ZDICT trainFromBuffer is never told the length of the samples buffer, so train from buffer checked that the sample sizes add up to it. With overflow checks off, as in release builds, that sum wrapped around: sizes totalling 2^64 plus the buffer length passed the check, and the trainer read past the end of the buffer. zstd::dict::from continuous relies on this check from zstd 0.4.10; older versions of zstd had their own, covered by a separate advisory.

This requires the sample sizes to come from an untrusted source. The flaw was corrected by summing the sizes with overflow checks.