3 ms·
Of these, I'm pretty sure VLC is the most common software on end-user systems - and there are enough security advisories where a well-crafted video file can exe
by a_bonobo 8y ago
Of these, I'm pretty sure VLC is the most common software on end-user systems - and there are enough security advisories where a well-crafted video file can execute code with user privileges (like https://www.videolan.org/security/sa1801.html https://www.videolan.org/security/sa1801.html ), if you can automate that you have access to many personal computers in the EU
- amenod 8y agoAlso, VLC has a huge attack surface - binary parsing is difficult to do right in C / C++. I hope this effort makes the crashes less frequent...
- justaj 8y agoIs mpv [0] better in this regard? 0: https://mpv.io/ https://mpv.io/
- kilotaras 8y agoGP isn't saying that VLC is unsafe, but rather that C (which VLC is written in) tends to be unsafe. Seeing as MPV is also written in C, it's absolutely the same in that regard.
- Nullabillity 8y agoAFAIK both VLC and mpv use FFmpeg's codecs, so their attack surfaces should be similar.
- cyphar 8y agoThere's work going on (since 2016) to port the parsers to Rust[1]. I believe that a few already are written in Rust, and it'd be great if some Rust folks would help out with the effort. [1]: https://youtu.be/YTy_JOxGOd4 https://youtu.be/YTy_JOxGOd4