Eliminates a class of zero-click exploits. No format breakage. No patching.
https://jam2we5b3a.medium.com/this-is-the-future-apple-should-already-be-shipping-054c69d78e50
Eliminates a class of zero-click exploits. No format breakage. No patching.
https://jam2we5b3a.medium.com/this-is-the-future-apple-should-already-be-shipping-054c69d78e50
If validating media integrity is as simple as checking a few bytes in the header, the decoder could already do that on its own.
Presumably there are attacks in media that look valid but cause subtle decoding bugs that then escalate into more serious things. How would this proposal catch those without an in depth understanding of each codec and version's possible failure modes, per operating system and hardware combo? The people who typically know that the best are already on decoder or security teams, and this just moves their work to a separate project where they'd have to integrate their checks and preventive measures alongside every other format's. Seems like a lot of work?
Can’t decoders already do this themselves? Theoretically yes — but in practice, media decoders are huge, legacy-tangled, performance-optimized, and frequently cross-platform. Asking each one to reliably gate input based on structural sanity is like asking libc to do bounds-checking. Sandboxes help, but they’re coarse — we’re talking about a clean, minimal contract: don’t decode unless the container structure is provably valid. It’s the same logic behind memory-safe preprocessing layers.
What about subtle decoder bugs in seemingly valid media? True — this doesn’t solve all decoder vulnerabilities. But it dramatically cuts risk by stripping malformed, truncated, recursive, or structurally deviant files before they reach the decoder logic. You can’t prevent every logic bug in a decoder, but you can gate execution to files that pass structural integrity — just like we gate executable code through signing and entitlement checks.
Thanks for the thoughtful reply!
Jamweba
jamweba•9mo ago
This write-up outlines a minimal architectural fix: a structural validator that intercepts files before decoding begins.
Curious what others think: Why hasn’t this already been adopted? Would Apple (or anyone) ship it?