Uploaded image for project: 'Java Couchbase JVM Core'
  1. Java Couchbase JVM Core
  2. JVMCBC-1523

Upgrade org.iq80.snappy from 0.4 to 0.5

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Major
    • 2.7.1
    • None
    • None
    • 0

    Description

      Suggested Release Notes: N/A. No user-visible changes

       

      We're upgrading to 0.5 because it fixes a bug that could lead to a JVM crash when decompressing invalid input. This crash is extremely unlikely to occur in the Couchbase SDK because Couchbase Server validates compressed documents, and refuses to store malformed compressed documents. However, we still want to upgrade to avoid even the slightest theoretical chance of a JVM crash (if for example the document got corrupted in transit from server to client). Upgrading also pacifies everyone's vulnerability scanners

      One complication is that version 0.5 removed compatibility with big-endian hardware and with JVMs where `sun.misc.Unsafe` is inaccessible (perhaps due to a restrictive security context).

      To preserve the ability to use compression in all cases, we are repackaging the safe "slow path" code from version 0.4. The SDK will decide at runtime whether it should use version 0.5 or fall back to the repackaged slow path from 0.4.

      There is no change from the user's perspective. This is exactly the same fallback behavior we used to get from the official distribution of version 0.4. The only different is that on little-endian systems that can access `sun.misc.Unsafe`, version 0.5 does better bounds checking to prevent potential JVM crashes.

      Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            david.nault David Nault
            david.nault David Nault
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes

                PagerDuty