3 ms·

> there is no string that could be injected to harm me Unfortunately that's not true at all. There are many instances of arbitrary code execution gained though

• rsync 9y ago
  Thank you for bringing up the 'strings' problem - something I had forgotten about. It's worth noting, however, that there is nothing inherently dangerous about a strings-like utility. Rather, it is GNU strings which has unexpected complexity: "Perhaps simply by the virtue of being a part of that bundle, the strings utility tries to leverage the common libbfd infrastructure to detect supported executable formats and "optimize" the process by extracting text only from specific sections of the file. Unfortunately, the underlying library can be hardly described as safe: a quick pass with afl (and probably with any other competent fuzzer) quickly reveals a range of troubling and likely exploitable out-of-bounds crashes due to very limited range checking" ... which is the very issue I'm warning against, just at a different layer of abstraction ...