On Mon 2017-07-10 20:48:40 -0400, Brian Sniffen wrote:
> Gpg is exposed to some zip bomb problems last I looked. But the worst
> that could do is fill your disk or crash your Emacs, right?  And I
> suspect the MIME library exposes similar issues in quantity.

Could you point to the zip bomb problem, Brian?  the quine (infinite
zipbomb) i think is limited by some sort of hard-coded depth constant.
are you referring to an infinite blowup, or "just" a finite expansion?

i agree that i expect GMime to be subject to finite expansions as well
(i haven't experimented with them though), but i think neither gpg nor
GMime should be subject to infinite expansion.

if you think otherwise, i'd be happy to read pointers.

thanks for raising this concern!

       --dkg