From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Stefan Monnier Newsgroups: gmane.emacs.devel Subject: Re: C file recoginzed as image file Date: Fri, 05 Jan 2007 22:16:30 -0500 Message-ID: References: NNTP-Posting-Host: lo.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: sea.gmane.org 1168053421 4457 80.91.229.12 (6 Jan 2007 03:17:01 GMT) X-Complaints-To: usenet@sea.gmane.org NNTP-Posting-Date: Sat, 6 Jan 2007 03:17:01 +0000 (UTC) Cc: Chris Moore , c.a.rendle@gmail.com, emacs-devel@gnu.org Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Sat Jan 06 04:16:48 2007 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([199.232.76.165]) by lo.gmane.org with esmtp (Exim 4.50) id 1H3235-00040v-QC for ged-emacs-devel@m.gmane.org; Sat, 06 Jan 2007 04:16:48 +0100 Original-Received: from localhost ([127.0.0.1] helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1H3235-0005QY-6f for ged-emacs-devel@m.gmane.org; Fri, 05 Jan 2007 22:16:47 -0500 Original-Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1H322t-0005QT-6I for emacs-devel@gnu.org; Fri, 05 Jan 2007 22:16:35 -0500 Original-Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1H322q-0005QH-Us for emacs-devel@gnu.org; Fri, 05 Jan 2007 22:16:33 -0500 Original-Received: from [199.232.76.173] (helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1H322q-0005QE-Rz for emacs-devel@gnu.org; Fri, 05 Jan 2007 22:16:32 -0500 Original-Received: from [209.226.175.34] (helo=tomts13-srv.bellnexxia.net) by monty-python.gnu.org with esmtp (Exim 4.52) id 1H322p-0000Ws-L2; Fri, 05 Jan 2007 22:16:31 -0500 Original-Received: from pastel.home ([74.12.206.167]) by tomts13-srv.bellnexxia.net (InterMail vM.5.01.06.13 201-253-122-130-113-20050324) with ESMTP id <20070106031631.XDHZ1773.tomts13-srv.bellnexxia.net@pastel.home>; Fri, 5 Jan 2007 22:16:31 -0500 Original-Received: by pastel.home (Postfix, from userid 20848) id B114085AE; Fri, 5 Jan 2007 22:16:30 -0500 (EST) Original-To: rms@gnu.org In-Reply-To: (Richard Stallman's message of "Fri\, 05 Jan 2007 21\:55\:10 -0500") User-Agent: Gnus/5.11 (Gnus v5.11) Emacs/22.0.91 (gnu/linux) X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:64860 Archived-At: > I receive a file foo.c in an email, save it to disk and open it in > Emacs, knowing that the .c type is opened in cc-mode which is safe. > To my horror, the file actually contains an evil .jpg file which > causes a buffer overflow in the jpg library; when it's displayed it > infects my machine with a virus. > Compare that with this scenario: > You receive a file foo.jpg in an email, you save it to disk > and open it in Emacs, figuring that a jpg file ought to be safe. > To your horror, the file actually contains an evil .jpg file which > causes a buffer overflow in the jpg library; when it's displayed it > infects your machine with a virus. > Assuming there is such a bug in the jpg library, the latter scenario > seems much more likely than the former. No: there are known security holes in jpg libs, not in cc-mode. So when I receive mail from an unknown source and it has a jpg file in it, I'll think twice before opening the image. OTOH if it's a ".c" file, I'll feel confident that it's perfectly safe to open it. Such misleading file names have been used over and over again in w32 viruses. > Besides which, a jpg file starts with characters that don't make any > sense at the start of a C file. So if it looks like a plausible C > file, it won't be treated as a jpeg. But that assumes you've already been able to see the content of the file. Typically, this is not the case: you get an attachment called "foo.c" and you ask Emacs to display it to see this (supposedly) C code. Stefan