/ 
IO-Compress-Brotli-0.003
/ IO::Uncompress::Brotli
Security Advisories (2)
CVE-2020-36846 (2025-05-30)

A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library.  Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your IO::Compress::Brotli module to 0.007 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.

CVE-2020-8927 (2020-09-15)

A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.

NAME

IO::Uncompress::Brotli - Read Brotli buffers/streams

SYNOPSIS

use IO::Uncompress::Brotli;

# uncompress a buffer (yielding at most 10MB)
my $decoded = unbro $encoded, 10_000_000;

# uncompress a stream
my $bro = IO::Uncompress::Brotli->create;
while(have_input()) {
   my $block = get_input_block();
   my $decoded_block = $bro->decompress($block);
   handle_output_block($decoded_block);
}

DESCRIPTION

IO::Uncompress::Brotli is a module that decompresses Brotli buffers and streams. Despite its name, it is not a subclass of IO::Uncompress::Base and does not implement its interface. This will be rectified in a future release.

One-shot interface

If you have the whole buffer in a Perl scalar use the unbro function.

unbro($input, $maximum_decoded_size)

Takes a whole compressed buffer as input and returns the decompressed data. It allocates a buffer of size $maximum_decoded_size to store the decompressed data, if this is not sufficient (or there is another error) this function will croak.

Exported by default.

Streaming interface

If you want to process the data in blocks use the object oriented interface. The available methods are:

IO::Uncompress::Brotli->create

Returns a IO::Uncompress::Brotli instance. Please note that a single instance cannot be used to decompress multiple streams.

$bro->decompress($block)

Takes the a block of compressed data and returns a block of uncompressed data. Dies on error.

SEE ALSO

Brotli Compressed Data Format Internet-Draft: https://www.ietf.org/id/draft-alakuijala-brotli-08.txt

Brotli source code: https://github.com/google/brotli/

AUTHOR

Marius Gavrilescu, <marius@ieval.ro>

The encoder bindings, modernisation of the decoder bindings and a clean up of the overall project were contributed by:

Quim Rovira, <quim@rovira.cat>
Ævar Arnfjörð Bjarmason, <avarab@gmail.com>
Marcell Szathmári
Mattia Barbon, <mattia@barbon.org>

COPYRIGHT AND LICENSE

Copyright (C) 2015-2017 by Marius Gavrilescu

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself, either Perl version 5.20.2 or, at your option, any later version of Perl 5 you may have available.