4 ms·
Now that sounds like a truly terrifying, terrible idea.
by stefan_ 4y ago
Now that sounds like a truly terrifying, terrible idea.
- Syonyk 4y agoThat seems to be how one of the exploits from a year or two ago worked. https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... It exploited an archaic Xerox format parser to make its own virtual machine, and then went out from there. So I'd agree, throwing anything on a webpage (or incoming message) into the "Can you parse this weird thing?" pipeline is a bad idea!
- astrange 4y agoJBIG2 is a mandatory part of PDF, not its own weird image format. (Though I think it's also allowed in TIFF files and those might count as weird.)