News for hackers. Stuff that matters.
Re:A better zip bomb by deathanatos on Thursday July 04, 2019 @06:04PM (#20358170)
> Zip is a streamable format

Not really. For a normal, created in one-shot ZIP, yes. But the types of ZIPs in the article are going to act differently if you tried streaming them. The core idea of the article is overlapping the various files within the ZIP, s.t. they share bytes. But this is only apparent if you're using the central directory, which you can't if you're streaming, since it appears after all the data. If you're streaming, you're using the local file headers, but for ZIPs such as those in the article, you will see many less LHFs than had you looked them up in the central directory, b/c they overlap. (In the streaming case, I think you'd see exactly 1 file. It would still be huge, given the other tricks in the article.)

Also, I think you can "append" to ZIPs (this is why the central directory is at the end, s.t. it can be overwritten by new data, and then re-appended.) I think this approach allows tools to also "delete" data by simply removing the entry from the central directory, and re-appending it w/o, so the central directory is essentially the authoritative source for the ZIPs contents. (Though I suppose a streaming decompressor could decompress to a temporary location and then only move non-deleted entries into their final place.)

The Wikipedia page echos this:

> Tools that correctly read ZIP archives must scan for the end of central directory record signature, and then, as appropriate, the other, indicated, central directory records. They must not scan for entries from the top of the ZIP file, because (as previously mentioned in this section) only the central directory specifies where a file chunk starts and that it has not been deleted. Scanning could lead to false positives, as the format does not forbid other data to be between chunks, nor file data streams from containing such signatures.

https://en.wikipedia.org/wiki/Zip_(file_format)

Re:A better zip bomb by hinkley on Thursday July 04, 2019 @09:24PM (#20359233)
Why is everybody fixating on my preface?

> I don’t understand why you would extract the archive before checking the contents?

Re:A better zip bomb by girvo on Thursday July 04, 2019 @11:26PM (#20359593)
Because a curious part of written internet culture is that of fixating on small mistakes that aren't even important to the overall context or meaning of a post, and ignoring the actual content. Why, I'm unsure, but I've been noticing it a lot more now that I'm aware of it!
Re:A better zip bomb by hinkley on Friday July 05, 2019 @05:16AM (#20361020)
Been thinking the same, but it also often feels like “waiting for your turn to talk”.