zstd: Detect extra block data and report as corrupted

zstd/blockdec.go

@@ -517,6 +517,10 @@ func (b *blockDec) prepareSequences(in []byte, hist *history) (err error) {
 		nSeqs = 0x7f00 + int(in[1]) + (int(in[2]) << 8)
 		in = in[3:]
 	}
+	if nSeqs == 0 && len(in) != 0 {
+		// When no sequences, there should not be any more data...
+		return ErrUnexpectedBlockSize
+	}
 
 	var seqs = &hist.decoders
 	seqs.nSeqs = nSeqs

zstd/decoder_test.go

@@ -1610,6 +1610,7 @@ func testDecoderDecodeAllError(t *testing.T, fn string, dec *Decoder, errMap map
 				t.Error("Did not get expected error, got", len(got), "bytes")
 				return
 			}
+			t.Log(err)
 			if errMap[tt.Name] == "" {
 				t.Error("cannot check error")
 			} else {

zstd/zstd.go

@@ -52,6 +52,10 @@ var (
 	// Typically returned on invalid input.
 	ErrBlockTooSmall = errors.New("block too small")
 
+	// ErrUnexpectedBlockSize is returned when a block has unexpected size.
+	// Typically returned on invalid input.
+	ErrUnexpectedBlockSize = errors.New("unexpected block size")
+
 	// ErrMagicMismatch is returned when a "magic" number isn't what is expected.
 	// Typically this indicates wrong or corrupted input.
 	ErrMagicMismatch = errors.New("invalid input: magic number mismatch")