Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

jpountz/lz4-java

              master @ be9ce57
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Memory Corruption: 2 prior fixes. Scrutinize any change in this area.

StreamingXXHash32JNI: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Memory Corruption: Concurrent access to JNI wrappers combined with garbage collection finalization can cause native use-after-free or double-free conditions. Future modifications to JNI instance life cycles must maintain explicit synchronization to avoid native memory corruption.

Memory Corruption: Passing read-only Java ByteBuffers directly to native compression or decompression functions that write data causes JVM crashes and memory corruption. Input validation layers must robustly reject read-only buffers before invoking native JNI methods.