AIKIDO-2026-251973

TL;DR

The with_prepared_dictionary constructors on the streaming and raw Encoder/Decoder register the supplied EncoderDictionary/DecoderDictionary with the underlying zstd context by raw pointer without tying the dictionary borrow to the context lifetime. Safe code can drop the dictionary while the encoder or decoder is still alive, leaving the context with a dangling pointer into freed memory. The next compression or decompression call dereferences that pointer, a use-after-free reachable without any unsafe. The fix constrains the dictionary reference to &'a so the borrow checker keeps the dictionary alive as long as the stream that uses it.