search

sammycage / lunasvg

lunasvg is a standalone SVG rendering library in C++
MIT License
818 stars 115 forks source link

SVG bomb uses more and more memory without ever stopping #171

Open sudoLife opened 4 weeks ago

sudoLife commented 4 weeks ago

Hi,

An unlikely but interesting attack vector with an SVG that references its own elements recursively: https://brhfl.com/2017/11/svg-bomb/

I've tried it out with LunaSVG and as I'm speaking my RAM is slowly disappearing. Thoughts?