pure

A linter for zip files that can probably detect some of these: https://github.com/ronomon/pure

Wow, that's saying something! The tool is called Pure [1]. It was originally written in JavaScript and open-sourced, then rewritten for Microsoft in C at their request for performance (running sandboxed) after it also detected David Fifield's “A Better Zip Bomb” as a zero day. I'd love to rewrite it in Zig to benefit from the checked arithmetic, explicit control flow and spatial safety—there are no temporal issues for this domain since it's all run-to-completion single-threaded. Got to admit I'm a little embarrassed it's still in C! [1] https://github.com/ronomon/pure

> So discover them. Roll in your piles of cash from those easy picking bounties. Prove your point. Sure, I already did. I earned the second highest bounty for Fastmail back in 2019 for exactly this kind of exploit. Since then I've reported to dozens of programs (OpenSSL, ClamAV, SpamAssassin, ProtonMail, Hey, Missive, Yahoo Mail, Yandex, Spark, Trello, Missive, AWS, Google Chrome) and rolled in a few tidy piles. I have also written various pieces of open-source software that would have detected and prevented four separate zero-days, affecting Microsoft (and almost every AV engine, browser, and zip parser) [1][2], Gmail [3], Apple Mail [4], and countless open-source email servers [5]. Now it's your turn. [1] https://github.com/ronomon/pure [2] https://www.usenix.org/conference/woot19/presentation/fifiel... [3] https://blog.cotten.io/ghost-

I wrote something similar but for the ZIP format, called Pure, to detect hidden buffer bleeds outside and between and within structures, amongst other anomalies. It's also amazing what you can do with a ZIP file. Pure: https://github.com/ronomon/pure The goal of Pure is to reduce the attack surface available for zero-days by doing the simple yet critical buffer bounds checks that most end-user application software will not, and to do this for more and more popular file formats. The vision is that one day you can deploy Pure at your email server and get much stronger guarantees on the safety of email attachments that you open... as well as on the attachments you send out... for example that your billing software is not leaking the contents of sensitive server memory into XLSX reports that you are mass mailing to clients (Pure actually foun