C# library can enter infinite loop on decompression. #552

Open
opened 2026-01-29 20:45:43 +00:00 by claunia · 2 comments
Owner

Originally created by @AlexC-CCL on GitHub (Sep 30, 2025).

Hi,

I happened upon an odd bug when attempting to decompress data which was not a valid brotli stream using the C# library which caused my application to hang. I tracked the bug to this line:

d74b0a4a22/csharp/org/brotli/dec/BitReader.cs (L257)

The Read method will never return -1, it returns 0 on EoF (I think this is just a translation error from Java, this same issue is noted here: d74b0a4a22/csharp/org/brotli/dec/BitReader.cs (L79) but didn't get changed for the other call) - if EoF is hit early in CopyBytes, an infinite loop is entered with the Read method returning 0 over and over and never triggering the exception as it should.

The fix should just be to change -1 to 0 - this correctly triggered the BrotliRuntimeException in my code.

Originally created by @AlexC-CCL on GitHub (Sep 30, 2025). Hi, I happened upon an odd bug when attempting to decompress data which was not a valid brotli stream using the C# library which caused my application to hang. I tracked the bug to this line: https://github.com/google/brotli/blob/d74b0a4a22163792aec1b91739c1938a66867ae8/csharp/org/brotli/dec/BitReader.cs#L257 The Read method will never return -1, it returns 0 on EoF (I think this is just a translation error from Java, this same issue is noted here: https://github.com/google/brotli/blob/d74b0a4a22163792aec1b91739c1938a66867ae8/csharp/org/brotli/dec/BitReader.cs#L79 but didn't get changed for the other call) - if EoF is hit early in CopyBytes, an infinite loop is entered with the Read method returning 0 over and over and never triggering the exception as it should. The fix should just be to change -1 to 0 - this correctly triggered the `BrotliRuntimeException` in my code.
Author
Owner

@eustas commented on GitHub (Oct 21, 2025):

This seems to be fixed in Java code; C# transpiled code needs to be refreshed...

@eustas commented on GitHub (Oct 21, 2025): This seems to be fixed in Java code; C# transpiled code needs to be refreshed...
Author
Owner

@eustas commented on GitHub (Oct 21, 2025):

Going soon to change transpiler from sharpen to one used for other languages (go/js/ts/kt). In the meanwhile will add .csproj files and build/test CI workflows.

@eustas commented on GitHub (Oct 21, 2025): Going soon to change transpiler from sharpen to one used for other languages (go/js/ts/kt). In the meanwhile will add .csproj files and build/test CI workflows.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/brotli#552