Skip to content

Comments

Brotli bombs; brotli-1.2 upgrade; GeneratorReader fix#266

Merged
vanschelven merged 3 commits intomainfrom
brotli-bombs-and-1.2
Nov 8, 2025
Merged

Brotli bombs; brotli-1.2 upgrade; GeneratorReader fix#266
vanschelven merged 3 commits intomainfrom
brotli-bombs-and-1.2

Conversation

@vanschelven
Copy link
Contributor

No description provided.

This became possible with brotli 1.2.0

It is my understanding pre-this change there was basically no
enforced limit on the amount of bytes "coming out" of
decompressor.process(); in other words: chunk size did not
apply to the most relevant (potentially blowing up) part of
the equation.

We had a MaxDataReader in place, but that would come "too late"
since all the mem-consuming stuff would happen right in brotli_generator
before any limiting would be possible.

See google/brotli#1381
this was exposed when dealing with things that yield in very big chunks
potentially (e.g. brotli bombs)

tests are more directly on the GeneratorReader itself now rather than
integrating this with particular genators-under-test.
@vanschelven vanschelven merged commit 3f65544 into main Nov 8, 2025
16 checks passed
Cycloctane

This comment was marked as duplicate.

@bugsink bugsink deleted a comment from Cycloctane Nov 8, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants