Hacker News Reader

> recent WebP vulnerability

For anyone wondering:

https://blog.cloudflare.com/uncovering-the-hidden-webp-vulne...

> The vulnerability allows an attacker to create a malformed WebP image file that makes libwebp write data beyond the buffer memory allocated to the image decoder. By writing past the legal bounds of the buffer, it is possible to modify sensitive data in memory, eventually leading to execution of the attacker's code.

View on HN

I'm not the sharpest tool in the shed just learning python right now can the wizards explain how this would work? Isn't data stored in memory super random so the attacker would need to upload an image multiple times to get sensitive data? Or does the webp image itself have code that will be run and can retrieve the data?

Generally with a buffer overrun, you're trying to put executable code in, and get it to a spot where it'll be run, allowing you to do further stuff.

Here is a canonical old article on one type of buffer overflow:

http://www.phrack.org/issues/49/14.html#article

(The webp one, iirc, is not a stack buffer overflow, but rather a heap, but that'll give you a general sense of what's going on, even if that article is a bit ... dated)

Reply on news.ycombinator.com