Hacker News new | past | comments | ask | show | jobs | submit
ks2048 | on: Evolving Threat: http2shell is an RCE in Node, Python, and more
Can someone point the heart of this fix? I see a bunch of change of naming of constants, etc
red75prime | parent | next
As far as I understand it's line 1978: `goto saveStateAndReturn;`. Early return that prevents further processing.
cowlevel | parent | next
Doesn't mix up error-need-more-data with error-invalid-data
therein | parent
Had a short moment to glance at it. My guess would be BROTLI_DCHECK(s>meta_block_remaining_len <= (int)BROTLI_BLOCK_SIZE_CAP) along with BROTLI_SAFE_WITH_STATUS having that goto saveStateAndReturn on non BROTLI_DECODER_SUCCESS.