Re:How Cloudflare Images addressed the aCropalypse vulnerabi...
by gpvos on Thursday July 13, 2023 @06:50AM
(#36707267)
Again, those checks might be negligible, but aren't nothing. The JPEG check looks like one extra check in existing code, so that's truly almost nothing, but the PNG check introduced an extra parsing step of the file.
> As the format is so regular, it’s easy to write a separate parser that just reads the prelude, loops through the chunks until we see IEND, and then checks if we have any bytes left. We can perform this check after decoding the image with lodepng, as this allows us to skip validating the checksums as lodepng has already checked them for us