Article claims OpenAI found this in February, but I don’t think that’s correct. I think Google made a change to the Brotli source code in February that fixes the issue, but hadn’t realized it was a security issue and therefore hadn’t cut a release.
Maybe an LLM just happened to do one of those "while I'm here" fixes in Feb and because nobody reviews anything anymore..
"Fixed reading too many bytes."
LGTM!
Edit: I was close! "Detect and report invalid stream earlier." Could have been a person.
The commit is attributed to "eustas" (Eugene Kliuchnikov) on the Google GitHub repo, who is the primary contributor to the Brotli project by a wide margin going back to 2015; so I think we can reasonably say it was.
Please do consider sharing the actual evidence to keep in the history, and respect actual human authors involved, their effort, time, and humane attitude... for discoveries, competition, actual achievements to learn from and get inspiration...