Re: Stopping zipbombs with Sophie

On Fri, Dec 31, 2004 at 07:16:33PM +0000, [email protected] wrote:
> Hi Martin,
> 
> I'm not sure exactly how you would go about using the volume decompressed 
> - you'd have to modify some of the code in Sophie. However, the 
> SOPHOS_ACTIVITY_DECOMPR is called regularly - once every few hundred K of 
> data processed. So counting the number of times that OkToContinue is 
> called does provide you with a shorthand way of checking this. 
> Alternatively, there is now a SAVI configuration option "EnableAutoStop". 
> If you set this value to "1" then it will enable some built-in zipbomb 
> detection that will prevent this kind of thing happening.

Yes, I'd have to change some code. But isn't it a very simple change? I
would think that the following change to sophie_notify.c should change
the limit_decompr parameter from being a limit on the number of times
OkToContinue can be called to a limit on the volume decompressed.
Doesn't this make more sense? Is there a reason that this hasn't been
done?

It's good to have the SAVI option EnableAutoStop, but I might have a
different opinion on what constitutes a zip bomb. And since Sophie
already has code for a decompression related limit I think the following
would make more sense.

[Warning: I'm not good at C and I haven't tested this, but at least it
compiles :) ]

196c196
<       static int loop_decompr = 0;
---
>       static U32 loop_decompr = 0;
279c279
<                       loop_decompr++;
---
>                       loop_decompr = loop_decompr + Extent;

Happy New Year,

Martin Zuziak <[email protected]>