github-actions[bot] opened a new issue, #3552: URL: https://github.com/apache/iceberg-rust/issues/3552
> Use-after-free of a dictionary after a one-shot call on a context with an open stream | Details | | | ------------------- | ---------------------------------------------- | | Status | unsound | | Package | `zstd-safe` | | Version | `7.2.4` | | URL | [https://github.com/gyscos/zstd-rs/commit/d34502a0ed07f80ab2aa4c65059578e0466f2467](https://github.com/gyscos/zstd-rs/commit/d34502a0ed07f80ab2aa4c65059578e0466f2467) | | Date | 2026-10-16 | The one-shot `DCtx` and `CCtx` methods assumed the C library resets the context, but it leaves an open stream as it is. When a stream was left unfinished on a context, a one-shot call such as `decompress_using_dict` could leave the context pointing at the dictionary borrowed for that call, and the next streaming call resumed the stream against it after it was freed: decompressed output then contained freed heap memory. On the compression side, the stream resumed against the one-shot call's buffers. This requires an application to use one context for both streaming and one-shot calls without a reset in between. The flaw was corrected by resetting the session after one-shot calls whenever a stream may be open. See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0400.html) for additional details. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
