fix: free native context if a stream constructor fails after creating it

[dfa1]

In-depth memory-leak / security review of the zstd module

Bug found & fixed — native context leak on constructor failure

All four streaming wrappers — ZstdOutputStream, ZstdInputStream, ZstdCompressStream, ZstdDecompressStream — create a native ZSTD_CCtx/ZSTD_DCtx and then make a second native call (set compression level / load dictionary). If that second call threw (e.g. an out-of-range parameter, a malformed dictionary, OOM), the just-created context leaked:

• the java.io streams closed only the Arena in their catch, never the cctx/dctx;
• the segment drivers rethrew from the static create() helper before super(...) could hand the pointer to NativeObject for tracked cleanup.

Fix: free the context on every constructor error path. For the java.io streams the post-setup buffer allocations also moved inside the guarded block, so a failure there releases both the context and the arena. Low-probability paths, but a real native leak each time.

Reviewed and found clean

• NativeObject — AtomicReference swap to NULL makes tryClose exactly-once and idempotent under repeated/concurrent close.
• Context/dict creators (ZstdCompressCtx/ZstdDecompressCtx/ZstdCompressDict/ZstdDecompressDict) — allocate the native handle as the last step, so an earlier failure leaks nothing.
• Zstd.copyIn/copyOut — Math.toIntExact guards the >2 GiB overflow, max(len,1) avoids zero-length allocation.
• Decode/encode entry points — requireNative on every segment, Objects.checkFromIndexSize on array ranges, NULL-pointer checks on create, negative-sentinel handling via Zstd.call.
• Dictionary trainers — all arena-scoped; ZDICT writes into an arena buffer, no native handle to leak.
• Loader — bundled-only, owner-only temp dir (hardened in security: bundled-only native loader; fix Sonar vuln + bug #8).

No integer-overflow, TOCTOU (beyond the already-hardened loader), or unbounded-read issues found (errorName reads a static zstd string).

Test

./mvnw -pl zstd,integration-tests -am verify — 138 unit + 79 integration green, checkstyle + javadoc clean.

🤖 Generated with Claude Code