A flaw was found in OpenSSH. uncompress_buffer could keep growing the output buffer inside the inflate loop until it passed the maximum packet size. The fix returns SSH_ERR_INVALID_FORMAT once the buffer reaches PACKET_MAX_SIZE. This applies only after compression has been negotiated. The extra memory stays in that connection's process. This is not a demonstrated memory-corruption flaw, and it is a different bug and reporter from the LZ77 dictionary leak.