Attacking the Samsung Galaxy A* Boot Chain

> Samsung added a custom JPEG parser in Little Kernel that is used to show logos and error messages while booting. The code responsible for loading the JPEG file will place it in a fixed-size structure on the heap. But it never checks the size of the file, causing a heap overflow.

Heh, file format parsers - the GIFt that just keeps on giving

Are Samsungs "contributions" to LK public? Has nobody reviewed those until now?

The early bootchain components are critical to the security of the device. I am extremly surprised Samsung let a complete noob add code to it.

So I guess this is where widevine keys and whatnot are stored? Perhaps this is how the piracy scene gets 4k rips.