3 ms·
It's unlikely any of the parsers would apply recursive decompression, so a ZipQuine isn't going to help exhaust resources.
by cyounkins 9y ago
It's unlikely any of the parsers would apply recursive decompression, so a ZipQuine isn't going to help exhaust resources.
- amenghra 9y agoTrue. I wonder what's the largest file you can decompress to given some bound on the compressed result.
- pinpeliponni 9y agoAt least none of the Java libraries seemed to fall for this when I tried.
- vog 9y agoIndeed. ZipQuines are not targeted against servers, but against middleware. More precisely, these try to attack certain kinds of "security scanners". Those security scanners want to unpack as much as possible, by design(!), otherwise bad code could hide behind yet another round of compressed container formats.
- masklinn 9y agoYes scanners and AV is what's targetted by quines.