Re: The security of deflate-compressed streams with uncompressed-length field

On 5 February 2017 at 11:55, Cosmin Truta <[email protected]> wrote:

> Specifically, libpng should offer a general-purpose inflation routine, such as:
>
> int png_get_inflate_buffer(
>     png_struct *png_ptr,
>     png_byte **out_inflate_buffer_ptr,
>     size_t *out_inflate_buffer_size_ptr,
>     const png_byte *in_deflate_buffer,
>     size_t in_deflate_buffer_size)

Correction: there should also be an upper limit as input parameter:
    size_t max_inflate_buffer_size

Otherwise, it is possible to exploit the fact that deflate compression
ratio exceeds 1000:1. (It is precisely 1032:1.) A not-so-visible,
half-megabyte deflate stream inside a multi-megapixel, multi-megabyte
PNG image may expand to a whopping half-gigabyte memory hog.

For zXIf in particular, max_inflate_buffer_size should be 65535
(0xffff). This is a hard limit, due to the inherent design limitations
of JPEG/EXIF.

Note that the uncompressed-size max check should always be executed,
regardless whether the additional uncompressed-size field exists or
not.

Sincerely,
Cosmin

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot