Re: Zip Bomb vulnerability questions
Przemysław Sobala <[email protected]> Wed, 15 Jul 2020 15:32:05 +0200
| Newsgroups | gmane.comp.video.graphicsmagick.help |
|---|---|
| Message-ID | <CAGKkJooF1NL7umd0fNWHhPmgapriE6_RvBfofnAvAtJWWS3aQQ@mail.gmail.com> |
On Fri, Jul 10, 2020 at 3:31 PM Bob Friesenhahn < [email protected]> wrote: > On Fri, 10 Jul 2020, Przemysław Sobala wrote: > > > > Patching magick/blob.c seems to work. > > Do you plan to introduce some kind of configuration switch (build time or > > runtime) for this [disabling (un)compressing input stream while > maintaining > > the support of PNG files]? > > A configuration option to disable support for gzip/bzip compression of > input files without impacting other uses of gzip compression is fairly > easy to do. > I've prepared a merge request for this: https://sourceforge.net/p/graphicsmagick/code/merge-requests/13/ -- regards Przemysław Sobala _______________________________________________ Graphicsmagick-help mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/graphicsmagick-help