Signal IOS Remote Memory Exhaustion and Restart

[nick.m.mckenna () gmail com]

The image rendering component of Signal on IOS  (createGenericPreview)  fails to check for  unreasonably large images 
before manipulating received images. This allows for a large image sent to a user to exhaust all available memory when 
the image is displayed resulting in a forced restart of the device. 


When Signal receives an image and it is viewed, the image display function createGenericPreview is called which 
subsequently calls createHeroImageView on the image which adds shadows to the original image and downscales it. Because 
of this, any image sent to a client will be loaded into memory in full without checking if Signal or the device on 
which it is running have enough memory to hold said image. Given a sufficiently large image an attacker can cause 
memory exhaustion. In Signal, an attacker is able to send arbitrarily large images to a user so long as the image is 
below the file size limit Signal sets for images of several Mb.  Generally, an image large enough to trigger memory 
exhaustion in this way would be too large to send however many image formats have built-in image compression for nearby 
pixels of the same color. In images with little variety of color this sort of compression results in a massive delta 
(many orders of magnitude) between the size of an image on disk and
  the size of an image when loaded into memory. Thus, by sending a large single color image an attacker may remotely 
crash Signal and force a phone to restart.

Demo:
https://streamable.com/mxivw

References:
If you would like a premade file with which to test this check https://bomb.codes/

https://github.com/signalapp/Signal-iOS/blob/77711df27469970d938184c5f2cb9ca36aa6684b/SignalMessaging/ViewControllers/MediaMessageView.swift
 Line 256-313