oss-sec mailing list archives
Re: Re: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx
From: Demi Marie Obenour <demi () invisiblethingslab com>
Date: Fri, 29 Sep 2023 12:35:07 -0400
On Thu, Sep 28, 2023 at 05:10:09PM -0700, nightmare.yeah27 () aceecat org wrote:
On Thu, Sep 28, 2023 at 04:42:33PM -0400, Demi Marie Obenour wrote:How long will it take for corporations to accept that writing media codecs in C, C++, or any other memory-unsafe language is a fundamentally bad idea, and that it is better to rewrite the codecs in a safe language (such as Wuffs or Rust) than to try to secure the existing ones?Wouldn't the low-level code have to ultimately depend on unsafe Rust modules, or similar feature in other safe language?
In Wuffs, every memory access is checked for safety at compile-time, and that includes being in-bounds. If the compiler cannot prove that every access is safe, the code will not compile. There are no bounds checks at runtime. Interfacing with hardware accelerators obviously will need unsafe code, but my understanding is that most vulnerabilities are in various parsers or in the code the accelerators replace, not in the code that interfaces with the accelerators. -- Sincerely, Demi Marie Obenour (she/her/hers) Invisible Things Lab
Attachment:
signature.asc
Description:
Current thread:
- CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx Alan Coopersmith (Sep 28)
- Re: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx Demi Marie Obenour (Sep 28)
- Re: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx nightmare . yeah27 (Sep 29)
- Re: Re: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx Demi Marie Obenour (Sep 29)
- Re: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx Michael Orlitzky (Sep 29)
- Re: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx Travis Finkenauer (Sep 29)
- Re: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx Michael Orlitzky (Sep 29)
- Rust programs in distrbutions (Was: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx) Dominique Martinet (Sep 30)
- Re: Rust programs in distrbutions (Was: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx) Demi Marie Obenour (Sep 30)
- Re: Rust programs in distrbutions (Was: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx) Michael Orlitzky (Sep 30)
- Re: Rust programs in distrbutions (Was: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx) Steffen Nurpmeso (Sep 30)
- Re: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx nightmare . yeah27 (Sep 29)
- Re: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx Demi Marie Obenour (Sep 28)