4 ms·

Millions of people in the world are affected by this library, 10 times over for every devices and apps they use. I'm sorry but I call for libraries used by mil

by keyle 3y ago

Millions of people in the world are affected by this library, 10 times over for every devices and apps they use. I'm sorry but I call for libraries used by millions around the world to NOT use C. And I love C... But this risk ratio is off the charts and they ought to not use C for such critical libraries. Even as a C guru, you are going to make a mistake, at some point. I think this is the fix https://github.com/webmproject/libwebp/commit/dce8397fec159c9edfeec7c6388cb81428c87ed8 https://github.com/webmproject/libwebp/commit/dce8397fec159c... "malloc fail"? :facepalm: (oh yes, Slack, Discord, Teams, everything is affected, including all modern OS).

deleted 3y ago
[deleted]
saagarjha 3y ago
This is the fix: https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a https://github.com/webmproject/libwebp/commit/902bc919033134...
- keyle 3y ago
  Thanks!
  - chrisbolt 3y ago
    There's a follow-up fix, according to Debian[0]: https://github.com/webmproject/libwebp/commit/95ea5226c870449522240ccff26f0b006037c520 https://github.com/webmproject/libwebp/commit/95ea5226c87044... [0]: https://security-tracker.debian.org/tracker/CVE-2023-4863 https://security-tracker.debian.org/tracker/CVE-2023-4863
ctz 3y ago
Not a single test, either here or in adjacent commits. !?!
1letterunixname 3y ago
Same here. Rust should be the "new C". Because you can code in C doesn't mean you should produce large quantities of complex code in it for "performance", "portability", or "legacy compatibility" "reasons". C/C++ as well as dynamic languages create huge surfaces of undefined behavior and subtle bugs that are too difficult to lint and too burdensome for even the most astute coders. Fundamental libraries should also be formally verified in a manner similar to seL4. Also, another problem is a pervasive attitude of unprofessionalism and dismissiveness of rigor, quality, correctness, and security in FOSS. The current approach of building empires on quicksand is foolish.

by keyle 3y ago

deleted 3y ago

[deleted]

saagarjha 3y ago

This is the fix: https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a https://github.com/webmproject/libwebp/commit/902bc919033134...

keyle 3y ago
Thanks!
- chrisbolt 3y ago
  There's a follow-up fix, according to Debian[0]: https://github.com/webmproject/libwebp/commit/95ea5226c870449522240ccff26f0b006037c520 https://github.com/webmproject/libwebp/commit/95ea5226c87044... [0]: https://security-tracker.debian.org/tracker/CVE-2023-4863 https://security-tracker.debian.org/tracker/CVE-2023-4863

ctz 3y ago

Not a single test, either here or in adjacent commits. !?!

1letterunixname 3y ago

Same here. Rust should be the "new C". Because you can code in C doesn't mean you should produce large quantities of complex code in it for "performance", "portability", or "legacy compatibility" "reasons". C/C++ as well as dynamic languages create huge surfaces of undefined behavior and subtle bugs that are too difficult to lint and too burdensome for even the most astute coders. Fundamental libraries should also be formally verified in a manner similar to seL4. Also, another problem is a pervasive attitude of unprofessionalism and dismissiveness of rigor, quality, correctness, and security in FOSS. The current approach of building empires on quicksand is foolish.