Re:Fun with gzip bombs and email clients
by duskwuff on Tuesday July 22, 2025 @08:31PM
(#44654514)
There are some stupid tricks you can pull with image formats like emitting the headers for a gigantic image without including enough image data to actually encode the whole image. Most decoders will try to allocate a buffer up front (possibly as much as 16 GB for a 65535x65535 image!) before discovering that the image is truncated.
The same trick works with PNG, actually. Possibly even better: it uses a pair of 32-bit integers for the resolution.
The same trick works with PNG, actually. Possibly even better: it uses a pair of 32-bit integers for the resolution.