From 7b2b78f8253528697fa9aa11e56914d184404c12 Mon Sep 17 00:00:00 2001
From: Your Name <azanulworkspace@gmail.com>
Date: Tue, 31 Mar 2026 21:26:57 +0530
Subject: [PATCH 1/2] Add libFuzzer target for BrotliDecoderAttachDictionary
 overflow

---
 tests/fuzz/fuzz_attach_dict.c | 51 +++++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100644 tests/fuzz/fuzz_attach_dict.c

diff --git a/tests/fuzz/fuzz_attach_dict.c b/tests/fuzz/fuzz_attach_dict.c
new file mode 100644
index 000000000..7c90376e9
--- /dev/null
+++ b/tests/fuzz/fuzz_attach_dict.c
@@ -0,0 +1,51 @@
+#include <stdint.h>
+#include <stdlib.h>
+#include <brotli/decode.h>
+
+// Fuzz target for:
+// Integer overflow in AttachCompoundDictionary()
+// leading to infinite loop in EnsureCompoundDictionaryInitialized()
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+    // Create decoder instance
+    BrotliDecoderState *state = BrotliDecoderCreateInstance(NULL, NULL, NULL);
+    if (!state) return 0;
+
+    // 🔥 Force dict_size > INT_MAX to trigger overflow
+    size_t dict_size = ((size_t)1 << 31) + size;
+
+    // 🔥 Attach multiple dictionaries to simulate cumulative overflow
+    for (int i = 0; i < 5; i++) {
+        BrotliDecoderAttachDictionary(
+            state,
+            BROTLI_SHARED_DICTIONARY_RAW,
+            dict_size,
+            data
+        );
+    }
+
+    // 🔥 Trigger decoding path (important for infinite loop)
+    uint8_t output[32];
+
+    size_t available_in = size;
+    const uint8_t *next_in = data;
+
+    size_t available_out = sizeof(output);
+    uint8_t *next_out = output;
+
+    size_t total_out = 0;
+
+    BrotliDecoderDecompressStream(
+        state,
+        &available_in,
+        &next_in,
+        &available_out,
+        &next_out,
+        &total_out
+    );
+
+    // Cleanup
+    BrotliDecoderDestroyInstance(state);
+
+    return 0;
+}

From baf672f482a312152738b4da9a07e1077508fa93 Mon Sep 17 00:00:00 2001
From: Your Name <azanulworkspace@gmail.com>
Date: Tue, 31 Mar 2026 21:38:37 +0530
Subject: [PATCH 2/2] Trigger CLA recheck