Skip to content

std.brotli: a decoder, capped, that refuses an unpatched libbrotlidec (CVE-2026-111497) #3133

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
paul-hammant merged 2 commits into from
Oct 24, 2026
Merged

std.brotli: a decoder, capped, that refuses an unpatched libbrotlidec (CVE-2026-111497) #3133

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
432269b
std.brotli: add one-shot and streaming decoder with size limits
google-labs-jules[bot] Oct 24, 2026
336ae3d
std.brotli decoder: refuse an unpatched libbrotlidec, report truncati…
paul-hammant Oct 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 12 additions & 7 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -583,14 +583,19 @@ ifeq ($(BROTLI),0)
BROTLI_CFLAGS :=
BROTLI_LDFLAGS :=
else
BROTLI_CFLAGS := $(shell pkg-config --cflags libbrotlienc 2>/dev/null)
BROTLI_CFLAGS := $(shell pkg-config --cflags libbrotlienc libbrotlidec 2>/dev/null)
# --static so libbrotlicommon comes with it. It is a Requires.private of
# libbrotlienc, so a plain --libs omits it -- fine when the loader resolves
# a shared object, fatal on a static link: MinGW's ld then reports a wall of
# undefined BrotliGetDictionary / BrotliDefaultAllocFunc / _kBrotli*
# references from inside libbrotlienc.a itself. Found on a real MSYS2 box;
# a Linux shared link hides it entirely.
BROTLI_LDFLAGS := $(shell pkg-config --static --libs libbrotlienc 2>/dev/null)
# libbrotlienc and libbrotlidec, so a plain --libs omits it -- fine when the
# loader resolves a shared object, fatal on a static link: MinGW's ld then
# reports a wall of undefined BrotliGetDictionary / BrotliDefaultAllocFunc /
# _kBrotli* references from inside libbrotlienc.a itself. Found on a real
# MSYS2 box; a Linux shared link hides it entirely. Asking for both
# libraries names -lbrotlicommon twice, and the link line must name each
# library once (optional_library_linking checks), so keep the LAST of each:
# a static link resolves left to right, and -lbrotlicommon has to follow
# libbrotlidec as well as libbrotlienc.
BROTLI_LDFLAGS := $(shell pkg-config --static --libs libbrotlienc libbrotlidec 2>/dev/null \
| awk '{ o = ""; for (i = NF; i > 0; i--) if (!seen[$$i]++) o = $$i " " o; print o }')
endif
ifneq ($(BROTLI_LDFLAGS),)
BROTLI_CFLAGS += -DAETHER_HAS_BROTLI
Expand Down
2 changes: 1 addition & 1 deletion compiler/codegen/codegen.c
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

91 changes: 89 additions & 2 deletions docs/api/brotli.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,13 +24,27 @@ <h2>Exports</h2>
<li><a href="#get_compress_bytes">get_compress_bytes</a></li>
<li><a href="#get_compress_length">get_compress_length</a></li>
<li><a href="#release_compress">release_compress</a></li>
<li><a href="#get_decompress_bytes">get_decompress_bytes</a></li>
<li><a href="#get_decompress_length">get_decompress_length</a></li>
<li><a href="#release_decompress">release_decompress</a></li>
<li><a href="#try_decompress_stream_new">try_decompress_stream_new</a></li>
<li><a href="#get_decompress_stream_bytes">get_decompress_stream_bytes</a></li>
<li><a href="#get_decompress_stream_length">get_decompress_stream_length</a></li>
<li><a href="#release_decompress_stream">release_decompress_stream</a></li>
<li><a href="#available">available</a></li>
<li><a href="#decoder_available">decoder_available</a></li>
<li><a href="#compress">compress</a></li>
<li><a href="#decompress">decompress</a></li>
<li><a href="#decompress_max">decompress_max</a></li>
<li><a href="#stream_new">stream_new</a></li>
<li><a href="#stream_write">stream_write</a></li>
<li><a href="#stream_flush">stream_flush</a></li>
<li><a href="#stream_finish">stream_finish</a></li>
<li><a href="#stream_free">stream_free</a></li>
<li><a href="#decompress_stream_new">decompress_stream_new</a></li>
<li><a href="#decompress_stream_write">decompress_stream_write</a></li>
<li><a href="#decompress_stream_finish">decompress_stream_finish</a></li>
<li><a href="#decompress_stream_free">decompress_stream_free</a></li>
<li><a href="#MIN_QUALITY">MIN_QUALITY</a></li>
<li><a href="#MAX_QUALITY">MAX_QUALITY</a></li>
<li><a href="#DEFAULT_QUALITY">DEFAULT_QUALITY</a></li>
Expand Down Expand Up @@ -132,7 +146,7 @@ <h2>Modules</h2>
<main class="content">
<div class="module-header">
<h1>brotli</h1>
<p class="module-desc">std.brotli — Brotli compression (RFC 7932), streaming and one-shot.</p>
<p class="module-desc">std.brotli — Brotli (RFC 7932) encoding and decoding, streaming and one-shot.</p>
<p class="import-line"><code>import std.brotli</code></p>
</div>
<div class="functions" id="functions">
Expand Down Expand Up @@ -178,17 +192,66 @@ <h3 class="function-name">get_compress_length <span class="kind">extern</span></
<h3 class="function-name">release_compress <span class="kind">extern</span></h3>
<pre class="usage"><code>release_compress()</code></pre>
</div>
<div class="function" id="get_decompress_bytes" data-name="get_decompress_bytes">
<h3 class="function-name">get_decompress_bytes <span class="kind">extern</span></h3>
<pre class="usage"><code>get_decompress_bytes() <span class="arrow">-&gt;</span> ptr</code></pre>
</div>
<div class="function" id="get_decompress_length" data-name="get_decompress_length">
<h3 class="function-name">get_decompress_length <span class="kind">extern</span></h3>
<pre class="usage"><code>get_decompress_length() <span class="arrow">-&gt;</span> int</code></pre>
</div>
<div class="function" id="release_decompress" data-name="release_decompress">
<h3 class="function-name">release_decompress <span class="kind">extern</span></h3>
<pre class="usage"><code>release_decompress()</code></pre>
</div>
<div class="function" id="try_decompress_stream_new" data-name="try_decompress_stream_new">
<h3 class="function-name">try_decompress_stream_new <span class="kind">extern</span></h3>
<pre class="usage"><code>try_decompress_stream_new(max_bytes) <span class="arrow">-&gt;</span> ptr</code></pre>
<p class="signature"><span class="sig-params">max_bytes: int</span></p>
</div>
<div class="function" id="get_decompress_stream_bytes" data-name="get_decompress_stream_bytes">
<h3 class="function-name">get_decompress_stream_bytes <span class="kind">extern</span></h3>
<pre class="usage"><code>get_decompress_stream_bytes(handle) <span class="arrow">-&gt;</span> ptr</code></pre>
<p class="signature"><span class="sig-params">handle: ptr</span></p>
</div>
<div class="function" id="get_decompress_stream_length" data-name="get_decompress_stream_length">
<h3 class="function-name">get_decompress_stream_length <span class="kind">extern</span></h3>
<pre class="usage"><code>get_decompress_stream_length(handle) <span class="arrow">-&gt;</span> int</code></pre>
<p class="signature"><span class="sig-params">handle: ptr</span></p>
</div>
<div class="function" id="release_decompress_stream" data-name="release_decompress_stream">
<h3 class="function-name">release_decompress_stream <span class="kind">extern</span></h3>
<pre class="usage"><code>release_decompress_stream(handle)</code></pre>
<p class="signature"><span class="sig-params">handle: ptr</span></p>
</div>
<div class="function" id="available" data-name="available">
<h3 class="function-name">available <span class="kind">fn</span></h3>
<pre class="usage"><code>available() <span class="arrow">-&gt;</span> int</code></pre>
<p class="doc">1 when the toolchain was built with libbrotlienc detected. Use it to skip a test or pick a fallback encoding rather than threading an error everywhere.</p>
<p class="doc">1 when the toolchain was built with libbrotli detected. Use it to skip a test or pick a fallback encoding rather than threading an error everywhere.</p>
</div>
<div class="function" id="decoder_available" data-name="decoder_available">
<h3 class="function-name">decoder_available <span class="kind">fn</span></h3>
<pre class="usage"><code>decoder_available() <span class="arrow">-&gt;</span> int</code></pre>
<p class="doc">1 when decoding works here: brotli is built in AND the system libbrotlidec carries the CVE-2026-111497 fix (an out-of-bounds write on malformed input, libbrotli 1.0.3 to 1.2.0). Without the fix every decode refuses with an error rather than run a decoder that untrusted input can exploit; encoding is unaffected. The check asks the library itself, so a distro backport that keeps the old version number passes.</p>
</div>
<div class="function" id="compress" data-name="compress">
<h3 class="function-name">compress <span class="kind">fn</span></h3>
<pre class="usage"><code>compress(data, quality)</code></pre>
<p class="signature"><span class="sig-params">data: byte[], quality: int</span></p>
<p class="doc">One-shot: compress a body already in memory. Returns (bytes, count, &quot;&quot;) on success, (&quot;&quot;, 0, error) otherwise. Quality out of range is clamped.</p>
</div>
<div class="function" id="decompress" data-name="decompress">
<h3 class="function-name">decompress <span class="kind">fn</span></h3>
<pre class="usage"><code>decompress(data)</code></pre>
<p class="signature"><span class="sig-params">data: byte[]</span></p>
<p class="doc">One-shot: decompress with the default 1 GiB ceiling. Returns (bytes, count, &quot;&quot;) on success, (&quot;&quot;, 0, error) otherwise. For input you did not produce, use decompress_max with a cap that fits the job.</p>
</div>
<div class="function" id="decompress_max" data-name="decompress_max">
<h3 class="function-name">decompress_max <span class="kind">fn</span></h3>
<pre class="usage"><code>decompress_max(data, max_bytes)</code></pre>
<p class="signature"><span class="sig-params">data: byte[], max_bytes: int</span></p>
<p class="doc">One-shot with a cap: decoding stops, and returns an &quot;output limit exceeded&quot; error, as soon as the output would pass `max_bytes` (0 = the 1 GiB ceiling). Truncated input, corrupt input and bytes after the end of the stream are errors too.</p>
</div>
<div class="function" id="stream_new" data-name="stream_new">
<h3 class="function-name">stream_new <span class="kind">fn</span></h3>
<pre class="usage"><code>stream_new(quality, window) <span class="arrow">-&gt;</span> (ptr, string)</code></pre>
Expand Down Expand Up @@ -219,6 +282,30 @@ <h3 class="function-name">stream_free <span class="kind">fn</span></h3>
<p class="signature"><span class="sig-params">handle: ptr</span></p>
<p class="doc">Release the handle. Safe on null.</p>
</div>
<div class="function" id="decompress_stream_new" data-name="decompress_stream_new">
<h3 class="function-name">decompress_stream_new <span class="kind">fn</span></h3>
<pre class="usage"><code>decompress_stream_new(max_bytes) <span class="arrow">-&gt;</span> (ptr, string)</code></pre>
<p class="signature"><span class="sig-params">max_bytes: int</span></p>
<p class="doc">Open a decoding stream whose total output is capped at `max_bytes` (0 = the 1 GiB ceiling). Returns (handle, &quot;&quot;) or (null, error).</p>
</div>
<div class="function" id="decompress_stream_write" data-name="decompress_stream_write">
<h3 class="function-name">decompress_stream_write <span class="kind">fn</span></h3>
<pre class="usage"><code>decompress_stream_write(handle, data)</code></pre>
<p class="signature"><span class="sig-params">handle: ptr, data: byte[]</span></p>
<p class="doc">Feed compressed bytes in any size of chunk. Returns (bytes, count, &quot;&quot;) with whatever they decoded to. After an error the handle refuses further writes.</p>
</div>
<div class="function" id="decompress_stream_finish" data-name="decompress_stream_finish">
<h3 class="function-name">decompress_stream_finish <span class="kind">fn</span></h3>
<pre class="usage"><code>decompress_stream_finish(handle) <span class="arrow">-&gt;</span> (string, int, string)</code></pre>
<p class="signature"><span class="sig-params">handle: ptr</span></p>
<p class="doc">Confirm the stream ended. Returns (&quot;&quot;, 0, &quot;&quot;) when it did, and a &quot;truncated stream&quot; error when the input stopped short of the end, so a cut connection is not mistaken for a shorter body. Still needs decompress_stream_free.</p>
</div>
<div class="function" id="decompress_stream_free" data-name="decompress_stream_free">
<h3 class="function-name">decompress_stream_free <span class="kind">fn</span></h3>
<pre class="usage"><code>decompress_stream_free(handle)</code></pre>
<p class="signature"><span class="sig-params">handle: ptr</span></p>
<p class="doc">Release a decoding stream. Safe on null.</p>
</div>
<div class="function" id="MIN_QUALITY" data-name="MIN_QUALITY">
<h3 class="function-name">MIN_QUALITY <span class="kind">const</span></h3>
<pre class="usage"><code>MIN_QUALITY = 0</code></pre>
Expand Down
18 changes: 16 additions & 2 deletions docs/api/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,8 +148,8 @@ <h3>bits</h3>
</a>
<a href="brotli.html" class="module-card">
<h3>brotli</h3>
<p>std.brotli — Brotli compression (RFC 7932), streaming and one-shot.</p>
<span class="count">20 exports</span>
<p>std.brotli — Brotli (RFC 7932) encoding and decoding, streaming and one-shot.</p>
<span class="count">34 exports</span>
</a>
<a href="bytes.html" class="module-card">
<h3>bytes</h3>
Expand Down Expand Up @@ -679,13 +679,27 @@ <h2>Search Results</h2>
<li class="function-item" data-name="get_compress_bytes"><a href="brotli.html#get_compress_bytes"><span class="fn-name">get_compress_bytes</span><span class="fn-module">brotli</span></a></li>
<li class="function-item" data-name="get_compress_length"><a href="brotli.html#get_compress_length"><span class="fn-name">get_compress_length</span><span class="fn-module">brotli</span></a></li>
<li class="function-item" data-name="release_compress"><a href="brotli.html#release_compress"><span class="fn-name">release_compress</span><span class="fn-module">brotli</span></a></li>
<li class="function-item" data-name="get_decompress_bytes"><a href="brotli.html#get_decompress_bytes"><span class="fn-name">get_decompress_bytes</span><span class="fn-module">brotli</span></a></li>
<li class="function-item" data-name="get_decompress_length"><a href="brotli.html#get_decompress_length"><span class="fn-name">get_decompress_length</span><span class="fn-module">brotli</span></a></li>
<li class="function-item" data-name="release_decompress"><a href="brotli.html#release_decompress"><span class="fn-name">release_decompress</span><span class="fn-module">brotli</span></a></li>
<li class="function-item" data-name="try_decompress_stream_new"><a href="brotli.html#try_decompress_stream_new"><span class="fn-name">try_decompress_stream_new</span><span class="fn-module">brotli</span></a></li>
<li class="function-item" data-name="get_decompress_stream_bytes"><a href="brotli.html#get_decompress_stream_bytes"><span class="fn-name">get_decompress_stream_bytes</span><span class="fn-module">brotli</span></a></li>
<li class="function-item" data-name="get_decompress_stream_length"><a href="brotli.html#get_decompress_stream_length"><span class="fn-name">get_decompress_stream_length</span><span class="fn-module">brotli</span></a></li>
<li class="function-item" data-name="release_decompress_stream"><a href="brotli.html#release_decompress_stream"><span class="fn-name">release_decompress_stream</span><span class="fn-module">brotli</span></a></li>
<li class="function-item" data-name="available"><a href="brotli.html#available"><span class="fn-name">available</span><span class="fn-module">brotli</span></a></li>
<li class="function-item" data-name="decoder_available"><a href="brotli.html#decoder_available"><span class="fn-name">decoder_available</span><span class="fn-module">brotli</span></a></li>
<li class="function-item" data-name="compress"><a href="brotli.html#compress"><span class="fn-name">compress</span><span class="fn-module">brotli</span></a></li>
<li class="function-item" data-name="decompress"><a href="brotli.html#decompress"><span class="fn-name">decompress</span><span class="fn-module">brotli</span></a></li>
<li class="function-item" data-name="decompress_max"><a href="brotli.html#decompress_max"><span class="fn-name">decompress_max</span><span class="fn-module">brotli</span></a></li>
<li class="function-item" data-name="stream_new"><a href="brotli.html#stream_new"><span class="fn-name">stream_new</span><span class="fn-module">brotli</span></a></li>
<li class="function-item" data-name="stream_write"><a href="brotli.html#stream_write"><span class="fn-name">stream_write</span><span class="fn-module">brotli</span></a></li>
<li class="function-item" data-name="stream_flush"><a href="brotli.html#stream_flush"><span class="fn-name">stream_flush</span><span class="fn-module">brotli</span></a></li>
<li class="function-item" data-name="stream_finish"><a href="brotli.html#stream_finish"><span class="fn-name">stream_finish</span><span class="fn-module">brotli</span></a></li>
<li class="function-item" data-name="stream_free"><a href="brotli.html#stream_free"><span class="fn-name">stream_free</span><span class="fn-module">brotli</span></a></li>
<li class="function-item" data-name="decompress_stream_new"><a href="brotli.html#decompress_stream_new"><span class="fn-name">decompress_stream_new</span><span class="fn-module">brotli</span></a></li>
<li class="function-item" data-name="decompress_stream_write"><a href="brotli.html#decompress_stream_write"><span class="fn-name">decompress_stream_write</span><span class="fn-module">brotli</span></a></li>
<li class="function-item" data-name="decompress_stream_finish"><a href="brotli.html#decompress_stream_finish"><span class="fn-name">decompress_stream_finish</span><span class="fn-module">brotli</span></a></li>
<li class="function-item" data-name="decompress_stream_free"><a href="brotli.html#decompress_stream_free"><span class="fn-name">decompress_stream_free</span><span class="fn-module">brotli</span></a></li>
<li class="function-item" data-name="MIN_QUALITY"><a href="brotli.html#MIN_QUALITY"><span class="fn-name">MIN_QUALITY</span><span class="fn-module">brotli</span></a></li>
<li class="function-item" data-name="MAX_QUALITY"><a href="brotli.html#MAX_QUALITY"><span class="fn-name">MAX_QUALITY</span><span class="fn-module">brotli</span></a></li>
<li class="function-item" data-name="DEFAULT_QUALITY"><a href="brotli.html#DEFAULT_QUALITY"><span class="fn-name">DEFAULT_QUALITY</span><span class="fn-module">brotli</span></a></li>
Expand Down
2 changes: 1 addition & 1 deletion docs/stdlib-reference.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ header comment is the authoritative description.
| `std.audit` | Query the sandbox audit trail. | 4 | [guide](../std/audit/README.md) · [source](../std/audit/module.ae) |
| `std.bignum` | Arbitrary-precision integers. | 29 | [guide](../std/bignum/README.md) · [source](../std/bignum/module.ae) |
| `std.bits` | Unsigned bit operations: rotates, shifts, popcount, leading zeros, unsigned divide. | 17 | [guide](../std/bits/README.md) · [source](../std/bits/module.ae) |
| `std.brotli` | Brotli compression, streaming and one-shot, for `Content-Encoding: br`. | 20 | [guide](../std/brotli/README.md) · [source](../std/brotli/module.ae) |
| `std.brotli` | Brotli encoding and capped decoding, streaming and one-shot, for `Content-Encoding: br`. | 34 | [guide](../std/brotli/README.md) · [source](../std/brotli/module.ae) |
| `std.bytes` | Mutable byte buffer with random access and overlap-safe copies. | 32 | [guide](../std/bytes/README.md) · [source](../std/bytes/module.ae) |
| `std.capsicum` | FreeBSD Capsicum capability-mode bindings. | 28 | [guide](../std/capsicum/README.md) · [source](../std/capsicum/module.ae) |
| `std.cas` | Content-addressed store keyed by the sha256 of file contents. | 7 | [guide](../std/cas/README.md) · [source](../std/cas/module.ae) |
Expand Down
Loading
Loading