 1) {
 			out->size = 1024 * 64;
 		} else {
+			if (in->size < 14) {
+				result = ERROR(data_error);
+				goto error_lock;
+			}
 			/* get frame size for output buffer */
 			unsigned char *src = (unsigned char *)in->buf + 6;
 			out->size = (size_t) MEM_readLE64(src);

C/zstdmt/lz4-mt_decompress.c

@@ -328,6 +328,10 @@ static void *pt_decompress(void *arg)
 		if (in->size < 40 && ctx->frames == 1) {
 			out->size = 1024 * 64;
 		} else {
+			if (in->size < 14) {
+				result = ERROR(data_error);
+				goto error_lock;
+			}
 			/* get frame size for output buffer */
 			unsigned char *src = (unsigned char *)in->buf + 6;
 			out->size = (size_t) MEM_readLE64(src);

C/zstdmt/lz5-mt_decompress.c

@@ -328,6 +328,10 @@ static void *pt_decompress(void *arg)
 		if (in->size < 40 && ctx->frames == 1) {
 			out->size = 1024 * 64;
 		} else {
+			if (in->size < 14) {
+				result = ERROR(data_error);
+				goto error_lock;
+			}
 			/* get frame size for output buffer */
 			unsigned char *src = (unsigned char *)in->buf + 6;
 			out->size = (size_t) MEM_readLE64(src);