NJL/Out-Of-Memory-1.2mb-browser-PNG
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add gzip

Browse Source
This commit is contained in:
NJL
2026-06-26 16:13:47 +00:00
parent 4b209203cf
commit d5bbf67624
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+7 -4
View File
@@ -4,20 +4,23 @@ A brotli "decompression bomb": a ~1 MB file on disk that expands to **50 GB** in
The decompressed payload starts with a real PNG, so the image renders — then the browser keeps
inflating the trailing 50 GB of zeros and runs **out of memory / crashes the tab**.
A gzip version (`bomb.png.gz`) is also built, so clients that don't accept `br` still get bombed.
## Files
| File | What it does |
|------|--------------|
| `image.png` | The real image embedded at the front of the payload (input). |
| `create.py` | Builds the bomb: `[PNG] + 1 MB random + 50 GB zeros` → `bomb.png.br`. |
| `bomb.png.br` | The compressed bomb (~1 MB on disk, 50 GB decompressed). |
| `server.py` | Minimal Flask server that serves the bomb with `Content-Encoding: br`. |
| `create.py` | Builds the bombs: `[PNG] + 1 MB random + 50 GB zeros` → `bomb.png.br` **and** `bomb.png.gz`. |
| `bomb.png.br` | The brotli bomb (~1 MB on disk, 50 GB decompressed). |
| `bomb.png.gz` | The gzip bomb (~50 MB on disk, 50 GB decompressed) — fallback for clients without `br`. |
| `server.py` | Minimal Flask server. Loads both prebuilt bombs and picks `br` or `gzip` per the client's `Accept-Encoding`. |
| `slow_download.py` | Fuller server: inline `<img>` page + download route. |
## Usage
```sh
python create.py # build bomb.png.br (pass --rebuild to overwrite)
python create.py # build bomb.png.br + bomb.png.gz (pass --rebuild to overwrite)
python server.py # serve on :8080, then open in a browser
```