50 CVEs in 50 Days: Fuzzing Adobe Reader • Hacker News Board

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#171

Post by gpvos » Fri, Dec 14, 2018, 12:06 PM UTC

zubspace wrote: post #55

time-domain0 wrote: post #5

If you read the PDF spec from the late 90's, it is Stephen King novel-scary... container format, multiple encodings, encryption, embedded binaries, embedded JavaScript and more.

While working with the PDF format I sometimes get the impression that this complexity is what Adobe wants. As a result, Adobe Reader is the only viewer that implements the entire spec and can handle all (or most) quirks. This is especially apparent when trying to edit arbitrary PDF files, which is sometimes not so easy or even impossible. Just the definition of fonts and the text layout is already so complicated that…

Okay, apparently I totally didn't notice the release of PDF 2.0 a year ago, even though I was working a lot with PDFs at that time. Also, this new version is an ISO standard that costs 198 CHF to download, so I hereby predict that it is basically dead in the water, since few people will bother implementing it. The new features also don't seem very interesting, and from what I gather the spec is still backwards compatible despite the major version number increment.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#172

Post by grkvlt » Fri, Dec 14, 2018, 12:38 PM UTC

intertextuality wrote: post #141

da_chicken wrote: post #132

Earlier quoted context omitted.

Because OCR is expensive (to write as software and to process for the end user) and very error prone, especially if your text is anything other than a 12 point black font in on a white background with no formatting (italics, underlines, etc.). If my document's information is valuable, I'm not going to be willing to rely on the quality of my recipient's OCR software to get a digitally readable copy of my work. I mean,…

> Then again, I imagine it won't be long before someone mentions LaTeX as a viable alternative, even though the one thing LaTeX isn't is portable. But LaTeX is primarily popular in the tech community because it lets programmers pretend to write code Rude remarks notwithstanding, LaTeX and its ilk let you make PDFs, which are indeed portable. Setting up LaTeX is the same as setting up any other program, some of which…

dvi files are about as user hostile as it gets for a rendered document format, though

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#173

Post by tinus_hn » Sat, Dec 15, 2018, 10:07 AM UTC

tonyedgecombe wrote: post #166

BlackFingolfin wrote: post #133

Earlier quoted context omitted.

Just because something is XML doesn't mean it is "well-defined".

No, but XML parsing is a solved problem, PDF parsing isn't.

The original criticism was that some parts are just binary blobs encoded in XML elements, which wouldn’t suprise me at all, with Microsoft being allowed to tick the ‘XML file format’ checkbox and still getting to keep the binary format advantages.