4 ms·
Adobe deserve a pile of the blame here for the pdf spec - it only requires the magic to appear in the first 1024 bytes[1] (and that %EOF appears in the last 102
by bazzargh 9y ago
Adobe deserve a pile of the blame here for the pdf spec - it only requires the magic to appear in the first 1024 bytes[1] (and that %EOF appears in the last 1024) - thus allowing silly tricks like PDFs that are also another file type [2].
[1] http://www.adobe.com/content/dam/Adobe/en/devnet/acrobat/pdfs/pdf_reference_1-7.pdf http://www.adobe.com/content/dam/Adobe/en/devnet/acrobat/pdf... section 3.4.1
[2] https://www.slideshare.net/ange4771/a-binary-chimera https://www.slideshare.net/ange4771/a-binary-chimera
- landave 9y agoI agree with the pdf spec allowing some insane stuff. However, I think it's quite a stretch to put any blame on Adobe for this one. In essence, Avast has implemented their own std::vec in C for the management of the magic numbers, and they implemented it quite poorly. As mentioned in the article, the find_magicnums function supports roughly 300 (!) different magic numbers. Adobe's PDF is not required at all to exploit this bug.