81–90 of 235 posts
Earlier quoted context omitted.
This is why I'm bullish on LLMs for application security vulnerability searches (like Shodan for code). It'll see what humans don't.
Why would you expect that? LLMs are explicitly trained on what humans do. Humans miss security vulnerabilities all the time.
This is pretty bad, there will be many vulnerable applications and someone just posted how to exploit it. I just reproduced it on a VM:
SUMMARY: AddressSanitizer: heap-buffer-overflow (/home//webp_test/examples/dwebp+0xb24e9) in BuildHuffmanTable Shadow bytes around the buggy address: ...
Also, here's the webp it generated as base64, but chrome doesn't crash or anything. Other apps may handle it differently, but many just say invalid format.
UklGRukAAABXRUJQVlA4TN0AAAAvAAAAAPAAWgAAsKwlnZsEAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAALRt27Zt27Zt27Zt27Zt2/b92fUAWgAAsLTknJskSQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAALw/23oALQAAWFpyzk2SJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAN6f bT2AFgAALC055yZJEgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAO/Pth7A/xsAQoutz/f3 fwAwMzNvVVXt7p5zLw==
Earlier quoted context omitted.
Is Rust in practice a memory safe language when you're doing tricks like decoding huffman-decoding huffman tables into buffers? It seems like once you optimize for performance this much, you're liable to turn off bounds checking here or there.
Rusts bounds checking is done at compile time, so you don't need to turn it off.
Do bounds checks even matter, even for very tight loops? This article [1] seems to suggest that removing the checks can give up to 10-15% speed increase under some circumstances. Worth it? I'd say no.
[1] https://dropbox.tech/infrastructure/lossless-compression-wit...
Earlier quoted context omitted.
Hubris and people thinking they can safely code in memory unsafe languages (they can't)
Not to worry, there are serialization and other vulnerabilities in memory safe languages :3
Earlier quoted context omitted.
This is the sort of thing where I am very curious to hear what happens if you fine-tune an uncensored version of GPT4 on some memory exploits like this along with the vulnerable code and ask it for more. It seems like it ought to be really good at this and I am suspicious that people in the know are afraid to talk about it publicly because it's too good at it and once people start weaponizing LLMs for this purpose we…
LLMs should indeed be very good at finding vulns. It is a safe bet state actors have already done this, and have added to their stockpile of zero-day exploits. I suspect you are right that collectively we are whistling past the graveyard and the current "solution" is to make widely available LLMs explicitly not provide that kind of capability.
Earlier quoted context omitted.
Is Rust in practice a memory safe language when you're doing tricks like decoding huffman-decoding huffman tables into buffers? It seems like once you optimize for performance this much, you're liable to turn off bounds checking here or there.
Rusts bounds checking is done at compile time, so you don't need to turn it off.
Additional timeline info, as I was curious myself. WebP is old enough that a memory safe language was not a feasible option when the project started. Android 12 was the first version to support Rust code, and came out in 2021 [0, link talks about the first year of integration]. On the iOS side (which also was affected by this), Swift 1.0 came out in ~2014. As far as I can tell, Chrome doesn't yet support a memory saf…
Is Rust in practice a memory safe language when you're doing tricks like decoding huffman-decoding huffman tables into buffers? It seems like once you optimize for performance this much, you're liable to turn off bounds checking here or there.
Many anti-bounds checker advocates, usually miss the first part.
The point about Android is particularly important. I wouldn't like to estimate the proportion of Android phones that are in regular use that no longer receive security updates.
Is there any site that shows what phones are still getting security updates? I'm worried that this will be the thing that makes me retire my son's old Moto G... 5 I think? It's probably out of security updates. Which kills me, he's a careful boy and it's a solid phone, this is unnecessary E-Waste.
Earlier quoted context omitted.
Is JavaScript a memory safe language?
Yes, and so are Python, Lisp, Haskell, and a million other languages that were available in 2010. None of those are suitable options for an image decoding library on the range of WebP supported platforms.
What makes them unsuitabe is lack of widespread compiler support across those platforms, if we ignore how long Ada has been available in GCC.
And Modula-2 is now in GCC as well.