3 ms·
> memory safety is still not going to make it free from vulnerabilities to accidental DoS attacks What kinds of DoS attacks are you thinking about that aren't
by pcwalton 10y ago
> memory safety is still not going to make it free from vulnerabilities to accidental DoS attacks
What kinds of DoS attacks are you thinking about that aren't covered by simply limiting the size of the images you need to parse?
I mean, I've written a PNG decoder and the only dynamic allocation I can think of that I needed was the actual decoded image data.
- tinus_hn 10y agoPNG compresses the image data using the DEFLATE algorithm. You can write data that decompresses to almost 1023 times the size of the compressed data. So if you allow 1 MB images, be prepared to allocate memory for and process about 1 GB of data.
- Rusky 10y agoPNG also explicitly specifies image dimensions, so there's no need for that at all.