Web browsers support compressed data, I wonder will they try to decompress something like this?
Yes they will, there was a post a while back which used this to bomb the browser.
Do you have a link, by any chance?
Zip Bomb
21–30 of 113 posts
Re: Zip Bomb
#22Re: Zip Bomb
#23Re: Zip Bomb
#24Earlier quoted context omitted.
It may be old but i didn't knew about it until it was brought up on a /r/technology thread yesterday. Old =/= everyone knows about it.
The fact that you don't do your homework doesn't mean what this guy is doing is righteous.
Hello,
Your new account has rapidly got a bunch of down votes. HN likes constructive thoughtful comments. Aggressive comments, even if correct, will likely get down votes.
"Old as fuck" is going to be down voted to oblivion, and risks the account being hell-banned.
"This is very old. I'm surprised HN readers are not already aware of it" may get down votes (it doesn't add anything to the conversation) but will probably be tolerated.
"This is very old. Here are some similar things / here's the theory behind it / here's an example of more modern versions / etc" will probably get a few up votes.
HN probably benefits more from people visiting the New tab and up voting good stories (and flagging the spam) than from people posting comments like "Old as fuck" on items they don't like.
Welcome to HN! (Though I suspect with a username like Trool that yours is a throwaway account.)
Re: Zip Bomb
#25Earlier quoted context omitted.
It may be old but i didn't knew about it until it was brought up on a /r/technology thread yesterday. Old =/= everyone knows about it.
The fact that you don't do your homework doesn't mean what this guy is doing is righteous.
I don't really have time to google everything or to go on and ask everyone I meet: "Hey .. how are you? Do you know some cool stuff about computers and IT that you could share with me... see I'm trying to learn new stuff".. This is why i just follow some forums and communities based around Comp Sci (i.e. hacker news). So I will agree to disagree with you; i think that this is a very interesting link and a good thread; I learn new stuff I wouldn't have discovered otherwise.
If you knew about this.. you could have just ignored it and not waste your time commenting on it. Let it be useful for the n00bs (i.e. me).
Re: Zip Bomb
#26Re: Zip Bomb
#27I've seen something similar with a PNG file for user supplied profile image [1]. The image was a 10000x10000 all black PNG image which compresses to a pretty small file size. Unless you validate the image dimensions as well as the file size it may cause problems, for instance when GD is used to try to resize it exhausted the memory limit. [1] https://bugs.launchpad.net/mahara/+bug/784978
Out of curiosity I just made two images: 15,000 x 15,000: http://i.imgur.com/WzCyE.png 50,000 x 50,000: http://i.imgur.com/kgmHu.png Both FF and Chrome refuse to open the second one. IE does something weird. Both Opera and Safari figure out the size correctly, but don't display the image.
With Firefox (15.0.1) I get some really, really strange results with the second image.
When I opened it the first time, or everytime I press Ctrl+Shift+R it works, but it shows the URL, and a litte icon in the upper left corner: http://i.imgur.com/B7jFE.png
If I press F5 or Ctrl+R it doesnt work, just as you said.
Re: Zip Bomb
#28Web browsers support compressed data, I wonder will they try to decompress something like this?
Yes they will, there was a post a while back which used this to bomb the browser.
Perhaps more concerning is being able to use this to launch a denial of service attack on a server that accepts zipped data. Gzipped requests are unusual with HTTP (no idea how widespread support for it is), but iirc SPDY is compressed by default.
Re: Zip Bomb
#29I found a similar file to this (a zip file that contains itself) and e-mailed it to a friend at work. He never received it, but I thought nothing of it (I assumed the email filters just destroyed it).
A days later the mail server stops working and the sysadmin turns up at my desk. Turns out the anti-virus scanner had been unzipping and scanning repeatedly. It eventually filled up the entire disk and bad things happened.