3 ms·
Yep, did it, not going to use Telegram now. Love the unsecure TLRPC objects deserialization that actually makes the native client crash and to not verify what
by rvnx 8y ago
Yep, did it, not going to use Telegram now.
Love the unsecure TLRPC objects deserialization that actually makes the native client crash and to not verify what other clients have sent:
https://raw.githubusercontent.com/DrKLO/Telegram/e397bd9afdfd9315bf099f78a903f8754d297d7a/TMessagesProj/src/main/java/org/telegram/tgnet/TLRPC.java https://raw.githubusercontent.com/DrKLO/Telegram/e397bd9afdf...
and the tons of magic and undocumented numbers in the code:
https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/jni/tgnet/Handshake.cpp#L278 https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/...
- empthought 8y agoCrashing in the face of invalid and likely malicious input is a secure approach (fail fast).
- saagarjha 8y agoDepends on whether the crash is intentional :/