3 ms·
Thank you for bringing up the 'strings' problem - something I had forgotten about. It's worth noting, however, that there is nothing inherently dangerous about
by rsync 9y ago
Thank you for bringing up the 'strings' problem - something I had forgotten about.
It's worth noting, however, that there is nothing inherently dangerous about a strings-like utility. Rather, it is GNU strings which has unexpected complexity:
"Perhaps simply by the virtue of being a part of that bundle, the strings utility tries to leverage the common libbfd infrastructure to detect supported executable formats and "optimize" the process by extracting text only from specific sections of the file. Unfortunately, the underlying library can be hardly described as safe: a quick pass with afl (and probably with any other competent fuzzer) quickly reveals a range of troubling and likely exploitable out-of-bounds crashes due to very limited range checking"
... which is the very issue I'm warning against, just at a different layer of abstraction ...