Memory-safety issues in zchunk .zck header, index, and range parsing

Fuzzing and static review of zchunk 1.5.2 (commit 2ec65c97e116) surfaced four memory-safety issues in the parsing of untrusted .zck files, all reported privately to the maintainer on 2026-07-22.

• Two heap out-of-bounds reads while parsing a checksum-valid header. read_preface() advanced by an optional-element data length without checking it against the remaining header, and index_read() checked room for the first chunk digest but not the uncompressed-source digest. (CWE-125)
• A NULL-pointer denial of service. index_read() accepted an index whose declared entry count did not match the number parsed, after which normal read APIs dereferenced a NULL first index entry. (CWE-476)
• A one-byte heap out-of-bounds write. After a fully-read dictionary-compressed file, zck_get_range_char() could serialize an empty range and write output[loc - 1] immediately before its allocation. (CWE-787)
• Zero-length memcpy with a NULL-derived pointer. comp_read_from_dc() and comp_add_to_dc() compute a copy length of zero but still do pointer arithmetic on a NULL decompression buffer and pass the result to memcpy() — undefined behaviour on otherwise valid files, with no demonstrated memory corruption. (CWE-758)

The maintainer (Jonathan Dieter) confirmed the reports on 2026-07-27 and accepted a combined patch; all fixes are verified locally (PoCs clean under ASan/UBSan, the 14 upstream regression samples pass). The read_preface() over-read was also independently and publicly reported the same day via PR #117; the coordinated fix here additionally addresses the sibling index_read() over-read, the NULL-deref, and the range write. Maintainer Jonathan Dieter fixed all of them in commit ab6aedbe5 (a broader header fix than PR #117 — it also covers the sibling index_read() uncompressed-digest over-read) and released them in zchunk 1.5.4 on 2026-08-02. Rebuilding the 1.5.4 release and replaying every PoC confirms each parses cleanly under ASan/UBSan.