Zip Bomb

timdorr wrote: post #3

While this is out of the range of most consumers, I wonder if any bored sysadmins with a new storage system to test have tried unzipping that file...

I've tried it, and I'm no sysadmin. Fortunately, I had a disk quota on, set by my sysadmin, and so the bomb could only take up 2 gb of the space I had in my quota.

Re: Zip Bomb

#5

Post by conductor » Fri, Oct 05, 2012, 8:55 AM UTC

Web browsers support compressed data, I wonder will they try to decompress something like this?

Re: Zip Bomb

#6

Post by lucian1900 » Fri, Oct 05, 2012, 8:56 AM UTC

timdorr wrote: post #3

While this is out of the range of most consumers, I wonder if any bored sysadmins with a new storage system to test have tried unzipping that file...

It'd be easier to do something like cat /dev/urandom > big

Re: Zip Bomb

#7

Post by trool » Fri, Oct 05, 2012, 8:57 AM UTC

Old as fuck.

Re: Zip Bomb

#8

Post by simoncoggins » Fri, Oct 05, 2012, 8:59 AM UTC

I've seen something similar with a PNG file for user supplied profile image [1]. The image was a 10000x10000 all black PNG image which compresses to a pretty small file size.

Unless you validate the image dimensions as well as the file size it may cause problems, for instance when GD is used to try to resize it exhausted the memory limit.

[1] https://bugs.launchpad.net/mahara/+bug/784978

Re: Zip Bomb

#9

Post by EwanToo » Fri, Oct 05, 2012, 9:03 AM UTC

trool wrote: post #7

Old as fuck.

Next week on HN, C++ released! :)

Re: Zip Bomb

#10

Post by vog » Fri, Oct 05, 2012, 9:05 AM UTC

Even more impressive: A zip file that extracts to itself. (That's also shown in the article, as a kind of "Lempel-Ziv quine".)