Vulnerability RUSTSEC-2026-0396

Seekable did not record whether it was initialized. On a fresh Seekable, or one whose init_buff() failed, decompress, offset_to_frame_index and frame_decompressed_size made the C library read a NULL seek table. After a failed re-initialization, decompress returned data from the refused buffer using the previous seek table.

Separately, frame_decompressed_size(num_frames()), on Seekable and SeekTable, read one entry past the end of the seek table.

The flaw was corrected by refusing to use a Seekable until an initialization succeeded, and by checking the frame index.