A zip bomb is an attack technique used against lossless data compression algorithms, such as those based around LZ77 or LZW.
David Fifield's innovative algorithm demonstrates an efficient way to create a non-recursive ZIP bomb, which is capable of achieving high compression ratios by overlapping files inside the ZIP container.
To do this, it exploits the header of a zip archive whose entries always point to the same compressed file. In this way he was able to overcome the shortcomings of DEFLATE (the compression algorithm most commonly used by zip parsers) which is limited to a maximum compression ratio of 1032:1.
The output size grows quadratically with the input size, achieving a compression ratio of more than 28 million: it can quickly extract 4.5 petabytes from a 46 megabyte source file,, making it an better alternative to recursive methods.
- David Fifield's blog post with detailed explanations: https://www.bamsoftware.com/hacks/zipbomb/
- Source Code https://www.bamsoftware.com/git/zipbomb.git