This does wonders when used in favicons :D
You just made my stomach turn at the thought
Biggest image in the smallest space
21–30 of 106 posts
Re: Biggest image in the smallest space
#22That's impressive. Here are some other compression curiosities. http://www.maximumcompression.com/compression_fun.php A 24 byte file that uncompresses to 5 MB; another file with good compression under RAR but almost no compression under ZIP; and a compressed file that decompresses to itself.
The file that decompresses to itself is a work of art. How does one even go about to create something like this?
Re: Biggest image in the smallest space
#23Is there a way to check for decompression bombs? I'd like my software to be able to unzip zip files safely.
Yes. A method whose only purpose is to answer the question 'is this file larger than '. If it is don't go further.
Re: Biggest image in the smallest space
#24Is there a way to check for decompression bombs? I'd like my software to be able to unzip zip files safely.
You can do it in zlib -- there's one call that effectively does the whole thing, and one that fills a buffer. You can check to see how much input has been consumed, if there's more, then you know you're getting large. It's up to the friendly programmer to decide when large is too large.
Re: Biggest image in the smallest space
#25Is there a way to check for decompression bombs? I'd like my software to be able to unzip zip files safely.
Monitor zip files as they decompress. Halt decompression process if the size ratio between zip file and decompressed file exceeds a fixed ratio (for example, if ratio between the file sizes is something like 10:1).
If you do that, pick something a little more extreme. When using BEM, for example, your CSS becomes pretty repetitive and you easily get better than 10:1 ratio with GZIP, for example.
Re: Biggest image in the smallest space
#26Cool, but most web sites wouldn't allow to upload a 5-MB picture as a profile picture. Or do they, these days?
Re: Biggest image in the smallest space
#27Re: Biggest image in the smallest space
#28This does wonders when used in favicons :D
I just tried it on a locally served page, and my browser handles it quite well (although it won't really display it).
Re: Biggest image in the smallest space
#29Actually, it decompresses to a 5.8MB PNG. However, many graphics programs may choose to use three bytes per pixel when rendering the image and because it has incredibly large dimensions, this representation would take up 141GB of RAM.
Some image programs will allocate space based on the metadata in the file. The actual image data isn't actually required. So, if there's corrupted image data, say a byte or two (or even missing), there's nothing stopping the reported size being in the gigapixel range.
Re: Biggest image in the smallest space
#30Actually, it decompresses to a 5.8MB PNG. However, many graphics programs may choose to use three bytes per pixel when rendering the image and because it has incredibly large dimensions, this representation would take up 141GB of RAM.
One of the rules of secure programming is that any program that is used in an even remotely security-sensitive context, and anything displaying a Portable Network Graphic is likely to be used in such a context, must be able to specify resource usage limits. In this case that could be dimensions or a limit on the total RAM allowed to be used. Limits need not be hard, either, but could produce a query, for instance, the way very long-running scripts in the browser ask you if they should continue.
Now, go find an API/library for dealing with PNGs that allow you to pass in such a limit, let alone pass in a callback for dealing with violations. Go ahead. I'll wait.
(The Internet being what it is, if there is one, someone will pop up in a reply in five minutes citing it. If so, my compliments to the authors! But I think we can all agree that in general image APIs do not offer this control. In fact, in general, if you submit a patch to allow it, it would probably be rejected from most projects as unnecessarily complicating the API.)
This is the sort of thing that I mean when I say that we are so utterly buried by insecure coding practices that we can't hardly even perceive it around us. I should add this as another example in http://www.jerf.org/iri/post/2942 .