1661261 - Update brotli to 1.0.9

Status: RESOLVED FIXED

(Core :: Graphics: Text, task, P3)

Description

[Ryan VanderMeulen [:RyanVM]]

+++ This bug was initially created as a clone of Bug #1507525 +++

Changes since 1.0.7:

• SECURITY: fix integer overflow when input chunk is longer than 2GiB

To be honest, I don't know how serious this issue is in practice for us. Obviously we might as well take this going forward, but is this something likely to actually hit us in the real world where it would make us want to backport also?

Comment 1

[Jonathan Kew [:jfkthame]]

TBH, I don't know what the implications of hitting this would be, but I guess it probably leads into undefined behavior territory where all bets are off, and someone somewhere might find a way to do bad things with it.

If it depends on feeding brotli an input payload that is >2GB as a starting point, that would tend to make it less attractive as a vector; many users would probably hit an out-of-memory crash before reaching this point.

Still, assuming it lands on central without issues, I think I'd be inclined to backport given that the fix is public, and may inspire somebody to try and stress-test it.

Comment 2

[Ryan VanderMeulen [:RyanVM]]

Try push:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=1e61dfdf58a9130b6ea379fe8de0aa5e8b622cd6

Comment 3

[Ryan VanderMeulen [:RyanVM]]

Attachment: Bug 1661261 - Update brotli to 1.0.9. r=jfkthame

Comment 4

[Ryan VanderMeulen [:RyanVM]]

Got re-released as 1.0.9 to address a build packaging issue. No code changes from 1.0.8.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4fb36e0374ed
Update brotli to 1.0.9. r=jfkthame

Comment 6

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/4fb36e0374ed

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9172198 [details]
Bug 1661261 - Update brotli to 1.0.9. r=jfkthame

Beta/Release Uplift Approval Request

• User impact if declined: Possible sec issue
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This has baked on Nightly and has good upstream test coverage, including oss-fuzz.
• String changes made/needed:

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9172198 [details]
Bug 1661261 - Update brotli to 1.0.9. r=jfkthame

Approved for 81.0b8 and 78.3esr.

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/c7bfc4640cc3

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr78/rev/bb63a7426fd3