temporarily revert jzbar application image loading
What the developer wrote
Authored by Craig Raw
temporarily revert jzbar application image loading
What changed, and why it matters
This commit temporarily changes how Sparrow Wallet loads the ZBar QR-code scanning library. Instead of bundling a Java wrapper library (jzbar) that loads its own native files, the app now tries to load a system-installed 'zbar' library directly from the Java installation directory. The change is described by the developer as a temporary revert because the bundled jzbar wrapper does not yet support pre-loaded native libraries. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a compatibility or build-maintenance change.
Treat this as a routine build/dependency change unless additional vendor or researcher documentation identifies a specific security issue. If reviewing for security, verify that the new System.load() path cannot be influenced by an attacker-controlled JAVA_HOME or directory layout, and confirm that the restored jzbar integration is tracked and reviewed when re-enabled.
Security signals we found
Native library loading path changed from bundled jzbar wrapper to direct System.load() of a system-provided library
Library search path is constructed from java.home and System.mapLibraryName('zbar')
No bounds checking or validation of the discovered library file before System.load()
Change is explicitly framed as a temporary revert due to missing upstream support, not as a security fix
Evidence from the diff
The patch removes the jzbar dependency from native-library extraction and JLink packaging, and replaces the previous bundled loading path with a manual System.load() call for a ‘zbar’ native library located under java.home/lib. The TODO comments indicate the jzbar integration will be restored once jzbar supports pre-loaded natives. The diff itself does not describe a vulnerability, CVE, or security report; it only describes a temporary functional revert.
Changed components
Sparrow Wallet QR-code scanning feature (ZBar integration)build.gradle native library packagingsrc/main/java/com/sparrowwallet/sparrow/io/ZBar.javaInspect captured patch +19 / −3
diff --git a/build.gradle b/build.gradle
index 83b0ba4..137055a 100644
--- a/build.gradle
+++ b/build.gradle
@@ -206,8 +206,8 @@ jlink {
'glob:/org.hid4java/win32-*/**,' +
'glob:/openpnp.capture.java/darwin-*/**,' +
'glob:/openpnp.capture.java/linux-*/**,' +
- 'glob:/openpnp.capture.java/win32-*/**,' +
- 'glob:/io.github.doblon8.jzbar/native/**']
+ 'glob:/openpnp.capture.java/win32-*/**']
+ // TODO: exclude glob:/io.github.doblon8.jzbar/native/** once jzbar supports pre-loaded natives
launcher {
name = 'sparrow'
jvmArgs = ["--enable-native-access=com.sparrowwallet.drongo",
@@ -401,7 +401,7 @@ def nativeLibJars = [
'openpnp-capture-java': "${jnaPlatform}/*",
'jSerialComm-' : "${serialOs}/${serialArch}/*",
'usb4java-' : "org/usb4java/${jnaPlatform}/*",
- 'jzbar-' : "native/${osName}/${osArch}/*",
+ // TODO: add 'jzbar-' once jzbar supports pre-loaded natives
]
tasks.register('extractNativeLibraries') {
diff --git a/src/main/java/com/sparrowwallet/sparrow/io/ZBar.java b/src/main/java/com/sparrowwallet/sparrow/io/ZBar.java
index f1e099e..2315fac 100644
--- a/src/main/java/com/sparrowwallet/sparrow/io/ZBar.java
+++ b/src/main/java/com/sparrowwallet/sparrow/io/ZBar.java
@@ -10,15 +10,31 @@ import org.slf4j.LoggerFactory;
import java.awt.*;
import java.awt.image.BufferedImage;
import java.awt.image.DataBufferByte;
+import java.io.File;
public class ZBar {
private static final Logger log = LoggerFactory.getLogger(ZBar.class);
+ private static boolean zbarLoaded;
public static boolean isEnabled() {
return com.sparrowwallet.sparrow.io.Config.get().isUseZbar();
}
+ private static synchronized void loadZBar() {
+ if(!zbarLoaded) {
+ String javaHome = System.getProperty("java.home");
+ if(javaHome != null) {
+ File libFile = new File(javaHome, "lib" + java.io.File.separator + System.mapLibraryName("zbar"));
+ if(libFile.exists()) {
+ System.load(libFile.getAbsolutePath());
+ }
+ }
+ zbarLoaded = true;
+ }
+ }
+
public static Scan scan(BufferedImage bufferedImage) {
+ loadZBar();
try {
BufferedImage grayscale = new BufferedImage(bufferedImage.getWidth(), bufferedImage.getHeight(), BufferedImage.TYPE_BYTE_GRAY);
Graphics2D g2d = (Graphics2D)grayscale.getGraphics();
Why this scored 26/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.