Bug#1151699: godot3: embedded Brotli 1.1.0 vulnerable to CVE-2026-111497

[Gajendra Nath Soren]

Package: godot3
Version: 3.6.2+ds-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: team at security.debian.org

Dear Maintainer,

The godot3 source package ships an embedded copy of Google Brotli in
thirdparty/brotli/ (thirdparty/README.md lists version 1.1.0, upstream
commit ed738e84, 2023).

This version is within the range affected by CVE-2026-111497, an
out-of-bounds write in the Brotli decoder (c/dec/decode.c), which affects
Brotli 1.0.3 through 1.2.0 according to the Debian security tracker. The
embedded copy does not contain the upstream fix: dec/decode.c still has
BROTLI_SAFE(DecodeCommandBlockSwitch(s)).

The system library is tracked in #1151685. The upstream fix for the 1.1.x
line is https://github.com/google/brotli/commit/da980636 (v1.1.1); the main
fix is in v1.2.1 (https://github.com/google/brotli/commit/b418fa81).

debian/rules disables many bundled libraries (builtin_*=no) but not Brotli,
and libbrotli-dev is not in Build-Depends, so the embedded copy appears to
be built. I have not checked which Godot code path uses it, so please
confirm whether it is reachable (for example through font loading).

Suggested fix: build against the system libbrotli (e.g. builtin_brotli=no
plus libbrotli-dev, if the 3.6 build system supports it) or apply the
upstream patch to thirdparty/brotli.

This was found while scanning the Debian source archive for embedded copies
of vulnerable code (Google Summer of Code 2026 project with Bastien
Roucariès).

Best regards,
Gajendra Nath Soren