News for hackers. Stuff that matters.

A comment on Zip Bomb. Parent comment

Re:Zip Bomb by kijin on Friday October 05, 2012 @08:53AM (#4616638)
Maybe not at the transport or protocol level, but it wouldn't be too hard to DoS an application server that handles compressed data, such as images.

Make a billion-pixel PNG image that compresses very well, upload several copies simultaneously to a LAMP server running on an average Linode, and watch it run out of memory while trying to create thumbnails with GD.

[ Parent | on HN ]
Re:Zip Bomb by debacle on Friday October 05, 2012 @09:13AM (#4616712)
PHP usually has a pretty reasonable memory limit set, so it would puke on itself pretty quickly.

But I don't think you'd bring the site down.

[ Parent | on HN ]
Re:Zip Bomb by kijin on Friday October 05, 2012 @10:07AM (#4616903)
Fair enough, but I've been on Linode's forums long enough to have seen dozens of people running 50 PHP processes with 128MB memory limit each, on a 1GB server shared with MySQL and a bunch of other crap. (It seems that 128MB is the new "reasonable memory limit" these days, since that's how much RAM it takes for PHP to handle photos from 8-to-12-megapixel cameras and smartphones.)
[ Parent | on HN ]