[Devdha]

Background

WOFF2 decompresses untrusted fonts with the Brotli decoder. The bundled brotli submodule is still at commit 533843e (2018), which predates the Brotli decoder fixes for CVE-2026-111497. This is the issue reported in #207.

Change

• Bump the brotli submodule to v1.2.1 (db24a98), the release that contains the decoder fix.
• Update the Makefile to build the bundled Brotli sources directly:
  • Brotli 1.2.1 no longer ships the in-tree Makefile that the old deps target invoked (make -C brotli lib).
  • Compile brotli/c/{common,dec,enc}/*.c with the same flags already used for the rest of the Makefile and link the resulting objects into the tools and fuzzer archives.
  • Add .DEFAULT_GOAL := all so the new object pattern rule does not become the default goal.
• make clean now removes the compiled Brotli objects.

The CMake build is untouched; it still uses the system Brotli as before.

Testing

make clean
make -j4

Built woff2_compress, woff2_decompress, woff2_info and both fuzzer archives successfully on macOS.

Round-trip check with a system TTF:

./woff2_compress Arial.ttf
./woff2_decompress Arial.woff2

The decompressed file loads with fontTools with the same 3,381 glyphs.

Fixes #207.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.