# Pixel flood attack

A 5KB PNG with spoofed 64250x64250 dimensions caused HackerOne's image converter to allocate ~4GB, timing out the service.

- Payout: $500
- Severity: medium
- Program: HackerOne
- Credited: spipm
- Disclosed: 2013-11-30
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/390
- Library page: https://bugbountylibrary.com/r/h1%3A390
- Tags: domain:web impact:dos kind:bounty platform:hackerone sev:medium tech:payment technique:source-review vuln:dos

**Target:** image upload/conversion service
**Root cause:** Image converter trusted the pixel-dimension header fields and allocated memory for the full declared image size without validating a maximum pixel count.
**Steps:**
1. Take a small 260x260 PNG (~5KB)
2. Patch the width/height header fields to `0xfafa x 0xfafa` (64250x64250)
3. Upload the crafted image to the target's image conversion endpoint
4. Converter attempts to allocate 64250*64250 = 4,128,062,500 pixels, exhausting memory and timing out the service
**How found:** Researcher noticed the service converts uploaded images and reasoned that spoofing the pixel dimensions in the header would force a huge memory allocation; confirmed by observing service timeouts and reproducing the same crash in Windows Photo Viewer.
**Exploitation:** Upload a tiny crafted image whose header declares enormous dimensions; the server-side converter allocates memory for the full image, causing resource exhaustion and service timeout (DoS).
**Insight:** Image parsers trust header-declared dimensions; a few bytes in a tiny file can force gigabyte allocations. Test dimension/header fields of image formats against any server-side converter or thumbnailer.