/ 
IO-Compress-Brotli-0.005-TRIAL
/ IO::Uncompress::Brotli
Security Advisories (1)
CVE-2020-36846 (2025-05-30)

A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library.  Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your IO::Compress::Brotli module to 0.007 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.

NAME

IO::Uncompress::Brotli - Read Brotli buffers/streams

SYNOPSIS

use IO::Uncompress::Brotli;

# uncompress a buffer (yielding at most 10MB)
my $decoded = unbro $encoded, 10_000_000;

# uncompress a stream
my $bro = IO::Uncompress::Brotli->create;
while(have_input()) {
   my $block = get_input_block();
   my $decoded_block = $bro->decompress($block);
   handle_output_block($decoded_block);
}

DESCRIPTION

IO::Uncompress::Brotli is a module that decompresses Brotli buffers and streams. Despite its name, it is not a subclass of IO::Uncompress::Base and does not implement its interface. This will be rectified in a future release.

One-shot interface

If you have the whole buffer in a Perl scalar use the unbro function.

unbro($input, $maximum_decoded_size)

Takes a whole compressed buffer as input and returns the decompressed data. It allocates a buffer of size $maximum_decoded_size to store the decompressed data, if this is not sufficient (or there is another error) this function will croak.

As of version 0.004_002, the $maximum_decoded_size argument is optional. If not provided, unbro uses the streaming interface described in the next section to decompress the buffer in blocks of one megabyte. The decompressed blocks are concatenated and returned.

Exported by default.

Streaming interface

If you want to process the data in blocks use the object oriented interface. The available methods are:

IO::Uncompress::Brotli->create

Returns a IO::Uncompress::Brotli instance. Please note that a single instance cannot be used to decompress multiple streams.

$bro->decompress($block)

Takes the a block of compressed data and returns a block of uncompressed data. Dies on error.

SEE ALSO

RFC 7392 Brotli Compressed Data Format: https://tools.ietf.org/html/rfc7932

Brotli source code: https://github.com/google/brotli/

AUTHOR

Marius Gavrilescu, <marius@ieval.ro>

The encoder bindings, modernisation of the decoder bindings and a clean up of the overall project were contributed by:

Quim Rovira, <quim@rovira.cat>
Ævar Arnfjörð Bjarmason, <avarab@gmail.com>
Marcell Szathmári
Mattia Barbon, <mattia@barbon.org>

POD fix by Mark Zabaro, <markzabaro@gmail.com>.

COPYRIGHT AND LICENSE

Copyright (C) 2015-2018 by Marius Gavrilescu

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself, either Perl version 5.20.2 or, at your option, any later version of Perl 5 you may have available.