Hacker News

points by lirolero 1 day ago | 0 comments

Genuine question, since I'm not very knowledgeable about this: why is using C for a PDF tool such a bad idea?

File formats are the buffer issue honeypot. You may be aware of how often video and audio codecs have vulnerabilities - it's nearly never the hand-tuned frame decode assembly (where you would think all the mistakes would be). It's nearly always the thing that reads the metadata and encoded frames to memory. Binary formats have things like offsets in them, and those can be trivially used to overrun.

Same thing applies here. Even Rust has a crate for dealing with binary data, despite its memory promises: https://crates.io/crates/untrusted

It's a fucking minefield, and this is one area where the Rust zealots are undeniably correct. It doesn't have to be Rust, any memory safe language will do, but Rust also happens to be performance competitive and that's usually also desirable.

[–] tialaramex 1 day ago

The technology you want for this sort of work is WUFFS, for Wrangling Untrusted File Formats Safely.

Rust is a general purpose programming language, which is great if your problem might be something never imagined before, but this literally isn't our first rodeo, we have wrangled lots of file formats before, we should use a language purpose-built to do that safely.

[–] zamalek 1 day ago

> Rust is a general purpose programming language

I don't understand how I hit the anti-Rust tripwire here:

> My comment: any memory safe language will do

[–] tialaramex 1 day ago

Not an anti-Rust tripwire. Just that WUFFS is the appropriate technology.

I like 4th edition D&D but if you're trying to make a story about nuanced inter-personal conflict in which there's no actual violence it's just not the right roleplaying system and so I'm not going to agree with your choice to recommend 4eD&D as the system for the story "Love and Jealousy in the Elven Forest"

I've written a whole bunch of Rust, and hardly any WUFFS - but, I wasn't writing code for Wrangling Untrusted File Formats and that's very much what you're doing in a PDF parser.

[–] jeffbee 1 day ago

I am a big fan of WUFFS but some recent developments by people assisted by AIs writing format parsers in other languages has made me question whether it will be maintained or forgotten.

[–] tptacek 1 day ago

I think the claim is hyperbolic, since most people memory-unsafe PDF implementations, but PDF is a monster format, a metaformat that brings in virtually every conceivable display format, and their renderer implementations with them, often poorly-maintained, never-touched reference implementations from the before times. PDF is pretty scary.

[–] DonHopkins 10 hours ago

Plus the PDF file name extension has been co-opted as a censorship-safe shorthand for Donald Trump and the Epstein Class he's protecting. Adobe must be totally pissed off about that.

You're right, PDFs are horrible scary monsters who you should never trust.

[–] cowlevel 1 day ago

PDFs are usually untrusted input and C provides no assurance there isn't a bug in the code that allows corrupted input to turn into arbitrary remote code execution.

[–] F3nd0 1 day ago

Other than Ada/SPARK, which languages can guarantee this won’t happen?

[–] tialaramex 1 day ago

This trivially can't happen in WUFFS. Forget RCE, WUFFS can't even do a traditional Hello World program because (1) you can't do I/O in WUFFS and (2) the language doesn't have strings.

https://github.com/google/wuffs

[–] cowlevel 1 day ago

Very few languages can prevent you writing something like "if(text == "shibboleth") rootshell();" but most languages don't make it trivial to write accidentally.

[–] mahemm 11 hours ago

Pretty much any memory managed language? Java, Go, Rust, Python, pretty much anything other than C/C++ these days is memory safe for security purposes.

[–] recursive 1 day ago

buffer overflow vulnerability in code dealing with user generated data and a complex file format.