Re: The security of deflate-compressed streams with uncompressed-length field

Hello, again,

I am posting my thoughts as they come by.

John does raise valid issues, and to clarify, I disagree with him only
on feasibility (specifically claiming that "it can be done correctly
and it's not that much of a big deal"), but not on validity of the
issues as a whole (specifically accepting that "it may be done
incorrectly, and that may be a big deal").

We shouldn't stop using qsort() just because many people can't get
quicksort right. It's been done right, it's in the standard C library,
let's use it. Sample code is available, and you may copy-paste that,
too.

The same goes with my proposed png_get_inflate_buffer() going into the
standard libpng library.

About the PNG specification, I suggest (as I had also done,
previously) adding non-normative sections with sample code. Regardless
whether the uncompressed-length field in zXIf gets in (and zXIf itself
gets in), implementors should be made aware of these *very* *valid*
*issues*. There won't be changes in zTXt or iCCP, and implementors (C
language implementors, to be exact) need this awareness.

Sincerely,
Cosmin

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot