2 ms·

But images and videos are byte streams already... The security boundary is often the network, where things are serialized anyway. The whole point is to sandbo

by chubot 11y ago

But images and videos are byte streams already... The security boundary is often the network, where things are serialized anyway. The whole point is to sandbox the deserialization only, which has a large attack surface due to complex conditionals and string handling. The rest of the application will need to run with privileges to actually do the stuff you care about, like display things to your screen and so forth.

lmm 11y ago
> But images and videos are byte streams already... Right, but the reason for this bug (and many others) is the mingling of the data bytestream and the command channel (the arguments for the call to wget). > The whole point is to sandbox the deserialization only, which has a large attack surface due to complex conditionals and string handling. I don't think that would help. Your sandboxed deserializer deserializes the video file into an inert datastructure. But then you go to system() to wget based on that datastructure and you're pouring commands and data into a flat stream. That architecture won't stop you from parsing a bunch of unix commands as image bytes and then passing those "image bytes" on the command line.