3 ms·

It’s just bad code and even worse error handling. The program runs a heartbeat that lets the rest of the car know all is well when things are running smoothly.

by CSSer 5y ago

It’s just bad code and even worse error handling. The program runs a heartbeat that lets the rest of the car know all is well when things are running smoothly. When the program hangs, the heartbeat stops. When the heartbeat is interrupted for long enough, it’s programmed to reboot. With that in mind, when the owner queues up the podcast the system attempts to decode an unsanitized string (the podcast title) as if it were percent/URL encoded. When it encounters an error because “% I” is not a valid character reference, it hangs. The worst part is that the car owner was told that a firmware update would “likely” fix it but they would have to pay for it.

hodgesrm 5y ago
This seems like grounds for a class action lawsuit. Owners have been harmed by loss of car function and they are reasonably numerous.
jmgao 5y ago
No, it's a format string vulnerability.
- CSSer 5y ago
  Go read this section of the transcript[0] [0]: https://99percentinvisible.org/episode/the-roman-mars-mazda-virus/transcript#:~:text=In%20a%20URL%2C%20certain%20characters%20are%20allowed%20and%20certain%20characters%20are%20not https://99percentinvisible.org/episode/the-roman-mars-mazda-....
  - jmgao 5y ago
    That section of the transcript is incorrect, despite being from someone who worked on it. It's obviously a printf bug because it only happens with %n with valid modifiers: https://www.reddit.com/r/gimlet/comments/bdxht4/hey_its_ben_from_the_reply_all_episode_140_i_have/el1lwb2/ https://www.reddit.com/r/gimlet/comments/bdxht4/hey_its_ben_...
    - CSSer 5y ago
      Despite the fact that he confirmed it’s not C code and despite the fact that the failure case has spaces in it which make it invalid? What am I missing here?
      - jmgao 5y ago
        He's wrong, it is getting parsed in C. glibc happens to allow ' ' as a modifier to %n: https://gcc.godbolt.org/z/zaTnjzEY3 https://gcc.godbolt.org/z/zaTnjzEY3

by CSSer 5y ago

hodgesrm 5y ago

This seems like grounds for a class action lawsuit. Owners have been harmed by loss of car function and they are reasonably numerous.

jmgao 5y ago

No, it's a format string vulnerability.

CSSer 5y ago
Go read this section of the transcript[0] [0]: https://99percentinvisible.org/episode/the-roman-mars-mazda-virus/transcript#:~:text=In%20a%20URL%2C%20certain%20characters%20are%20allowed%20and%20certain%20characters%20are%20not https://99percentinvisible.org/episode/the-roman-mars-mazda-....
- jmgao 5y ago
  That section of the transcript is incorrect, despite being from someone who worked on it. It's obviously a printf bug because it only happens with %n with valid modifiers: https://www.reddit.com/r/gimlet/comments/bdxht4/hey_its_ben_from_the_reply_all_episode_140_i_have/el1lwb2/ https://www.reddit.com/r/gimlet/comments/bdxht4/hey_its_ben_...
  - CSSer 5y ago
    Despite the fact that he confirmed it’s not C code and despite the fact that the failure case has spaces in it which make it invalid? What am I missing here?
    - jmgao 5y ago
      He's wrong, it is getting parsed in C. glibc happens to allow ' ' as a modifier to %n: https://gcc.godbolt.org/z/zaTnjzEY3 https://gcc.godbolt.org/z/zaTnjzEY3