The vulnerability stems from the getComment function in decoding.c, which handled comment parsing without enforcing a maximum length limit. The GitHub patch explicitly adds a COMMENT_LENGTH_MAX check in this function, and the CWE-770 (resource allocation without throttling) directly maps to this unbounded memory allocation behavior. The commit diff shows the vulnerable code flow: original implementation used 'len = Bytes[0]' and 'reallocarray(info->comment, len + offset + 1)' without validation, making it the clear attack vector.