Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
airlift/aircompressor
master @ 38c2a7d
4
Fixes
1
CVEs
HIGH
Peak severity
Highlights
Information Disclosure: 2 prior fixes. Scrutinize any change in this area.
SnappyRawDecompressor: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Information Disclosure: Malformed compressed inputs with zero match offsets allow copying pre-existing data from the decompression buffer, leaking uninitialized or previously processed memory back to callers. This risk is tracked under CVE-2025-67721.
Out-of-bounds Read: Integer overflows from large literal or match lengths wrap around to negative values, bypassing traditional positive boundary checks and leading to arbitrary out-of-bounds memory reads via unsafe direct memory copy operations.
Memory Safety: Missing bounds checks during literal and match copy operations using UNSAFE memory APIs allow out-of-bounds reads and writes, potentially corrupting application memory or causing JVM crashes.