Repository navigation
Bump io.sqreen:libsqreen to 17.6.0 - #13135
gh-worker-dd-mergequeue-cf854d[bot] merged 2 commits into
Conversation
libsqreen 17.6.0 links libsqreen_jni.so with BIND_NOW (DataDog/libddwaf-java#219). This fixes a SIGSEGV in JNI_OnLoad when the native ddprof profiler writes its malloc hook into the lazily-bound GOT slot before ld.so relocates the library (APPSEC-69052).
jandro996
added
type: bug fix
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![datadog-official[bot]](https://avatars.githubusercontent.com/in/1358509?s=60&v=4){kind=small}
There was a problem hiding this comment.
More details
The libsqreen 17.6.0 dependency selection raised no actionable integration concerns. The JNI relocation fix and WAF-context closure behavior remain unverified at runtime.
🤖 Bits Code Review · Commit 681f06d
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 681f06de8f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
jandro996
added
the
tag: ai generated
There was a problem hiding this comment.
More details
The dependency declaration and all 452 affected lockfiles consistently select libsqreen 17.6.0. Native crash resolution and WAF lifecycle behavior were not verified through execution.
🤖 Bits Code Review · Commit ba56d63
This comment has been minimized.
This comment has been minimized.
🟢 Java Benchmark SLOs — All performance SLOs passed
PR vs. master results
Commit: Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion. |
Kafka / producer-benchmarkParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 3 metrics, 0 unstable metrics. See unchanged results
|
Kafka / consumer-benchmarkParameters
See matching parameters
SummaryFound 0 performance improvements and 1 performance regressions! Performance is the same for 2 metrics, 0 unstable metrics.
See unchanged results
|
|
/merge |
|
View all feedbacks in Devflow UI.
The expected merge time in
|
f9b4674
into
master
What Does This Do
Bumps
io.sqreen:libsqreenfrom 17.5.0 to 17.6.0.Motivation
Fixes a SIGSEGV in
libsqreen_jni.soJNI_OnLoadduring AppSec initialization (APPSEC-69052). The native ddprof profiler (ddprof --preset cpu_live_heap, v0.19.0) wrote itsmallochook into the lazily-bound GOT slot oflibsqreen_jni.sobefore ld.so relocated the library. glibc then applied the lazy relocation on top (*slot += l_addr), and the firstmalloccall jumped to a garbage address.libsqreen 17.6.0 links
libsqreen_jni.sowith-z now -z relro(BIND_NOW, DataDog/libddwaf-java#219), so ld.so overwrites the slot with the resolved symbol and the early write is harmless.17.6.0 also includes DataDog/libddwaf-java#216 (reject new WAF contexts once handle closure begins).
Additional Notes
:dd-java-agent:appsec:testpasses locally with 17.6.0 (693 tests, 0 failures).gradle.lockfilefiles are updated. The 17.6.0 POM has the same dependencies as 17.5.0 (slf4j-api1.7.30), so only the libsqreen entry changes. Cross-checked by regenerating:dd-java-agent:appsecand:dd-java-agent:agent-toolingwithresolveAndLockAll --write-locks.Jira ticket: APPSEC-69052