Re: Interesting article about PHP security exploit by GIF files

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



At 9:27 PM +0200 6/20/07, Tijnema wrote:
On 6/20/07, tedd <tedd@xxxxxxxxxxxx> wrote:
If you are worried about evil code being in the image, you could
always resample the image (larger or smaller). Not that I have
personal experience, but I would think that any piece of code that is
resampled is going to have a difficult time running.

Cheers,

tedd

Well, some smart guy could still come around ifhe knows how the file
is resampled, as he would just need to the opposite, but that would
only work if you go from gif to gif I think, Don't think it will be
possible with JPEG or such...

Tijnema


The resampling of the image could certainly be random -- there's really not a lot of visual difference between a 200 x 200 image and a range of 195 x 195 to 205 x 205 images -- so that gives you a range of 10 possibilities. Plus , you can mix and match various dimensions producing uneven images, such as a 201 x 199 image. That should give you enough range to make it very unlikely that someone could guess as to which which random image configuration was going to be applied.

And, you can change all gifs to jpegs.

Cheers,

tedd

--
-------
http://sperling.com  http://ancientstones.com  http://earthstones.com

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


[Index of Archives]     [PHP Home]     [Apache Users]     [PHP on Windows]     [Kernel Newbies]     [PHP Install]     [PHP Classes]     [Pear]     [Postgresql]     [Postgresql PHP]     [PHP on Windows]     [PHP Database Programming]     [PHP SOAP]

  Powered by Linux