github-actions[bot] opened a new issue, #3547: URL: https://github.com/apache/iceberg-rust/issues/3547
> Use-after-free when changing a multithreaded context with an unfinished frame | Details | | | ------------------- | ---------------------------------------------- | | Status | unsound | | Package | `zstd-safe` | | Version | `7.2.4` | | URL | [https://github.com/gyscos/zstd-rs/commit/e224018a2389915d68ed17f30109bebad36e9734](https://github.com/gyscos/zstd-rs/commit/e224018a2389915d68ed17f30109bebad36e9734) | | Date | 2026-10-16 | When a multithreaded frame (`zstdmt` feature, `CParameter::NbWorkers`) is left unfinished, its jobs may still be running on the worker threads: the C library only waits for them when the next frame starts, or when the context is freed. A session reset makes the context accept changes again in the meantime, so: - unloading the dictionary (`load_dictionary`, `ref_cdict`, `ref_prefix`, `disable_dictionary`, `init*`, or `reset` with parameters) freed the dictionary a worker was still compressing against; - changing `NbWorkers` made the next frame resize the job table before waiting for the old jobs. The flaw was corrected by refusing these calls while a multithreaded frame is unfinished. The new `CCtx::wait_for_workers()` waits for the workers first. See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0406.html) for additional details. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
