{"action":"created","issue":{"url":"https://api.github.com/repos/thumbor/thumbor/issues/604","labels_url":"https://api.github.com/repos/thumbor/thumbor/issues/604/labels{/name}","comments_url":"https://api.github.com/repos/thumbor/thumbor/issues/604/comments","events_url":"https://api.github.com/repos/thumbor/thumbor/issues/604/events","html_url":"https://github.com/thumbor/thumbor/issues/604","id":117778080,"number":604,"title":"PNG bomb vulnerability","user":{"login":"gi11es","id":487183,"avatar_url":"https://avatars.githubusercontent.com/u/487183?v=3","gravatar_id":"","url":"https://api.github.com/users/gi11es","html_url":"https://github.com/gi11es","followers_url":"https://api.github.com/users/gi11es/followers","following_url":"https://api.github.com/users/gi11es/following{/other_user}","gists_url":"https://api.github.com/users/gi11es/gists{/gist_id}","starred_url":"https://api.github.com/users/gi11es/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gi11es/subscriptions","organizations_url":"https://api.github.com/users/gi11es/orgs","repos_url":"https://api.github.com/users/gi11es/repos","events_url":"https://api.github.com/users/gi11es/events{/privacy}","received_events_url":"https://api.github.com/users/gi11es/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-11-19T09:52:09Z","updated_at":"2015-11-19T13:25:31Z","closed_at":null,"body":"![PNG bomb file](https://cloud.githubusercontent.com/assets/487183/11267360/394eb86c-8eab-11e5-922b-f8e779607f15.png)\r\n\r\nPIL actually detects the bomb, but Thumbor crashes anyway:\r\n\r\n```\r\nvagrant@mediawiki-vagrant:~$ sudo /srv/thumbor/bin/python /srv/thumbor/bin/thumbor -c /etc/thumbor.conf\r\n/srv/thumbor/local/lib/python2.7/site-packages/PIL/Image.py:2261: DecompressionBombWarning: Image size (50625000000 pixels) exceeds limit of 89478485 pixels, could be decompression bomb DOS attack.\r\n  DecompressionBombWarning)\r\nvagrant@mediawiki-vagrant:~$ \r\n```\r\nHaving a configurable source megapixel limit would work around that problem."},"comment":{"url":"https://api.github.com/repos/thumbor/thumbor/issues/comments/158055908","html_url":"https://github.com/thumbor/thumbor/issues/604#issuecomment-158055908","issue_url":"https://api.github.com/repos/thumbor/thumbor/issues/604","id":158055908,"user":{"login":"gi11es","id":487183,"avatar_url":"https://avatars.githubusercontent.com/u/487183?v=3","gravatar_id":"","url":"https://api.github.com/users/gi11es","html_url":"https://github.com/gi11es","followers_url":"https://api.github.com/users/gi11es/followers","following_url":"https://api.github.com/users/gi11es/following{/other_user}","gists_url":"https://api.github.com/users/gi11es/gists{/gist_id}","starred_url":"https://api.github.com/users/gi11es/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gi11es/subscriptions","organizations_url":"https://api.github.com/users/gi11es/orgs","repos_url":"https://api.github.com/users/gi11es/repos","events_url":"https://api.github.com/users/gi11es/events{/privacy}","received_events_url":"https://api.github.com/users/gi11es/received_events","type":"User","site_admin":false},"created_at":"2015-11-19T13:25:30Z","updated_at":"2015-11-19T13:25:30Z","body":"FYI I'm working on an attempt to fix this, I'm just fighting my way through tests setup, as my other issue reports would have hinted by now :)"}}