foobaz / lossypng Goto Github PK

Thanks for your work, I'm following this project with great interest.

I'm completely new to Go so I could be wrong about this. In these two lines

• https://github.com/foobaz/lossypng/blob/master/lossypng/lib.go#L141
• https://github.com/foobaz/lossypng/blob/master/lossypng/lib.go#L211

the intention of the loop is to copy the array values from row 0 to rows 1..n, however, what happens is that merely the references from row 0 are copied,

If I do colorError[0][0][0] = 999 after the loop, colorError[1][0][0] equals 999 too.

Also, you can simplify the code a tad by looping until i < errorRowCount - 1 and removing the % errorRowCount.

Testing the lossypng I found out that it is vulnerable for PNG Bomb - trying to optimize image like https://www.bamsoftware.com/hacks/deflate.html can consume a lot of memory.
It happening when you call image.Decode() on such file.

One of the way to defend is to check the size of image before decoding - you can do this with decoding only config, like:

optimizeLimit := 10000 // for example
cfg, _, _ := image.DecodeConfig(inFile)
if cfg.Height > optimizeLimit || cfg.Width > optimizeLimit {
	// Throw error / do not optimize etc.                
}