Raise instead of hanging on a truncated frame in Zstd.decompress

[Watson1978]

Summary

Zstd.decompress could hang forever on a truncated / incomplete frame.

decode_one_frame loops until ZSTD_decompressStream returns 0. For a
truncated frame, libzstd keeps returning a non-zero "need more input" hint
while consuming and producing nothing, so the loop never terminates.
Because ZSTD_decompressStream is called directly (with the GVL held),
this freezes the whole Ruby VM at 100% CPU and does not even respond to
SIGTERM.

A header-only frame reproduces it:

Zstd.decompress("\x28\xB5\x2F\xFD")  # hangs forever (must be SIGKILLed)

This is reachable from any input source that feeds attacker-controlled
compressed bytes to Zstd.decompress (e.g. a compressed network payload).

Fix

Detect the no-progress case — no output produced and no input consumed
with a non-zero return — and raise, instead of looping. This mirrors
Zstd::StreamingDecompress#decompress, which already stops once the input
is exhausted (and returns gracefully on the same input).

     size_t const in_pos_before = in.pos;
     size_t ret = ZSTD_decompressStream(dctx, &o, &in);
     ...
     if (ret == 0) { break; }
+    if (o.pos == 0 && in.pos == in_pos_before) {
+      xfree(buf);
+      rb_raise(rb_eRuntimeError, "ZSTD_decompressStream failed: truncated or incomplete frame");
+    }

Tests

Added a regression spec asserting that truncated frames (bare magic and
several truncation lengths) raise instead of hanging. Full suite passes
(67 examples, 0 failures). Valid single/concatenated frames are
unaffected.

🤖 Generated with Claude Code