AIKIDO-2026-993409

TL;DR

THeaderTransport::transform() compresses outgoing frames when the ZLIB transform is enabled. resizeTransformBuffer() allocates only wBufSize_ plus a fixed DEFAULT_BUFFER_SIZE margin and does not grow further once that size is reached, so the retry loop cannot enlarge the buffer. The method then copies stream.total_out bytes from the transform buffer back into the write buffer without checking that the compressed length fits. A frame that does not compress well, including data a remote peer supplied, can make the compressed output exceed that margin. The copy writes past the end of the heap write buffer, and for a large frame it also reads past the end of the transform buffer. The fix sizes the transform buffer with deflateBound() plus the existing headroom, compresses in a single pass, and grows the write buffer to the compressed length before copying the result back.