Integer underflow in Brotli as used in Mozilla Firefox before 45.0 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted data with brotli compression.