4 ms·

Context: https://en.wikipedia.org/wiki/Zip_bomb https://en.wikipedia.org/wiki/Zip_bomb

masklinn 12y ago
Here's an old page with various compression bomb demos: http://www.aerasec.de/security/advisories/decompression-bomb-vulnerability.html http://www.aerasec.de/security/advisories/decompression-bomb... It's not just archive formats, anything which uses standard compression algorithm could be a compression bomb (e.g. PNG)
- angersock 12y ago
  Any examples of a PNG bomb in the wild?
  - JetSpiegel 12y ago
    There's this[1]. eog doesn't choke on it, but it takes 4GB of RAM during processing. After it return to 2GB. WARNING: Will decompress to potentially 5GB of RAM. [1]: ftp://ftp.aerasec.de/pub/advisories/decompressionbombs/pictures/picture-1G-19000x19000.png
  - DanBC 12y ago
    The link in parent comment has instructions for creating PNG bombs and a link to an ftp site with some downloads.
    - angersock 12y ago
      So, do we need to change our file uploaders and whatnot to autokill after a certain amount of time? Or just set `ulimit -m` or whatever judiciously? This looks like an annoying attack vector for people that, say, resize image uploads to make thumbnails.
      - masklinn 12y ago
        > So, do we need to change our file uploaders and whatnot to autokill after a certain amount of time? Or just set `ulimit -m` or whatever judiciously? Most image formats specify the size before providing any data, you can just check that w*h is below whatever limit you deem fit before loading the image data. The file upload size should already have a "sane" limit so people don't upload truckloads of data, the problem with compression bomb is that you can upload a very small amount of data and it eats the target's RAM on decoding. > This looks like an annoying attack vector for people that, say, resize image uploads to make thumbnails. It is, although for JPEG you don't need to decode the image to resize it (depending how whatever you're using is implemented it may still do so regardless).
- JetSpiegel 12y ago
  http://www.aerasec.de/security/advisories/html-bomb/bomb-html-char-X-10M http://www.aerasec.de/security/advisories/html-bomb/bomb-htm... Modern computers don't choke on ten million X's on a page, but the fans do spin up wildly. Maybe smartphones die with this.

Here's an old page with various compression bomb demos: http://www.aerasec.de/security/advisories/decompression-bomb-vulnerability.html http://www.aerasec.de/security/advisories/decompression-bomb... It's not just archive formats, anything which uses standard compression algorithm could be a compression bomb (e.g. PNG)

angersock 12y ago
Any examples of a PNG bomb in the wild?
- JetSpiegel 12y ago
  There's this[1]. eog doesn't choke on it, but it takes 4GB of RAM during processing. After it return to 2GB. WARNING: Will decompress to potentially 5GB of RAM. [1]: ftp://ftp.aerasec.de/pub/advisories/decompressionbombs/pictures/picture-1G-19000x19000.png
- DanBC 12y ago
  The link in parent comment has instructions for creating PNG bombs and a link to an ftp site with some downloads.
  - angersock 12y ago
    So, do we need to change our file uploaders and whatnot to autokill after a certain amount of time? Or just set `ulimit -m` or whatever judiciously? This looks like an annoying attack vector for people that, say, resize image uploads to make thumbnails.
    - masklinn 12y ago
      > So, do we need to change our file uploaders and whatnot to autokill after a certain amount of time? Or just set `ulimit -m` or whatever judiciously? Most image formats specify the size before providing any data, you can just check that w*h is below whatever limit you deem fit before loading the image data. The file upload size should already have a "sane" limit so people don't upload truckloads of data, the problem with compression bomb is that you can upload a very small amount of data and it eats the target's RAM on decoding. > This looks like an annoying attack vector for people that, say, resize image uploads to make thumbnails. It is, although for JPEG you don't need to decode the image to resize it (depending how whatever you're using is implemented it may still do so regardless).
JetSpiegel 12y ago
http://www.aerasec.de/security/advisories/html-bomb/bomb-html-char-X-10M http://www.aerasec.de/security/advisories/html-bomb/bomb-htm... Modern computers don't choke on ten million X's on a page, but the fans do spin up wildly. Maybe smartphones die with this.