A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby(projectzero.google)
26 pointsby el_duderino6 hours ago1 comment
  • amatecha4 hours ago
    > The UDC is integrated into a variety of hardware and platforms, including Android, iOS, Windows and media streaming devices. It is shipped to most OEMs as a binary ‘blob’ with limited symbols, which is then statically linked into a shared library.

    Does that suggest this is a vulnerability on other platforms as well?

    • ronsor3 hours ago
      The article claims iOS/macOS is likely not vulnerable. I'm not sure about Windows.
      • adrian_b7 minutes ago
        It should be noted that iOS/macOS is likely to be not vulnerable because for them the Dolby decoder has been compiled as any C/C++ program should be compiled by default everywhere, i.e. with bounds checking enabled.

        Unfortunately, all C/C++ compilers have as the default option to omit bounds checking, but any decent compiler has options for enabling bounds checking and other run-time checks suitable for catching all the undesirable behaviors that are undefined in the C/C++ standards. The default should be to enable such options globally for any program and to disable them selectively only for the code parts where benchmarks have demonstrated that they prevent the program to reach the target performance and code analysis has concluded that the erroneous behavior cannot happen.