To: =?UTF-8?Q?Pavel_Jan=c3=adk?= <Pavel@Janik.cz>
References: <565CD7D8.3070102@gmail.com>
	<90EF4E6C-9A71-4A35-A938-EAFC1A24DD24@mattcorallo.com>
	<04188281-6A0C-4178-B2CA-BDE799C4FE9F@Janik.cz>
	<565E30C6.1010002@bitcartel.com>
	<AF49F870-0600-47D1-8AC6-EEBFAA5B1C24@Janik.cz>
From: Simon Liu <simon@bitcartel.com>
Message-ID: <565E9EC7.50003@bitcartel.com>
Date: Tue, 1 Dec 2015 23:33:27 -0800
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101
	Thunderbird/38.3.0
MIME-Version: 1.0
In-Reply-To: <AF49F870-0600-47D1-8AC6-EEBFAA5B1C24@Janik.cz>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
Cc: Bitcoin Dev <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] [BIP Draft] Datastream compression of Blocks and
 Transactions
Precedence: list

Hi Pavel,

(my earlier email was moderated, so the list can only see it via your
reply),

Yes, an attacker could try and send malicious data to take advantage of
a compression library vulnerability...  but is it that much worse than
existing attack vectors which might also result in denial of service,
crashes, remote execution?

Peter, perhaps your BIP can look at possible ways to isolate the
decompression phase, such as having incoming compressed blocks be saved
to a quarantine folder and an external process/daemon decompress and
verify the block's hash?

Regards,
Simon


On 12/01/2015 10:47 PM, Pavel Janík wrote:
> 
>> On 02 Dec 2015, at 00:44, Simon Liu <simon@bitcartel.com> wrote:
>>
>> Hi Matt/Pavel,
>>
>> Why is it scary/undesirable?  Thanks.
> 
> Select your preferable compression library and google for it with +CVE.
> 
> E.g. in zlib:
> 
> http://www.cvedetails.com/vulnerability-list/vendor_id-72/product_id-1820/GNU-Zlib.html
> 
> …allows remote attackers to cause a denial of service (crash) via a crafted compressed stream…
> …allows remote attackers to cause a denial of service (application crash)…
> etc.
> 
> Do you want to expose such lib to the potential attacker?
> --  
> Pavel Janík
> 
> 
> 
>