This is an automated email from the ASF dual-hosted git repository.
xiangfu0 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/pinot.git
The following commit(s) were added to refs/heads/master by this push:
new b51535ed34a Bump org.xerial.snappy:snappy-java from 1.1.10.8 to
1.1.10.9 (#19764)
b51535ed34a is described below
commit b51535ed34a9edf95be0ed81c647f4555b3742ca
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
AuthorDate: Tue Oct 6 16:00:27 2026 -0700
Bump org.xerial.snappy:snappy-java from 1.1.10.8 to 1.1.10.9 (#19764)
* Bump org.xerial.snappy:snappy-java from 1.1.10.8 to 1.1.10.9
Bumps
[org.xerial.snappy:snappy-java](https://github.com/xerial/snappy-java) from
1.1.10.8 to 1.1.10.9.
- [Release notes](https://github.com/xerial/snappy-java/releases)
-
[Commits](https://github.com/xerial/snappy-java/compare/v1.1.10.8...v1.1.10.9)
---
updated-dependencies:
- dependency-name: org.xerial.snappy:snappy-java
dependency-version: 1.1.10.9
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <[email protected]>
* Fix Snappy corrupt-input tests for stricter validation
---------
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot]
<49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Xiaotian (Jackie) Jiang <[email protected]>
---
.../io/codec/CompressionCodecCorruptInputTest.java | 29 ++++++++++++++--------
pom.xml | 2 +-
2 files changed, 20 insertions(+), 11 deletions(-)
diff --git
a/pinot-segment-local/src/test/java/org/apache/pinot/segment/local/io/codec/CompressionCodecCorruptInputTest.java
b/pinot-segment-local/src/test/java/org/apache/pinot/segment/local/io/codec/CompressionCodecCorruptInputTest.java
index a2b73a62e54..ee47b16fc31 100644
---
a/pinot-segment-local/src/test/java/org/apache/pinot/segment/local/io/codec/CompressionCodecCorruptInputTest.java
+++
b/pinot-segment-local/src/test/java/org/apache/pinot/segment/local/io/codec/CompressionCodecCorruptInputTest.java
@@ -27,6 +27,7 @@ import org.apache.pinot.spi.data.FieldSpec.DataType;
import org.testng.annotations.Test;
import org.xerial.snappy.Snappy;
+import static org.testng.Assert.assertEquals;
import static org.testng.Assert.assertThrows;
import static org.testng.Assert.assertTrue;
import static org.testng.Assert.expectThrows;
@@ -91,11 +92,19 @@ public class CompressionCodecCorruptInputTest {
@Test
public void testSnappyDecodeRejectsOversizedDeclaredSize() {
- // The sanity cap must fire before the destination-capacity guard. The
declared size is
- // the smallest rejected value (cap + 1), pinning the inclusive boundary:
exactly 1 GiB is accepted.
- IOException exception = expectThrows(IOException.class,
+ // Snappy may reject this impossible expansion ratio before Pinot checks
the shared sanity cap.
+ assertThrows(IOException.class,
() ->
SnappyCodecDefinition.INSTANCE.decode(SnappyCodecDefinition.OPTIONS, CTX,
oversizedSnappyFrame(), ByteBuffer.allocateDirect(16)));
+ }
+
+ @Test
+ public void testDeclaredDecompressedSizeSanityCap() throws IOException {
+ // Pin the inclusive 1 GiB boundary independently of the compression
library's frame validation.
+ int cap = 1 << 30;
+ assertEquals(CodecBufferUtils.checkDeclaredDecompressedSize(cap, "Snappy",
"varint length header"), cap);
+ IOException exception = expectThrows(IOException.class,
+ () -> CodecBufferUtils.checkDeclaredDecompressedSize(cap + 1,
"Snappy", "varint length header"));
assertTrue(exception.getMessage().contains("out of range"),
exception.getMessage());
}
@@ -189,21 +198,21 @@ public class CompressionCodecCorruptInputTest {
@Test
public void testMultiStageDecodeBoundsInnerSnappyOutput() throws Exception {
- // A valid Snappy frame that expands to 1 MiB is far larger than the
four-byte final INT
+ // A valid Snappy frame that expands to 64 bytes is larger than the
four-byte final INT
// chunk declared by the outer format. The executor must supply a
four-byte scratch bound
// instead of sizing the destination from the inner frame header.
- byte[] compressed = Snappy.compress(new byte[1024 * 1024]);
- // Keep only a small prefix: it contains Snappy's claimed decoded length
and stays below the
- // executor's outer encoded-size bound, so this specifically exercises the
inner-frame guard.
- ByteBuffer encoded = ByteBuffer.allocateDirect(16);
- encoded.put(compressed, 0, encoded.capacity()).flip();
+ byte[] compressed = Snappy.compress(new byte[64]);
+ // Keep the complete frame below the executor's outer encoded-size bound
so Snappy accepts
+ // the frame header and this specifically exercises Pinot's inner-frame
guard.
+ ByteBuffer encoded = ByteBuffer.allocateDirect(compressed.length);
+ encoded.put(compressed).flip();
ByteBuffer decoded = ByteBuffer.allocateDirect(Integer.BYTES);
CodecPipelineExecutor executor = CodecPipelineExecutor.create(
"DELTA,SNAPPY", CTX, CodecRegistry.DEFAULT);
IllegalArgumentException exception =
expectThrows(IllegalArgumentException.class,
() -> CodecTestUtils.decode(executor, encoded, decoded,
Integer.BYTES));
- assertTrue(exception.getMessage().contains("Snappy: decompressed size"),
exception.getMessage());
+ assertEquals(exception.getMessage(), "Snappy: decompressed size 64 exceeds
dst capacity 4");
}
@Test
diff --git a/pom.xml b/pom.xml
index c78e24c8ffb..d0f168da40e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -211,7 +211,7 @@
<yammer-metrics.version>2.2.0</yammer-metrics.version>
<!-- helix-core, spark-core use libraries from io.dropwizard.metrics -->
<dropwizard-metrics.version>4.2.40</dropwizard-metrics.version>
- <snappy-java.version>1.1.10.8</snappy-java.version>
+ <snappy-java.version>1.1.10.9</snappy-java.version>
<zstd-jni.version>1.5.7-20</zstd-jni.version>
<lz4-java.version>1.12.0</lz4-java.version>
<libthrift.version>0.25.0</libthrift.version>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
