3 ms·

AFAIK, fonts aren't a passive format, they contain code which executes in a VM.

• marcosdumay 9y ago
  At least SRT files are a purely declarative sequence of lines with "time time text".
  • jbk 9y ago
    But SSA is not. It's specifying a font and sometimes even shipping a font inside the SSA file.
  • Khao 9y ago
    "Officially", SRT files are only timecodes and text, but most players support html codes directly like <b> <i> <u> to support more formatting options than the basic SRT. I wonder if some of them simply render the text as html and could be vulnerable to similar attacks. I say "Officially" because SRT has no standard, it just evolved through usage and it's a fucking mess, as I'm a software dev working on a subtitling editor software.
    • olau 9y ago
      I seen a similar problem in another context where a browser engine is used to render some simple HTML in an app for convenience, but then suddenly turns into something exploitable because nobody is thinking about updating the engine when a bug is found in an esoteric (for the app) feature. Embedded web engines should probably have a minimalistic safe mode.