/ 
IO-Compress-Brotli-0.002
/ IO::Uncompress::Brotli
Security Advisories (2)
CVE-2020-36846 (2025-05-30)

A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library.  Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your IO::Compress::Brotli module to 0.007 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.

CVE-2020-8927 (2020-09-15)

A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.

NAME

IO::Uncompress::Brotli - Read Brotli buffers/streams

SYNOPSIS

use IO::Uncompress::Brotli;

# uncompress a buffer
my $decoded = unbro $encoded;

# uncompress a stream
my $bro = IO::Uncompress::Brotli->create;
while(have_input()) {
   my $block = get_input_block();
   my $decoded_block = $bro->decompress($block);
   handle_output_block($decoded_block);
}

DESCRIPTION

IO::Uncompress::Brotli is a module that decompresses Brotli buffers and streams. Despite its name, it is not a subclass of IO::Uncompress::Base and does not implement its interface. This will be rectified in a future release.

One-shot interface

If you have the whole buffer in a Perl scalar use the unbro function.

unbro($input)

Takes a whole compressed buffer as input and returns the decompressed data. This function relies on the BrotliDecompressedSize function. In other words, it only works if the buffer has a single meta block or two meta-blocks where the first is uncompressed and the second is empty.

Exported by default.

Streaming interface

If you want to process the data in blocks use the object oriented interface. The available methods are:

IO::Uncompress::Brotli->create

Returns a IO::Uncompress::Brotli instance. Please note that a single instance cannot be used to decompress multiple streams.

$bro->decompress($block)

Takes the a block of compressed data and returns a block of uncompressed data. Dies on error.

SEE ALSO

Brotli Compressed Data Format Internet-Draft: https://www.ietf.org/id/draft-alakuijala-brotli-08.txt

Brotli source code: https://github.com/google/brotli/

AUTHOR

Marius Gavrilescu, <marius@ieval.ro>

The encoder bindings, modernisation of the decoder bindings and a clean up of the overall project were contributed by:

Quim Rovira, <quim@rovira.cat>
Ævar Arnfjörð Bjarmason, <avarab@gmail.com>
Marcell Szathmári
Mattia Barbon, <mattia@barbon.org>

COPYRIGHT AND LICENSE

Copyright (C) 2015-2016 by Marius Gavrilescu

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself, either Perl version 5.20.2 or, at your option, any later version of Perl 5 you may have available.

1 POD Error

The following errors were encountered while parsing the POD:

Around line 109:

You forgot a '=back' before '=head1'