7 ms·
Another important point is that the attacker already has the ability to affect the decompressed output, since they are presumably responsible for the compressed
by emaste 14y ago
Another important point is that the attacker already has the ability to affect the decompressed output, since they are presumably responsible for the compressed input.
- cperciva 14y agoDepending on how you set things up you might use one sandbox to perform multiple decompression calls, so the attacker might be able to mangle someone else's data. But yes, if you set up a new sandbox for each inflate you're safe.
- crest 14y agoHash the decompressed data and check the result returned by zlib.