Previously (link to upstream announcement): https://news.ycombinator.com/item?id=26426816
No simultaneous source release, a call for users to run Linux benchmarks, and a mysterious tweet about 7Zip source code quality.
No simultaneous source release, a call for users to run Linux benchmarks, and a mysterious tweet about 7Zip source code quality.
p7zip has a number of known bugs easily found by fuzzing, as it hasn't seen updates for years. 7-zip in general is a tool that is written in C and supports lots of complex binary formats and thus has a huge attack surface for memory corruption bugs.
This is all pretty obvious with some basic knowledge of how these things work.
And a bit off-topic, but have you heard of (or maybe commented on) "Bring macOS Quick Look Feature to Windows"[0] aka "parse and preview everything"? Is it paranoia[1] to think "how we defend against parser exploits" should be part of the tool design?