4 ms·
> The Images team addressed the vulnerability in a way that didn’t require any changes to the original images or cause any increased latency or regressions for
by byteknight 3y ago
> The Images team addressed the vulnerability in a way that didn’t require any changes to the original images or cause any increased latency or regressions for customers.
How do you add additional synchronous checks in the code without increasing latency? It might be negligible, but it isn't nothing.
- ddorian43 3y ago> we just have to check that once we have consumed the end-of-image marker all of the input has been consumed. In our proxy we use an in-memory buffer as input, so we can check that there are no bytes left in the buffer: > As the format is so regular, it’s easy to write a separate parser that just reads the prelude, loops through the chunks until we see IEND, and then checks if we have any bytes left. We can perform this check after decoding the image with lodepng, as this allows us to skip validating the checksums as lodepng has already checked them for us