[Top] [All Lists]

Re: [ietf-smtp] Compressing SMTP streams

2016-01-31 20:23:12
Someone was wondering what sort of nastiness one could do by putting
maliciously crafted data into allegedly compressed data.  I took a look
and using deflate, the malice appears limited.

One thing you could do is to make something that blows up to enormous
size.  It appears to me is that the limit of deflats is about 1000:1.
I compressed a 5 gig file all of the same character, the compressed
version was 5 meg.  That's a lot of expansion, but the obvious response
is to limit the size, the same as with uncompressed data.  Using zlib
it's easy enough to track the decompressed size and stop if you have
more than you want.

The other possibility would be to do something that hangs the
decompressor or at least makes it really slow.  Deflate is pretty
simple, decoding Huffman encoded bit strings, and LZ pointers back to
previous data.  There are bit combinations that are forbidden, but at
someone else's suggeston I looked to see of people have tried fuzz
testing zlib, with randomly permuted data, it appears lots of people
have and nobody's found any bugs for a long time.

So compression may not buy us much, but it seems unlikely to do anything
very evil.


ietf-smtp mailing list