Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

blog.checkpoint.com

Post reply on HN
Print view View original

101–110 of 234 posts

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#101

Post by jbk »

ackfoo wrote: post #93

Treat data as data. Taking the Subrip format as an example, everything starts out fine so long as there is good bounds checking on the purely textual data. Then, however, some dipshit decides to extend the format by adding tags for things like bold, italics, underline etc. This is completely unnecessary for subtitles because the emphasis can be inferred from the dialogue. The unnecessary complexity increase the poten…

Then people add full BASE64 fonts inside the subtitles.

Fonts that have a virtual machine in...

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#102

Post by runeks »

Can anyone recommend a video player written in a memory-safe language for OSX that handles MKV files? Or is the simple truth that the problem lies in the parsers, which are shipped as a library written in C, because no sane developer wants to rewrite parsers for 25 different subtitle formats when writing a video player?

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#103

Post by bingojess »

tydok wrote: post #76
etix wrote: post #66

Earlier quoted context omitted.

They use a hash function to match subtitles. http://trac.opensubtitles.org/projects/opensubtitles/wiki/Ha...

The problem isn't only about matching subtitles to movies but also where to look for subtitles, e.g. opensubtitles.org, subscene.com, etc.

I believe it just scrapes them all. I can't remember the last time opensubtitles didn't have a sub I was looking for

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#104

Post by emodendroket »

cbr wrote: post #99
ackfoo wrote: post #93

Treat data as data. Taking the Subrip format as an example, everything starts out fine so long as there is good bounds checking on the purely textual data. Then, however, some dipshit decides to extend the format by adding tags for things like bold, italics, underline etc. This is completely unnecessary for subtitles because the emphasis can be inferred from the dialogue. The unnecessary complexity increase the poten…

This is completely unnecessary for subtitles because the emphasis can be inferred from the dialogue. Seems useful for deaf people

It also seems like you could use it for applications like karaoke.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#105

Post by tomp »

MereInterest wrote: post #26
captainmuon wrote: post #8

Wow, that is bad. I'm always amazed by such vectors in supposedly passive formats, like fonts, images, and so on. There is no excuse that these kind of applications are not completely sandboxed. All you need is some kind of DLL, raw data in, raw pixels out. In case of hardware accelerated codecs, raw pixels in, surface pointer in, nothing out. There is no need to be able to access the filesystem, etc.. To render subt…

I get equally confused anytime Microsoft Office gives the "Files from the internet may contain viruses." warning. How do you mess up a document editor so badly that the document can affect the computer? I know that the answer is Visual Basic, and I know that there are legacy reasons why it will never be removed, but holy cow, it is ridiculous.

Well, M$ Office makes sense, since it's macros.

What I really don't understand is Acrobat Reader. It has a "Protected View", which is the first WTF - .pdf-s are read-only, so there should be absolutely zero active code running anyways. What's the next, much bigger WTF WTF WTF is that you need to exit protected view to print the document.

How can the program read and render the document on screen, but not print it?! How is this even possible?

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#106

Post by jbk »

runeks wrote: post #102

Can anyone recommend a video player written in a memory-safe language for OSX that handles MKV files? Or is the simple truth that the problem lies in the parsers, which are shipped as a library written in C, because no sane developer wants to rewrite parsers for 25 different subtitle formats when writing a video player?

There are none. You can use VLC inside VLC sandbox, but you won't get something perfect.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#107

Post by airza »

pjmlp wrote: post #17
_jomo wrote: post #9

These are the VLC commits adressing the issue: https://github.com/videolan/vlc/search?utf8=%E2%9C%93&q=subt...

As usual, the common set of friends we already know since the 80's: > Fix potential heap buffer overflow > Fix potential out of bound read > Fix invalid double increment.

i've never seen a double increment exploited before- it's undefined behavior, but what is the typical route against that?

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#108

Post by dragonwriter »

ackfoo wrote: post #93

Treat data as data. Taking the Subrip format as an example, everything starts out fine so long as there is good bounds checking on the purely textual data. Then, however, some dipshit decides to extend the format by adding tags for things like bold, italics, underline etc. This is completely unnecessary for subtitles because the emphasis can be inferred from the dialogue. The unnecessary complexity increase the poten…

> Then, however, some dipshit decides to extend the format by adding tags for things like bold, italics, underline etc. This is completely unnecessary for subtitles because the emphasis can be inferred from the dialogue.

Emphasis of an entire line can be inferred, but how can emphasis within a line be inferred when you don't know which utterances within the line correspond to which words in the subtitles (which, if you need subtitles because you don't know the language being spoken, you won't)?

While uncommon, I've occasionally seen font variants used for emphasis on professional subtitles for that reason.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#109

Post by justin66 »

jbk wrote: post #22
captainmuon wrote: post #8

Wow, that is bad. I'm always amazed by such vectors in supposedly passive formats, like fonts, images, and so on. There is no excuse that these kind of applications are not completely sandboxed. All you need is some kind of DLL, raw data in, raw pixels out. In case of hardware accelerated codecs, raw pixels in, surface pointer in, nothing out. There is no need to be able to access the filesystem, etc.. To render subt…

Ha, the famous sandboxing remark. I wish it was that simple! So, let me share some light on the sandboxing for multimedia (I work on VLC). If you sandbox an application like VLC, in the current way of doing sandboxing, which we've done for macOS, WinRT/UWP, and snaps, you still need a lot of permissions. Namely: - you need to be able to open files without user interactions (no file picker), in order to open playlist,…

What features could the OS offer you (to help your program be "sandboxed") that it currently does not?

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#110

Post by eth_hero_12 »

jbk wrote: post #33
pawadu wrote: post #15

Earlier quoted context omitted.

Holy crap, that code doesn't look good. I predict we will see more exploits for this project. Maybe we should stop random people from contributing to complex C projects?

Look at FFmpeg and all the multimedia libraries and you will be horrified.

vlc has a bug and yet you talk shit about well developed and fuzzed by google projects. thats why vlc will never be better than mpv.
Post reply on HN