github-actions[bot] opened a new issue, #3543: URL: https://github.com/apache/iceberg-rust/issues/3543
> Use-after-free with `CParameter::StableInBuffer` | Details | | | ------------------- | ---------------------------------------------- | | Status | unsound | | Package | `zstd-safe` | | Version | `7.2.4` | | URL | [https://github.com/gyscos/zstd-rs/commit/53a8a290d8cfb52ff5b29fb6e04a40b5a174cc65](https://github.com/gyscos/zstd-rs/commit/53a8a290d8cfb52ff5b29fb6e04a40b5a174cc65) | | Date | 2026-10-16 | With `CParameter::StableInBuffer(true)` (`experimental` feature), the C library keeps a pointer to the input of one streaming call and reads from it in later calls, including `flush_stream` and `end_stream`, which take no input. An `InBuffer` only borrows its slice for one call, so safe code could free it in between, and freed memory was compressed into the frame. The C library behaves this way since zstd 1.5.4, whether bundled or linked from the system. The flaw was corrected by refusing to enable the parameter. See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0395.html) for additional details. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
