4 ms·

Previously (link to upstream announcement): https://news.ycombinator.com/item?id=26426816 https://news.ycombinator.com/item?id=26426816 No simultaneous source

• hannob 6y ago
  It isn't that mysterious. p7zip has a number of known bugs easily found by fuzzing, as it hasn't seen updates for years. 7-zip in general is a tool that is written in C and supports lots of complex binary formats and thus has a huge attack surface for memory corruption bugs. This is all pretty obvious with some basic knowledge of how these things work.
  • lumpa 6y ago
    Thanks for clarifying, the original tweet has also been expanded innl the same vein: https://mobile.twitter.com/AdmVonSchneider/status/1369300173441089538 https://mobile.twitter.com/AdmVonSchneider/status/1369300173... And a bit off-topic, but have you heard of (or maybe commented on) "Bring macOS Quick Look Feature to Windows"[0] aka "parse and preview everything"? Is it paranoia[1] to think "how we defend against parser exploits" should be part of the tool design? [0] https://github.com/QL-Win/QuickLook https://github.com/QL-Win/QuickLook [1] https://news.ycombinator.com/item?id=26007577 https://news.ycombinator.com/item?id=26007577
• webmobdev 6y ago
  The developer has already clarified that the source will be released and open sourced under GNU LGPL - https://sourceforge.net/p/sevenzip/discussion/45797/thread/cec5e63147/ https://sourceforge.net/p/sevenzip/discussion/45797/thread/c...