Zip Bomb vulnerability questions

Hi
GraphicsMagick tries to open compressed files which makes it vulnerable for Zip
Bomb <https://en.wikipedia.org/wiki/Zip_bomb> attacks.
Eg.:

$ gm identify -debug All test-png-gzip
14:45:13 0:0.000465  0.000u 4654 log.c/SetLogEventMask/1171/Configure:
  Set log event mask: All
14:45:13 0:0.000723  0.000u 4654 blob.c/OpenBlob/2705/Blob:
  Opening blob stream: image 0x14925c0, blob 0x148ce10, mode ReadBinary ...
14:45:13 0:0.000884  0.000u 4654 blob.c/DetachBlob/1259/Blob:
  Detach (reset) blob: blob 0x148ce10, ref 1
14:45:13 0:0.001054  0.000u 4654 blob.c/OpenBlob/2888/Blob:
    I/O buffer set to 16384 bytes
14:45:13 0:0.001191  0.000u 4654 blob.c/OpenBlob/2910/Blob:
    opened file "test-png-gzip" as FileStream image 0x14925c0, blob 0x148ce10
14:45:13 0:0.001334  0.000u 4654 blob.c/OpenBlob/2935/Blob:
    read 2053 magic header bytes
14:45:13 0:0.001500  0.000u 4654 blob.c/OpenBlob/2949/Blob:
    reopened file "test-png-gzip"as ZipStream image 0x14925c0, blob 0x148ce10
14:45:13 0:0.001700  0.000u 4654
tempfile.c/AddTemporaryFileToList/60/TemporaryFile:
  Allocating temporary file "/tmp/gmdUEvhK"
14:45:13 0:0.001810  0.000u 4654 blob.c/ImageToFile/2396/Blob:
  Copying from Blob stream to file /tmp/gmdUEvhK

[Uncompressing malicious file that lasts forever and consumes lots of memmory]


1. Is there a possibility to set a black/white list of un/supported formats
to support only eg. JPG, PNG, GIF or to disable support of compressed files?

or:

2. After configuring GM without the support of zlib (un)compressing files
is not supported any more, but so is reading/writing PNG files...

And, by the way:

3. PNG uses a compression algorithm. Is GM vulnerable to malicious
(Compression Bomb) PNG files?
I think I saw somewhere in PNG decoder's code, inside GM, a part where it
checks compression ratio and fails to read file if it's below some
arbitrary value. If it's correct, it should protect us from malicious PNG
files.

--
Best regards
Przemysław Sobala

_______________________________________________
Graphicsmagick-help mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/graphicsmagick-help