From 8c79af57e676280cd03924d429e6ebb1548d2635 Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Mon, 7 Sep 2026 10:19:27 +0200
Subject: [PATCH] http2: use strict brotli, forbid large window

Ticket: 9008

Avoids over-allocation from a few bytes

(cherry picked from commit 2b4d7a1f3dd08453e9bf64ac99c6d38fa0a2cd4e)
---
 rust/src/http2/decompression.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rust/src/http2/decompression.rs b/rust/src/http2/decompression.rs
index 1f9f58afc2..fce581d2a4 100644
--- a/rust/src/http2/decompression.rs
+++ b/rust/src/http2/decompression.rs
@@ -90,7 +90,7 @@ pub(super) struct BrotliDecompressor {
 impl BrotliDecompressor {
     pub fn new(cursor: HTTP2cursor) -> BrotliDecompressor {
         BrotliDecompressor {
-            state: BrotliState::new(
+            state: BrotliState::new_strict(
                 HeapAlloc::<u8>::new(0),
                 HeapAlloc::<u32>::new(0),
                 HeapAlloc::<HuffmanCode>::new(HuffmanCode { bits: 0, value: 0 }),