Biggest image in the smallest space

Actually, it decompresses to a 5.8MB PNG. However, many graphics programs may choose to use three bytes per pixel when rendering the image and because it has incredibly large dimensions, this representation would take up 141GB of RAM.

That&#x27;s impressive. Here are some other compression curiosities.<p><a href="http:&#x2F;&#x2F;www.maximumcompression.com&#x2F;compression_fun.php" rel="nofollow">http:&#x2F;&#x2F;www.maximumcompression.com&#x2F;compression_fun.php</a><p>A 24 byte file that uncompresses to 5 MB; another file with good compression under RAR but almost no compression under ZIP; and a compressed file that decompresses to itself.

That&#x27;s neat, but I still think the self-reproducing r.zip from &quot;zip files all the way down&quot; is the best compression trick I&#x27;ve seen:<p><a href="http:&#x2F;&#x2F;research.swtch.com&#x2F;zip" rel="nofollow">http:&#x2F;&#x2F;research.swtch.com&#x2F;zip</a>

Photoshop was able to show it: <a href="http:&#x2F;&#x2F;i.imgur.com&#x2F;7EdBySv.png" rel="nofollow">http:&#x2F;&#x2F;i.imgur.com&#x2F;7EdBySv.png</a> (Macbook Pro, 16GB RAM)

If you follow the &quot;related reading&quot; link on the bottom of TFA, you come to a page by Glenn Randers-Pehrson discussing how libpng deals with decompression bombs. On the bottom of that page you find the following curious note; anyone know what to make of it?<p>&quot;&quot;&quot; [Note for any DHS people who have stumbled upon this site, be aware that this is a cybersecurity issue, not a physical security issue. Feel free to contact me at &lt;glennrp at users.sourceforge.net&gt; to discuss it.] &quot;&quot;&quot;

PNGs also have optional compressed text metadata chunks, and it&#x27;s possible to sneak a decompression bomb into one of those as well. You can get about a factor of 1000 in the compression -- 1MB of &#x27;a&#x27; winds up being about 1040 bytes. You can have multiple itxt chunks, and it appears that the chunk size is only limited to 2^31-1.<p>See <a href="https:&#x2F;&#x2F;github.com&#x2F;python-pillow&#x2F;Pillow&#x2F;blob&#x2F;master&#x2F;Tests&#x2F;check_png_dos.py" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;python-pillow&#x2F;Pillow&#x2F;blob&#x2F;master&#x2F;Tests&#x2F;ch...</a> for a quick way to generate some of these.

Reminds me of how you could crash a fido node by sending them some big empty files, so when they got automatically unzipped the filled of the harddrive :)

<a href="http:&#x2F;&#x2F;jeremykun.com&#x2F;2012&#x2F;04&#x2F;21&#x2F;kolmogorov-complexity-a-primer&#x2F;" rel="nofollow">http:&#x2F;&#x2F;jeremykun.com&#x2F;2012&#x2F;04&#x2F;21&#x2F;kolmogorov-complexity-a-prim...</a><p><a href="http:&#x2F;&#x2F;c2.com&#x2F;cgi&#x2F;wiki?KolmogorovComplexity" rel="nofollow">http:&#x2F;&#x2F;c2.com&#x2F;cgi&#x2F;wiki?KolmogorovComplexity</a><p>Here be rabbit-hole.

This does wonders when used in favicons :D

Fun fact: When trying to upload this as a profile picture (on a site I host myself), chromium crashes.

Having dealt with and printed a lot of <i>very</i> large images, e.g., 60k x 60k pixels, I have been on the lookout for image processing software that never decompresses the entire image into ram, but instead works on blocks or scan lines or blocks of scan lines, but stays in constant memory and streams to and from disk. For example, the ImageMagick fork GraphicsMagick does a much better job of this than ImageMagick. What other software is out there that can handle these kinds of images?

I used to work on a scanning SMTP&#x2F;HTTP proxy and even back then it wasn&#x27;t unknown for people to send crafted decompression bombs to attempt to crash the services. We handled it by estimating the total uncompressed size upfront (including sub archives) and throwing out anything with a suspiciously large compression ratio.<p>I imagine that .pdf files are another avenue for mischief. They contain lots of chunks which may be compressed in varying ways.

Neat. I needed to make very large PNG bombs recently and toyed with the idea of doing it &quot;manually.&quot; In the end I decided to take the lazy route and use libpng[1].<p>[1]: <a href="https:&#x2F;&#x2F;bitbucket.org&#x2F;tetrep&#x2F;pngbomb&#x2F;src&#x2F;03dfc95065d78562c156c056abc3d5f1fd7047b8&#x2F;pngbomb.c?at=master" rel="nofollow">https:&#x2F;&#x2F;bitbucket.org&#x2F;tetrep&#x2F;pngbomb&#x2F;src&#x2F;03dfc95065d78562c15...</a>

That&#x27;s cool. Presumably the same &quot;attack&quot; could be applied to any file format that uses DEFLATE.<p>From a legal stand-point, I&#x27;d be wary about following through with the authors suggestion of &quot;Upload as your profile picture to some online service, try to crash their image processing scripts&quot; without permission. Sounds like a good way of getting into trouble.

&gt;The image is almost entirely zeroes, with a secret message in the center.<p>too pressed for time, did anyone look? What is it?

I realize that this is besides the point but going on the title alone we could write a script that could generate an &#x27;infinite&#x27; (max out available memory) sized image.

Everyone&#x27;s focusing on this being a PNG problem but actually if my server unzips a 420 byte file into a 5M file of any kind, I&#x27;d say that&#x27;s the first red flag. Assuming some sort of streaming decompression, you could write an output filter that shuts off the decompressor when it&#x27;s seen a factor of X bytes. A reasonable factor would be 10 - which in this case would have halted bzip decompression at 4kB.<p>This would probably be a trivial patch to bzip2. But I like the idea in general of passing an &quot;max input&#x2F;output ratio&quot; to any process or function that might yield far more output than input.

Looks handy for large image processing tests, thanks.

Trying to run the program and create my own image, however a few questions, what did you use for secret.png? Any old png?<p>Are you using PIL or pillow?

Cool, but most web sites wouldn&#x27;t allow to upload a 5-MB picture as a profile picture. Or do they, these days?

Is there a way to check for decompression bombs? I&#x27;d like my software to be able to unzip zip files safely.

It&#x27;s probably using middle-out.

I wonder what the ratio would look like if the equivalent was done with a JPEG instead of a PNG.

does anybody tried to upload it on facebook as profile picture?

The title was changed and is now more opaque and less descriptive.

righto pied piper

This is a very easy form of attack in security circles.