Google Brotli decoder out-of-bounds write via unchecked block type switch

#!/usr/bin/env bash
# CVE-2026-111497 - Brotli Decoder OOB Write - Host Vulnerability Check
# Exit: 0=PATCHED  1=VULNERABLE  2=UNKNOWN (no Brotli found)
set -uo pipefail
OVERALL="PATCHED"; FOUND=0
mark_vuln() { echo "[VULN] $1"; OVERALL="VULNERABLE"; }
mark_ok()   { echo "[ OK ] $1"; }
mark_skip() { echo "[SKIP] $1"; }

# Version comparison: returns 0 if $1 >= $2
ver_gte() { [ "$(printf '%s\n%s' "$1" "$2" | sort -V | head -n1)" = "$2" ]; }

# Check Brotli library version against fix tracks
check_brotli() {
  local v="$1" label="$2"
  local M m p; IFS='.' read -r M m p <<< "$v"
  p="${p%%[^0-9]*}"; m="${m%%[^0-9]*}"; M="${M%%[^0-9]*}"
  [[ -z "$M" || -z "$m" ]] && { mark_skip "$label v$v (unparseable)"; return; }
  FOUND=1
  if [[ $M -ne 1 ]]; then mark_ok "$label v$v (outside 1.x)"; return; fi
  case $m in
    0) if [[ ${p:-0} -ge 10 ]]; then mark_ok "$label v$v (>=1.0.10)";
       elif [[ ${p:-0} -ge 3 ]]; then mark_vuln "$label v$v (1.0.3-1.0.9)";
       else mark_ok "$label v$v (<1.0.3, not affected)"; fi ;;
    1) if [[ ${p:-0} -ge 1 ]]; then mark_ok "$label v$v (>=1.1.1)";
       else mark_vuln "$label v$v (1.1.0)"; fi ;;
    2) if [[ ${p:-0} -ge 1 ]]; then mark_ok "$label v$v (>=1.2.1)";
       else mark_vuln "$label v$v (1.2.0)"; fi ;;
    *) mark_ok "$label v$v (>1.2.x)" ;;
  esac
}

echo "=== CVE-2026-111497 Brotli Decoder Check ==="
echo ""

# 1. System libbrotli (deb/rpm)
echo "--- System libbrotli ---"
SYS_V=""
if command -v dpkg-query &>/dev/null; then
  for pkg in libbrotli1 libbrotlidec1 brotli; do
    SYS_V=$(dpkg-query -W -f='\${Version}' "$pkg" 2>/dev/null || true)
    [[ -n "$SYS_V" ]] && break
  done
  if [[ -n "$SYS_V" ]]; then
    UP="${SYS_V#*:}"; UP="${UP%%-*}"; UP="${UP%%+*}"
    check_brotli "$UP" "libbrotli (deb: $SYS_V)"
  else mark_skip "libbrotli not found via dpkg"; fi
elif command -v rpm &>/dev/null; then
  SYS_V=$(rpm -q --qf '%{VERSION}' brotli 2>/dev/null || true)
  if [[ -n "$SYS_V" && "$SYS_V" != *"not installed"* ]]; then
    check_brotli "$SYS_V" "brotli (rpm)"
  else mark_skip "brotli not found via rpm"; fi
else mark_skip "No deb/rpm package manager found"; fi

# 2. Node.js
echo ""
echo "--- Node.js ---"
if command -v node &>/dev/null; then
  NV=$(node -v 2>/dev/null | sed 's/^v//'); FOUND=1
  NM=$(echo "$NV" | cut -d. -f1)
  case "$NM" in
    22) ver_gte "$NV" "22.23.4" && mark_ok "Node.js v$NV (>=22.23.4)" || mark_vuln "Node.js v$NV (<22.23.4)" ;;
    24) ver_gte "$NV" "24.22.1" && mark_ok "Node.js v$NV (>=24.22.1)" || mark_vuln "Node.js v$NV (<24.22.1)" ;;
    26) ver_gte "$NV" "26.12.1" && mark_ok "Node.js v$NV (>=26.12.1)" || mark_vuln "Node.js v$NV (<26.12.1)" ;;
    *)  if [[ $NM -lt 22 ]]; then mark_vuln "Node.js v$NV (EOL, no fix)"
        elif [[ $((NM % 2)) -eq 1 ]]; then mark_vuln "Node.js v$NV (odd release, likely unfixed)"
        else mark_skip "Node.js v$NV (check vendor advisory)"; fi ;;
  esac
else mark_skip "Node.js not installed"; fi

# 3. Python brotli / brotlicffi
echo ""
echo "--- Python brotli ---"
for PY in python3 python; do
  command -v "$PY" &>/dev/null || continue
  for mod in brotli brotlicffi; do
    PV=$("$PY" -I -c "import ${mod}; print(${mod}.__version__)" 2>/dev/null || true)
    [[ -n "$PV" ]] && check_brotli "$PV" "$mod ($PY)"
  done
done

# 4. Envoy
echo ""
echo "--- Envoy Proxy ---"
if command -v envoy &>/dev/null; then
  EV=$(envoy --version 2>/dev/null | grep -oP '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)
  if [[ -n "$EV" ]]; then
    FOUND=1; EM=$(echo "$EV" | cut -d. -f1,2)
    case "$EM" in
      1.36) ver_gte "$EV" "1.36.12" && mark_ok "Envoy v$EV" || mark_vuln "Envoy v$EV (<1.36.12)" ;;
      1.37) ver_gte "$EV" "1.37.8"  && mark_ok "Envoy v$EV" || mark_vuln "Envoy v$EV (<1.37.8)" ;;
      1.38) ver_gte "$EV" "1.38.6"  && mark_ok "Envoy v$EV" || mark_vuln "Envoy v$EV (<1.38.6)" ;;
      1.39) ver_gte "$EV" "1.39.3"  && mark_ok "Envoy v$EV" || mark_vuln "Envoy v$EV (<1.39.3)" ;;
      *)    ver_gte "$EV" "1.40.0"  && mark_ok "Envoy v$EV" || mark_skip "Envoy v$EV (verify manually)" ;;
    esac
  fi
else mark_skip "Envoy not installed"; fi

# 5. Bun
echo ""
echo "--- Bun ---"
if command -v bun &>/dev/null; then
  BV=$(bun --version 2>/dev/null || true); FOUND=1
  ver_gte "$BV" "1.4.4" && mark_ok "Bun v$BV (>=1.4.4)" || mark_vuln "Bun v$BV (<1.4.4)"
else mark_skip "Bun not installed"; fi

echo ""
echo "================================"
if [[ $FOUND -eq 0 ]]; then
  echo "UNKNOWN - no Brotli components detected on this host"
  exit 2
elif [[ "$OVERALL" == "VULNERABLE" ]]; then
  echo "VULNERABLE - one or more components need patching for CVE-2026-111497"
  exit 1
else
  echo "PATCHED - all detected Brotli components are at fixed versions"
  exit 0
fi