Heap overflow via unchecked decompression length

Heap-based buffer overflow in Assimp 17c12da allows remote attackers to corrupt memory via a crafted compressed X file parsed by decompressBlock. In code/Common/Compression.cpp, Assimp::Compression::decompressBlock hands zlib inflate a fixed-size buffer without verifying that the XFileParser-supplied compressed stream matches the declared length, so malformed input drives reads past the heap allocation. Exploitation requires an application that uses Assimp to import attacker-supplied X assets; the public PoC demonstrates a crash, while code-execution impact has not been publicly shown.