From https://twitter.com/David3141593/status/1636979466860744704
Also: you [can] do a basic check with tools like exiftool - it will report "Warning: [minor] Trailer data after PNG IEND chunk" on vulnerable images.
From: https://twitter.com/David3141593/status/1636981307891671041
They should be doing a “mktemp; write; sync; rename”, which atomically and durably replaces the file in most linux file systems.
There might also be an exploitable race where you overwrite the file in place while it is being parsed, leading to undefined behavior in applications attempting to read the file.
Hyperbole like this is unhelpful. The reporter didn't think of it as a security bug, and the discussion in the bug itself is about API compatibility and documentation concerns.
Pretending in hindsight that we're all too smart to have ever missed this isn't helping software quality for anyone, and good postmortem analysis doesn't throw around words like "unforgivable".
Yeah I always do the same and I'm happy to see I'm not the only one. And a CVE like these shows that we're the ones "not seeing things".
1. Using the cropping tool given when taking the screenshot (using the Markup tool in any other way does not work for me)
2. You have to crop at least 2 sides
Also, I'm not able to recover the rest of the image once it is put through Discord.
Ah, one commenter offered this:
"It looks like when the edits make the PNG smaller it saves the original number of bytes, overflowing its own buffer and leaving a bunch of unintended IDAT chunks to find :). Did you talk to Google about this before taking to twitter though?"
https://twitter.com/Bottersnike237/status/163689272301266534...
This thread provides a good overview and some sample images https://mastodon.delroth.net/@delroth/110043776803548821
