Re: Firefox "Intent to Implement" WOFF2

On Fri, Oct 3, 2014 at 1:37 PM, John Hudson <tiro@tiro.com> wrote:

> Jonathan,
>
> Out of interest, are you writing your own Brotli decoder, or using open
> source code from Google?


Using Google one I believe.



> I wonder because some of my colleagues have expressed concern about the
> single implementation of Brotli compression/decompression, as compared with
> the variety of libraries available for handling WOFF1 gzip. They wonder how
> robustly tested is the Google code, given how new Brotli is? Also, has it
> undergone security reviews?


Those are very valid concerns.  In fact, when I reviewed the code before I
found a few alarming issues.  In particular, for Brotli itself.  Granted,
this might not be exploitable currently, but definitely should be addressed:

  https://code.google.com/p/font-compression-reference/issues/detail?id=2

Possibly affecting the metadata compression:

  https://code.google.com/p/font-compression-reference/issues/detail?id=4

And a more generic issue in the woff2 implementation:

  https://code.google.com/p/font-compression-reference/issues/list

Now might be a good time to address those.

behdad