inflateGetDictionary() in zlib (inflate.c) 1.2.7.1 through 1.3.2 can write up to 8 MB past the caller's 32 KB dictionary buffer. With windowBits 0, inflate() takes the window size from the zlib header and stores an invalid size of up to 2^23 before rejecting it, and inflateReset()/inflateSync() keep it (versions before 1.2.9 accept the oversized size outright); the window then grows past 32 KB and inflateGetDictionary() copies all of it into a buffer the API documents as 32 KB, a heap overflow driven by crafted compressed input. Fixed in zlib 1.4.