3 ms·
If everyone has the same parser the whole classes of bugs just stop being exploitable. The classic one being one parser at the edge validates somethhing and the
by Muromec 1y ago
If everyone has the same parser the whole classes of bugs just stop being exploitable. The classic one being one parser at the edge validates somethhing and the further down the line sees another result which it expects tp be rejected during validation.
Both parsers could be buggy, but when they have different kinds of bugs, you get a zero click undetectable exploit
- woodruffw 1y agoI don’t think it’s this simple: you can still produce observable differentials with a single parser by using different options within that parser in different places. The ZIP format itself affords ample opportunities for that.
- hinkley 1y agoThe settings are at encode time. For two readers the results should be unambiguous.
- woodruffw 1y agoThere are plenty of decode-time knobs, even within a single ZIP parser. Here are just a few you could set while using libzip[1]. [1]: https://libzip.org/documentation/zip_open.html#DESCRIPTION https://libzip.org/documentation/zip_open.html#DESCRIPTION
- aaviator42 1y agoIt significantly increases the attack surfaces of bugs that do exist in the parser if the same implementation is used everywhere.