Security vulnerability: Snappy decompressor can be made to crash JVM about aircompressor HOT 5 CLOSED

Relates to trinodb/trino#20566
I have used GitHub private vulnerability reporting on trinodb/trino to report there what I have found. It is also about SnappyDecompressor, but I won't share any details publicly here yet until I got a response from the maintainers.

I assume it might be the same issue you have found, but in case you have data which reproduces your crash and the maintainers notice this GitHub issue here, it might be good to share it with them as well just to make sure nothing is overlooked.

from aircompressor.

This fixed in release 0.26, which should be available in Maven Central shortly

from aircompressor.

Thanks for the report. I'm unable to reproduce the issue based on the steps listed above, even after more than 100 million runs. Are you able to capture and provide a the contents of the array that's causing the crash? That will it easier to diagnose and fix the problem.

from aircompressor.

@martint Hi Martin, thanks for the response. I'll follow up with the email address on your GitHub profile 👍

from aircompressor.

@martint Thanks for enabling private vulnerability reporting, I've also submitted a draft report there with more details and a reproducible example.

Would suggest adding @Marcono1234 as a collaborator there (and/or me to their report if appropriate) so that we can better coordinate efforts.

from aircompressor.