Investigate impact of CVE-2025-67721 (Snappy compression)

Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. In versions 3.3 and below, incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allow remote attackers to read previous buffer contents via crafted compressed input. With certain crafted compressed inputs, elements from the output buffer can end up in the uncompressed output, potentially leaking sensitive data. This is relevant for applications that reuse the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates a fix-sized buffer for performance purpose

io.airlift:aircompressor is a Spark SQL dependency. Snappy is the default compression for parquet/delta.

• In the context od the library the the user has full control over compressed content so the attack vector is not applicable.
• In the context of the server the bulk import with parquet format could potentially be used as an attack vector. Needs to be investigated further. (most likely not an issue, but in either case may depend on how Spark use the library)

No source files or tests are named. Start by tracing how Spark SQL handles bulk imports in Parquet format and how its io.airlift:aircompressor dependency reaches Snappy or LZ4 decompression. Done means determining whether crafted compressed input can expose reused buffer contents in the server context and documenting the conclusion.