bool ZlibInStream::decompress(bool wait)
{
  if (!underlying)
    throw Exception("ZlibInStream overrun: no underlying stream");

  zs->next_out = (U8*)end;
  zs->avail_out = start + bufSize - end;

  int n = underlying->check(1, 1, wait);
  if (n == 0) return false;
  zs->next_in = (U8*)underlying->getptr();
  zs->avail_in = underlying->getend() - underlying->getptr();
  if ((int)zs->avail_in > bytesIn)
    zs->avail_in = bytesIn;

  int rc = inflate(zs, Z_SYNC_FLUSH);
  if (rc != Z_OK) {
    throw Exception("ZlibInStream: inflate failed");
  }

  bytesIn -= zs->next_in - underlying->getptr();
  end = zs->next_out;
  underlying->setptr(zs->next_in);
  return true;
}
The software writes data past the end, or before the beginning, of the intended buffer.