Does anyone know if the subtitle hosting services added checks for this as well?
Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
11–20 of 234 posts
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#12Does this also work for Android versions of Kodi et al?
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#13Interestingly running VLC 2.2.4 on MacOS 10.12 and checking for updates returns 'VLC 2.2.4 is currently the newest version available.', obviously I downloaded 2.2.5.1 from videolan.org but still odd.
The update will be deployed today or tomorrow in the updaters.
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#14Clearly VLC should be rewritten in Rust.
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#15These are the VLC commits adressing the issue: https://github.com/videolan/vlc/search?utf8=%E2%9C%93&q=subt...
Holy crap, that code doesn't look good. I predict we will see more exploits for this project.
Maybe we should stop random people from contributing to complex C projects?
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#16Clearly VLC should be rewritten in Rust.
While I think Rust would be s good choice, the project could benefit from a rewrite even in the same language.
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#17These are the VLC commits adressing the issue: https://github.com/videolan/vlc/search?utf8=%E2%9C%93&q=subt...
As usual, the common set of friends we already know since the 80's:
> Fix potential heap buffer overflow
> Fix potential out of bound read
> Fix invalid double increment.
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#18These are the VLC commits adressing the issue: https://github.com/videolan/vlc/search?utf8=%E2%9C%93&q=subt...
Holy crap, that code doesn't look good. I predict we will see more exploits for this project. Maybe we should stop random people from contributing to complex C projects?
That was my hope when C was just gaining market share outside UNIX, and here we stand now.
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#19Clearly VLC should be rewritten in Rust.
Looking at the bug fixes done in VLC, Ada or Modula-2 would be enough, although there are plenty of options actually.
Rust isn't the only alternative to write native code safer than C will ever allow.
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#20Slightly related to this: where can I find data sanitizers for common file formats (PDF, MP3 and so on)?