nodejs/node · error

invalid base64-encoded comment\n

Error message

invalid base64-encoded comment\n

What it means

`ParseBase64` (brotli.c:182) decodes a relaxed base64 comment: it allows `+`/`-` and `/`/`_`, skips whitespace, requires padding count ≤ 2, and rejects decoded output longer than `MAX_COMMENT_LEN` (80 bytes). Any violation prints `invalid base64-encoded comment` and aborts. The comment is binary metadata embedded in the stream header.

Source

Thrown at deps/brotli/c/tools/brotli.c:488

                               BROTLI_MAX_WINDOW_BITS, &params->lgwin);
          if (!lgwin_set) {
            fprintf(stderr, "error parsing lgwin value [%s]\n", argv[i]);
            return COMMAND_INVALID;
          }
          if (params->lgwin != 0 && params->lgwin < BROTLI_MIN_WINDOW_BITS) {
            fprintf(stderr,
                    "lgwin parameter (%d) smaller than the minimum (%d)\n",
                    params->lgwin, BROTLI_MIN_WINDOW_BITS);
            return COMMAND_INVALID;
          }
        } else if (c == 'C') {
          if (comment_set) {
            fprintf(stderr, "comment already set\n");
            return COMMAND_INVALID;
          }
          params->comment_len = MAX_COMMENT_LEN;
          if (!ParseBase64(argv[i], params->comment, &params->comment_len)) {
            fprintf(stderr, "invalid base64-encoded comment\n");
            return COMMAND_INVALID;
          }
          comment_set = BROTLI_TRUE;
        } else if (c == 'D') {
          if (params->dictionary_path) {
            fprintf(stderr, "dictionary path already set\n");
            return COMMAND_INVALID;
          }
          params->dictionary_path = argv[i];
        } else if (c == 'S') {
          if (suffix_set) {
            fprintf(stderr, "suffix already set\n");
            return COMMAND_INVALID;
          }
          suffix_set = BROTLI_TRUE;
          params->suffix = argv[i];
        }
      }

View on GitHub (pinned to 1b2de5e052)

Solutions

1. Encode with standard base64 and keep decoded length ≤ 80 bytes: `brotli -C "$(printf %s "$c" | base64)" in`.
2. Strip non-base64 characters and verify padding (0–2 `=`).
3. If the comment is binary, ensure the base64 string decodes to ≤ 80 bytes.

Example fix

# before
brotli -C 'hello world' in
# after
brotli -C "$(printf %s 'hello world' | base64)" in

# bash: pre-validate the comment as base64 decoding to <=80 bytes
validate_b64() {
  python3 - "$1" <<'PY'
import sys, base64, binascii
s=''.join(sys.argv[1].split())
try:
    raw=base64.b64decode(s+'='*((4-len(s)%4)%4))
except binascii.Error:
    sys.exit('bad base64')
if len(raw)>80: sys.exit('decoded >80 bytes')
PY
}
argv=("$@")
for ((i=0;i<${#argv[@]};i++)); do
  if [ "${argv[$i]}" = -C ]; then
    validate_b64 "${argv[$((i+1))]:-}" || exit 2
  fi
done
brotli "$@"

# bash
if ! brotli "$@"; then rc=$?; echo "brotli exit $rc; verify base64 comment" >&2; exit "$rc"; fi

When it happens

Trigger: `brotli -C '!@#' in` (illegal char), `brotli -C '===' in` (padding >2), `brotli -C "$(head -c 200 /dev/urandom | base64)" in` (decoded > 80 bytes), `brotli -C 'A' in` (invalid length/padding combination yields false).

Common situations: Passing raw text instead of base64; URL-safe vs standard base64 mismatch handled (both are accepted here, so the issue is usually length or stray chars); very long metadata.

Related errors

• comment already set\n
• too many options passed
• quality already set
• write to standard output already set
• command already set when parsing -d

AI-assisted analysis of nodejs/node@1b2de5e052 (2026-08-13). Data as JSON: /api/errors/c30fe9356f0c77fc. Report an issue: GitHub.