BROTLI_BUILD_PORTABLE has dangerous default setting #89

New Issue

claunia · 2026-01-29T20:32:42Z

claunia commented

2026-01-29 20:32:42 +00:00

Originally created by @ncopa on GitHub (Jan 28, 2016).

firefox 44.0 recently shipped with brotli support. On Alpine Linux (which uses musl libc) it crashed due to it was not built with BROTLI_BUILD_PORTABLE set. (or BROTLI_SAFE_MEMMOVE to be sepcific)

There was no warning and there was no way to catch it til after the fact that it had happened. (it wouldn't been caught if we wouldn't build with FORTIFY_SOURCE).

I would recommend that you flip the default setting around and by default build with BROTLI_BUILD_PORTABLE or change it to BROTLI_BUILD_NONPORTABLE, because the memcpy implementation is outside of your control, you can not verify or warn if things gets miscompiled and relying on "undefined behavior" is generally a bad idea.

Originally created by @ncopa on GitHub (Jan 28, 2016). firefox 44.0 recently shipped with brotli support. On Alpine Linux (which uses musl libc) it [crashed](https://bugzilla.mozilla.org/show_bug.cgi?id=1243724) due to it was not built with BROTLI_BUILD_PORTABLE set. (or BROTLI_SAFE_MEMMOVE to be sepcific) There was no warning and there was no way to catch it til after the fact that it had happened. (it wouldn't been caught if we wouldn't build with FORTIFY_SOURCE). I would recommend that you flip the default setting around and by default build with `BROTLI_BUILD_PORTABLE` or change it to `BROTLI_BUILD_NONPORTABLE`, because the memcpy implementation is outside of your control, you can not verify or warn if things gets miscompiled and relying on "undefined behavior" is generally a bad idea.

claunia referenced this issue

2026-01-29 20:50:23 +00:00

[PR #89] [MERGED] Create -03 version of the internet draft. #691

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/brotli#89