Implement PNG enginge

[odan]

PNG Bomb Protection

• if you found super large (400 GB) file in your tmp directory (/tmp) with the name like "magick-*"
• or if see lack of the memory on the server for uploaded images
• or if see lack of disk space on the server for uploaded images
• or if there are some unexplained problems with uploading of images

It seems that someone uploaded to your server PNG bomb (a unicolor picture in PNG format with a very big width and height).

The solution: check image width and height before image processing.

For this you could use image magick tool. Here is an example for PHP:

if ($width > 10000 || $height > 10000) {
    // invalid image
}

More information you could find here:

• Decompression bomb vulnerabilities
• Decompression bomb protection
• files in /tmp
• Файл 420 байт разжимается в картинку png на 40 гигапикселей
• https://github.com/ptrofimov/png-bomb-protection