Debunking the LZ4 "20 years old bug" myth

http://fastcompression.blogspot.com/2014/06/debunking-lz4-20-years-old-bug-myth.html

by bronson • 12 years ago

178 14 12 years ago

fastcompression.blogspot.com

aortega• 12 years ago

"besides TCP messages have a hard-code limit of 64KB."

hcles• 12 years ago

A legit criticism, but who would transmit an 8Mb datablock using LZ4 over a network? There are far better compression schemes whose lower performance tradeoffs become negligible when network latency is involved.

I am using LZ4 currently for a project compressing Netflow-derived data for a major ISP, even then it's in 64Kb chunks for quick access and decompression.

Xylakant2• 12 years ago

but who would transmit an 8Mb datablock using LZ4 over a network

Well, an attacker would. The question is whether the listener accepts that block, decodes it and gets pwned.

iclelland• 12 years ago

This all looks like a lot more drama than it really is. There's a lot of reasonable discussion going on between the two parties now.

See http://seclists.org/oss-sec/2014/q2/681 and https://code.google.com/p/lz4/issues/detail?id=52&can=1 for more recent, measured responses.

hblanks• 12 years ago

Lobste.rs, of course, toplists the original citation in place of Yann's response. I find it better reading.

dang• 12 years ago

The original article was posted at https://news.ycombinator.com/item?id=7951324.

lostlogin• 12 years ago

And now its hit the front (Internet) page of a big paper. The Mars Rover hardly gets a mention, despite the headline. http://www.telegraph.co.uk/technology/news/10930090/Software...

Debunking the LZ4 "20 years old bug" myth

Related Stories