Re: Zip Bomb vulnerability questions

On Fri, 10 Jul 2020, Przemysław Sobala wrote:
>
> Patching magick/blob.c seems to work.
> Do you plan to introduce some kind of configuration switch (build time or
> runtime) for this [disabling (un)compressing input stream while maintaining
> the support of PNG files]?

It seems like the best solution is to improve the blob.c 
implementation so that it uses an initial in-memory buffer in order to 
test the file format (and possibly completely decode the file), and 
only fail over to using a disk file when needed.  There needs to be a 
way to limit the input blob size read from the stream or uncompressed 
from the stream.  Besides providing more control, this would improve 
performance and reliability.

This implementation will not happen instantaneously.

A configuration option to disable support for gzip/bzip compression of 
input files without impacting other uses of gzip compression is fairly 
easy to do.

Bob
-- 
Bob Friesenhahn
[email protected], http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/
Public Key,     http://www.simplesystems.org/users/bfriesen/public-key.txt

_______________________________________________
Graphicsmagick-help mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/graphicsmagick-help