AIKIDO-2026-644423

TL;DR

MessagePack's LZ4 block decompressor accumulates literal and match lengths from length extension bytes inside an unchecked block, with no check for int32 overflow. When an application enables Lz4Block or Lz4BlockArray compression and deserializes untrusted MessagePack data, a crafted payload around 8.4 MB can wrap the length accumulator to a large negative value, corrupting pointer arithmetic and triggering an out-of-bounds memory access that crashes the process. The patch validates the accumulated length against the remaining output buffer before every addition and before copying literals or a repeated sequence, rejecting malformed input instead of overflowing.