Skip to content

libutil: reject truncated Brotli streams - #16575

Open
iamanaws wants to merge 1 commit into
NixOS:masterfrom
iamanaws:fix/brotli-truncated-input
Open

iamanaws wants to merge 1 commit into
NixOS:masterfrom
iamanaws:fix/brotli-truncated-input

Conversation

@iamanaws

@iamanaws iamanaws commented Oct 8, 2026

Copy link
Copy Markdown
Member

Motivation

Empty or truncated Brotli input can make decompression loop indefinitely.
The decoder requests more input, but finish() keeps retrying without any.

Context

Throw CompressionError when Brotli requests more input during finish(),
when the caller has signaled that no more bytes will arrive.
Requests for more input during normal streaming remain valid.

Add regression tests for empty and truncated input through both
decompression APIs.

Validation: 820 libutil tests passed, one skipped. Formatting passed.


Add 👍 to pull requests you find important.

The Nix maintainer team uses a GitHub project board to schedule and track reviews.

@iamanaws
iamanaws requested a review from edolstra as a code owner October 8, 2026 10:11
Comment thread src/libutil-tests/compression.cc Outdated
Comment thread src/libutil-tests/compression.cc Outdated
Fail when Brotli needs more input at EOF instead of looping forever.
Accept empty input, matching the other decompressors.

Test empty input, truncation and incremental decoding.

Assisted-by: Codex (GPT-6-Astra)
@iamanaws
iamanaws force-pushed the fix/brotli-truncated-input branch from 3b04262 to 7a55fd1 Compare October 11, 2026 13:12
@iamanaws
iamanaws requested a review from xokdvium October 11, 2026 13:14

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants