MOAB #29, does it include a Safari denial of service attack? - MOAB Fixes

Message from discussion MOAB #29, does it include a Safari denial of service attack?

Matt Beaumont

More options Jan 30 2007, 12:29 pm

From: Matt Beaumont <ma...@cs.ucla.edu>

Date: Tue, 30 Jan 2007 09:29:30 -0800

Local: Tues, Jan 30 2007 12:29 pm

Subject: Re: [moabfixes] Re: MOAB #29, does it include a Safari denial of service attack?

  Reply to author
  |
  Forward
  | Print
  | View thread
  | Show original
  | Report this message
  | Find messages by this author
  

On Tue, Jan 30, 2007 at 9:15:50 -0800, Landon Fuller wrote:
> I haven't had time to look at it, but Matt Beaumont did some digging,
> and it sounds like the image causes in an infinite loop in
> CoreGraphics' jpeg2000 implementation.

Should've mentioned this last night on-list, but I was busy with some
C++ reversing :)

FWIW, the relevant library is Kakadu [1], licensed by Apple for use with
CG. It lives in
'/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Framew orks/ImageIO.framework/Versions/A/Resources/libJP2.dylib'.

I'm not actually sure that the loop is infinite, per se, but certainly
very, very large -- 300000-ish iterations of the outermost loop times
3-5 iterations of the next loop in, and on occasion, some
0x1212-iteration loops within that.

-Matt

[1] http://www.kakadusoftware.com/

Reply to author Forward