News for hackers. Stuff that matters.
Re:How Cloudflare Images addressed the aCropalypse vulnerabi... by ddorian43 on Tuesday July 11, 2023 @10:19AM (#36681329)
> we just have to check that once we have consumed the end-of-image marker all of the input has been consumed. In our proxy we use an in-memory buffer as input, so we can check that there are no bytes left in the buffer:

> As the format is so regular, it’s easy to write a separate parser that just reads the prelude, loops through the chunks until we see IEND, and then checks if we have any bytes left. We can perform this check after decoding the image with lodepng, as this allows us to skip validating the checksums as lodepng has already checked them for us

Re:How Cloudflare Images addressed the aCropalypse vulnerabi... by gpvos on Thursday July 13, 2023 @06:50AM (#36707267)
Again, those checks might be negligible, but aren't nothing. The JPEG check looks like one extra check in existing code, so that's truly almost nothing, but the PNG check introduced an extra parsing step of the file.
Re:How Cloudflare Images addressed the aCropalypse vulnerabi... by ddorian43 on Thursday July 13, 2023 @06:57AM (#36707324)
Assume it's 0.1ms slowdown per-image ?