It looks like brotli <= 1.2.0 is vulnerable.

The python package has already been updated to 1.2.1. https://pypi.org/project/brotli/1.2.1/

Another day another out of bounds access in C code.

Can someone point the heart of this fix? I see a bunch of change of naming of constants, etc

	▲	cowlevel 4 minutes ago \| parent \| next [-]
		Doesn't mix up error-need-more-data with error-invalid-data
	▲	red75prime 2 hours ago \| parent \| prev \| next [-]
		As far as I understand it's line 1978: `goto saveStateAndReturn;`. Early return that prevents further processing.
	▲	therein an hour ago \| parent \| prev [-]
		Had a short moment to glance at it. My guess would be BROTLI_DCHECK(s>meta_block_remaining_len <= (int)BROTLI_BLOCK_SIZE_CAP) along with BROTLI_SAFE_WITH_STATUS having that goto saveStateAndReturn on non BROTLI_DECODER_SUCCESS.