Skip to content

Fix max_body_size for Content-Encoding: br - #230

Merged
oalders merged 1 commit into
masterfrom
brotli-max-body-size
Jul 21, 2026
Merged

Fix max_body_size for Content-Encoding: br#230
oalders merged 1 commit into
masterfrom
brotli-max-body-size

Conversation

@oalders

@oalders oalders commented Jul 21, 2026

Copy link
Copy Markdown
Member

Fixes #229.

IO::Uncompress::Brotli::decompress is a one-argument method, so passing the limit as a second argument was an XS usage error rather than a size cap. Every brotli response therefore failed to decode whenever a limit was set, regardless of size -- an 11-byte body died under a 1 GB limit.

unbro($in, $max) is the only brotli interface that accepts a size. It decodes into a buffer of that many octets, so the limit bounds the allocation directly rather than being checked after the fact. It does not commit the buffer up front: RSS stays flat decoding a small payload under a large limit.

One consequence worth knowing: unbro reports "output buffer too small" and "this is not valid brotli" identically, so the error cannot say which occurred and names both possibilities. That is unlike the gzip and bzip2 branches, which can tell the two apart.

Test

t/message-decode-brotlibomb.t asserted only that decoding died when the body exceeded the limit. It did die -- on the arity error -- so it passed for the wrong reason since it was written. It now also asserts on the error message, and checks that a body under the limit still decodes, which is the case that was actually broken.

Verified the new assertions fail against the current master and pass here:

master     exit=2   (error-message assertion fails; under-limit test dies)
this branch exit=0

Note that prove -I is not enough to check this if you have --lib in a .proverc, since ./lib then wins over -I. Run the file with perl -I<path> directly.

The plan is now done_testing() rather than a hardcoded count.

Scope

Code, test and a Changes line only. max_body_size has no Pod on master, so nothing to update here.

decompress() is a one-argument method, so passing it the limit as a
second argument was an XS usage error rather than a size cap. Any brotli
response therefore failed to decode whenever a limit was set, no matter
how small the body was -- an 11-byte body died under a 1GB limit.

unbro() is the only brotli interface that accepts a size, so use it when
a limit is in effect. It decodes into a buffer of that many octets, so
the limit bounds the allocation directly. It does not commit the buffer
up front: RSS stays flat decoding a small payload under a large limit.

unbro() reports "output buffer too small" and "this is not valid brotli"
identically, so the error cannot say which occurred and has to name both
possibilities.

t/message-decode-brotlibomb.t asserted only that decoding died when the
body exceeded the limit. It did die -- on the arity error -- so the test
passed for the wrong reason. It now asserts on the error message, and
checks that a body under the limit still decodes.

Broken since 7fc855e, the commit that added max_body_size; released in
6.42 through 7.02.

GH#229

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@codecov

codecov Bot commented Jul 21, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.50%. Comparing base (746001b) to head (8cc1217).

Additional details and impacted files
@@            Coverage Diff             @@
##           master     #230      +/-   ##
==========================================
- Coverage   94.57%   94.50%   -0.08%     
==========================================
  Files          10       10              
  Lines        1254     1256       +2     
  Branches      350      351       +1     
==========================================
+ Hits         1186     1187       +1     
  Misses         14       14              
- Partials       54       55       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@oalders
oalders merged commit c278cf8 into master Jul 21, 2026
30 of 31 checks passed
@oalders
oalders deleted the brotli-max-body-size branch July 21, 2026 20:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

max_body_size breaks all Content-Encoding: br responses

1 participant