github-actions[bot] opened a new issue, #3546: URL: https://github.com/apache/iceberg-rust/issues/3546
> Double free in `DCtx::try_clone` | Details | | | ------------------- | ---------------------------------------------- | | Status | unsound | | Package | `zstd-safe` | | Version | `7.2.4` | | URL | [https://github.com/gyscos/zstd-rs/commit/cee6529b553ec600a8e152aaca15a91598820ecf](https://github.com/gyscos/zstd-rs/commit/cee6529b553ec600a8e152aaca15a91598820ecf) | | Date | 2026-10-16 | `DCtx::try_clone` (`experimental` feature, deprecated) is a plain copy of the C context. A context owning a dictionary (from `load_dictionary`, `ref_prefix` or `init_using_dict`) or a dictionary table (`ref_ddict` with `RefMultipleDDicts`) ended up with both copies freeing it. A context cloned mid-frame resumed on uninitialized stream state. The clone also silently lost the `WindowLogMax` limit. The flaw was corrected by refusing to clone such contexts, and by carrying over the parameters the copy leaves out. See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0404.html) for additional details. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
