📅 Original date posted:2015-12-02 📝 Original message:If compression is to be ...

Patrick Strateman [ARCHIVE] /

npub1l3u…9pvv

2023-06-07 17:45:28

in reply to nevent1q…gpks

📅 Original date posted:2015-12-02
📝 Original message:If compression is to be used a custom compression algorithm should be
written.

Bitcoin data is largely incompressible outside of a tiny subset of fields.

On 12/01/2015 11:33 PM, Simon Liu via bitcoin-dev wrote:
> Hi Pavel,
>
> (my earlier email was moderated, so the list can only see it via your
> reply),
>
> Yes, an attacker could try and send malicious data to take advantage of
> a compression library vulnerability... but is it that much worse than
> existing attack vectors which might also result in denial of service,
> crashes, remote execution?
>
> Peter, perhaps your BIP can look at possible ways to isolate the
> decompression phase, such as having incoming compressed blocks be saved
> to a quarantine folder and an external process/daemon decompress and
> verify the block's hash?
>
> Regards,
> Simon
>
>
> On 12/01/2015 10:47 PM, Pavel Janík wrote:
>>> On 02 Dec 2015, at 00:44, Simon Liu <simon at bitcartel.com> wrote:
>>>
>>> Hi Matt/Pavel,
>>>
>>> Why is it scary/undesirable? Thanks.
>> Select your preferable compression library and google for it with +CVE.
>>
>> E.g. in zlib:
>>
>> http://www.cvedetails.com/vulnerability-list/vendor_id-72/product_id-1820/GNU-Zlib.html
>>
>> …allows remote attackers to cause a denial of service (crash) via a crafted compressed stream…
>> …allows remote attackers to cause a denial of service (application crash)…
>> etc.
>>
>> Do you want to expose such lib to the potential attacker?
>> --
>> Pavel Janík
>>
>>
>>
>>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

Author Public Key

npub1l3uf9m4yw2y7x8wyjeswhelsqyy8ql4jaca4nyy6en0s474yadssg69pvv

Show more details

Published at

2023-06-07 17:45:28

Kind type

1 Short Text Note

Event JSON

{ "id": "3ca7a56f132a0993c419f4f0313e09081ad66d401cba45e94395fbb58dccf337", "pubkey": "fc7892eea47289e31dc49660ebe7f00108707eb2ee3b59909accdf0afaa4eb61", "created_at": 1686159928, "kind": 1, "tags": [ [ "e", "66e2fed0b01e52e71a1dd6b42fe6a9fda1f0a599c3d79a1ed608f15fbb8c1ad3", "", "root" ], [ "e", "489915d94817c8d82b31868a47e789d77847bd4a7f0af1130f2b80c359d59f42", "", "reply" ], [ "p", "ec441dce91fdd87933cc9222deff2be2b3ac971939fd1f23aa1f9b61f898f361" ] ], "content": "📅 Original date posted:2015-12-02\n📝 Original message:If compression is to be used a custom compression algorithm should be\nwritten.\n\nBitcoin data is largely incompressible outside of a tiny subset of fields.\n\nOn 12/01/2015 11:33 PM, Simon Liu via bitcoin-dev wrote:\n\u003e Hi Pavel,\n\u003e\n\u003e (my earlier email was moderated, so the list can only see it via your\n\u003e reply),\n\u003e\n\u003e Yes, an attacker could try and send malicious data to take advantage of\n\u003e a compression library vulnerability... but is it that much worse than\n\u003e existing attack vectors which might also result in denial of service,\n\u003e crashes, remote execution?\n\u003e\n\u003e Peter, perhaps your BIP can look at possible ways to isolate the\n\u003e decompression phase, such as having incoming compressed blocks be saved\n\u003e to a quarantine folder and an external process/daemon decompress and\n\u003e verify the block's hash?\n\u003e\n\u003e Regards,\n\u003e Simon\n\u003e\n\u003e\n\u003e On 12/01/2015 10:47 PM, Pavel Janík wrote:\n\u003e\u003e\u003e On 02 Dec 2015, at 00:44, Simon Liu \u003csimon at bitcartel.com\u003e wrote:\n\u003e\u003e\u003e\n\u003e\u003e\u003e Hi Matt/Pavel,\n\u003e\u003e\u003e\n\u003e\u003e\u003e Why is it scary/undesirable? Thanks.\n\u003e\u003e Select your preferable compression library and google for it with +CVE.\n\u003e\u003e\n\u003e\u003e E.g. in zlib:\n\u003e\u003e\n\u003e\u003e http://www.cvedetails.com/vulnerability-list/vendor_id-72/product_id-1820/GNU-Zlib.html\n\u003e\u003e\n\u003e\u003e …allows remote attackers to cause a denial of service (crash) via a crafted compressed stream…\n\u003e\u003e …allows remote attackers to cause a denial of service (application crash)…\n\u003e\u003e etc.\n\u003e\u003e\n\u003e\u003e Do you want to expose such lib to the potential attacker?\n\u003e\u003e -- \n\u003e\u003e Pavel Janík\n\u003e\u003e\n\u003e\u003e\n\u003e\u003e\n\u003e\u003e\n\u003e _______________________________________________\n\u003e bitcoin-dev mailing list\n\u003e bitcoin-dev at lists.linuxfoundation.org\n\u003e https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev", "sig": "c5358061cbb98e8fdf323042fb4079b105527fc607e05f80d06f71fe39b3cb3ada405dd2e95bc2a7a3acadc030facef4a4d48008c25591e04156e39c9a191b61" }