usvg SVGZ decompression bomb in `Tree::from_data`
usvg automatically decompresses SVGZ in Tree::from_data, enabling a gzip decompression-bomb denial of service.
A Full Disclosure post describes a decompression-bomb flaw in the Rust usvg SVG library. Tree::from_data detects gzip magic bytes and decompresses SVGZ input before parsing. A small compressed payload can force excessive expansion and deny service to applications that parse untrusted SVG. No CVE is mentioned.
- Tree::from_data detects gzip magic and decompresses SVGZ before parsing.
- A small compressed file can expand into a resource-exhaustion denial of service.
- No CVE identifier is listed in the disclosure.
Posted by Khashayar Fereidani on Sep 26 # usvg SVGZ decompression bomb in `Tree::from_data` https://fereidani.com/usvg-svgz-decompression-bomb-in-treefromdata https://fereidani.com/contact ## Description `Tree::from_data` in `crates/usvg/src/parser/mod.rs:102` detects the gzip magic bytes at the start of the input and decompresses the data before parsing it: ```rust //...
This source does not provide full text. Read it at seclists.org.