Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
cloudflare/golz4
master @ caecf3c
2
Fixes
1
CVEs
CRITICAL
Peak severity
Highlights
Memory Corruption: 2 prior fixes. Scrutinize any change in this area.
lz4.go: most-fixed (2 issues). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Memory Corruption: The use of the deprecated C.LZ4_uncompress function allowed attackers to cause memory corruption via malformed inputs, a flaw tracked publicly as CVE-2014-125026. Developers must ensure that only bounded, safe decompressors like C.LZ4_decompress_safe are used.
Memory Corruption: Passing Go slices directly to C functions using unsafe.Pointer without validating if the slice is empty can lead to out-of-bounds indexing or null pointer dereferences. Safe wrappers must explicitly check for empty slices and return nil before performing pointer arithmetic.