Memory corruption via unchecked buffer-size additions

Integer overflow in zchunk before 1.3.2 allows attackers to corrupt memory by supplying a malformed zchunk file. Four parsing and compression paths add attacker-controlled lengths to existing buffer sizes without first checking for size_t wraparound, then pass the wrapped totals to reallocation or header-reading operations. Processing of a crafted file is required; the resulting undersized buffers expose the consuming process to out-of-bounds memory access, although no public source establishes a specific exploit outcome.