~/talk

aCropalypse Now, in Search of the Missing PNG

on YouTube 15m
TalkinFrenchat Devoxx France 2024 · 2024-04-17..04-19· [security, web-platform]

speaker

name:Sonia Seddiki
links:none on file

resources

video:https://youtu.be/ggdvxmyPGzo
slides:none on file

summary

Describes CVE-2023-21036 (aCropalypse) affecting PNG screenshots on Google Pixel and Windows where overwriting files without truncation leaves original cropped pixels in trailing IDAT chunks. Shows a recovery method: append a 32 KB search buffer to locate/decompress zlib/deflate blocks from the file tail, extract pixel stream fragments, infer device resolution, repair PNG filter bytes, and rewrap the recovered data into a valid PNG; includes the blog post and script used to restore parts of original screenshots.

AI-written summary · about

chapters (5)

  1. 0:00Introduction
  2. 1:05Acropalypse flaw origin
  3. 3:55PNG format basics
  4. 9:34Damaged file recovery
  5. 14:36Summary

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.