aleister1102 2dc2a5feea fix(java): reject decoder push length exceeding input buffer capacity ...

DecoderJNI.Wrapper.push(int length) validated only length < 0. nativePush() stored input_length without an upper bound, and DecoderHandle did not retain the input buffer's allocation size, so new DecoderJNI.Wrapper(1).push(32) made BrotliDecoderDecompressStream read past the one-byte input allocation (heap out-of-bounds read).

Add an upper-bound check in Wrapper.push(), and as defense in depth store the allocation size in DecoderHandle and reject oversized input_length in nativePush(). Add DecoderJNITest covering rejection and a valid round trip.

2026-06-07 00:20:09 +07:00

..

org/brotli

fix(java): reject decoder push length exceeding input buffer capacity

2026-06-07 00:20:09 +07:00

BUILD.bazel

Fix bazel build

2026-03-13 12:31:38 +00:00

MODULE.bazel

Fix bazel build

2026-03-13 12:31:38 +00:00

MODULE.bazel.lock

Fix bazel build

2026-03-13 12:31:38 +00:00