Uma exhashazwa, lawa maphutha angavumela abahlaseli ukuthi bathole ukufinyelela okungagunyaziwe kulwazi olubucayi noma ngokuvamile babangele izinkinga.
Kukhishwe imininingwane mayelana ukuba sengozini (esivele ifakwe kukhathalogi ngaphansi kwe-CVE-2023-21036) ikhonjiwe kuhlelo lokusebenza lwe-Markup kusetshenziswe Smartphones I-Google Pixel ukuze unqampune futhi uhlele izithombe-skrini, okuvumela ukubuyisela ingxenye yolwazi olusikiwe noma oluhleliwe.
Onjiniyela USimon Aarons noDavid Buchanan, abathole isiphazamisi futhi bakhiqiza ithuluzi ukululama kwe ubufakazi beConcept, ngokulandelana, bayibiza ngokuthi i-Cropalypse futhi yaphawula ukuthi "le bug yimbi" kubantu abathintekayo mayelana nobumfihlo babo.
Lokho kusho ukuthi uma othile ebamba isithombe sakho esinqanyuliwe, angazama ukuthola ingxenye eshodayo. Uma isithombe sakhiwe kabusha ngemibhalo ezindaweni ezithile, lezo zindawo zingase zibonakale esithombeni esibuyiselwe. Lokhu akulungile kubumfihlo.
Inkinga ibonakala lapho uhlela izithombe ze-PNG ku-Markup futhi kubangelwa ukuthi uma isithombe esisha esilungisiwe sibhalwa, idatha ibekwe phezulu efayeleni langaphambilini ngaphandle kokuncishiswa, okungukuthi, ifayela lokugcina elitholwe ngemva kokuhlelwa lihlanganisa umsila wefayela lomthombo, lapho idatha ihlala khona. idatha ecindezelwe.
Inkinga Kubhekwa njengento esengozini. njengoba umsebenzisi angathumela isithombe esihleliwe ngemva kokukhipha idatha ebucayi, kodwa empeleni le datha ihlala kufayela, nakuba ingabonakali ngesikhathi sokubuka okuvamile. Ukuze kubuyiselwe idatha esele, isevisi yewebhu ye-acropalypse.app yaqalwa futhi isibonelo se-Python script sashicilelwa.
Ubungozi bulokhu bubonakala kusukela ochungechungeni lwe-Google Pixel 3 lwama-smartphones wethulwa ngo-2018 kusetshenziswa i-firmware esekelwe ku-Android 10 nezinguqulo ezintsha. Inkinga yalungiswa kusibuyekezo se-firmware sikaMashi se-Android sama-smartphones e-Pixel.
“Umphumela wukuthi ifayela lesithombe livulwa ngaphandle kwefulegi [elincishisiwe], ukuze kuthi uma kubhalwa isithombe esisikiwe, isithombe sokuqala singancishisiwe,” kusho uBuchanan. "Uma ifayela lesithombe esisha lilincane, isiphetho sesoqobo sisala ngemuva."
Izingcezu zefayela obekumele zincishiswe zitholwe zingatholakala njengezithombe ngemuva kokwenza ubunjiniyela obuhlehlayo bendlela ye-zlib compression library, uBuchahan athi ukwazile ukuyenza "ngemuva kwamahora ambalwa edlala." Umphumela uwubufakazi bomqondo wokuthi noma ubani onedivayisi ye-Pixel ethintekile angazihlola yena.
Kukholelwa ukuthi inkinga ingenxa yoshintsho lokuziphatha olungabhaliwe lwendlela ye-ParcelFileDescriptor.parseMode() , lapho, ngaphambi kokukhishwa kwenkundla ye-Android 10, ifulegi elithi "w" (bhala). ibangele ukuthi ifayela lincishiswe ngenkathi izama ukubhalela ifayela eselivele likhona, kodwa kusukela ekukhishweni kwe-Android 10, ukuziphatha kwashintsha futhi ukuze kuncishiswe kwakudingeka ukuthi kucaciswe ngokusobala ifulegi elithi "wt" (bhala, nciphisa) futhi lapho ifulegi elithi "w" licacisiwe, ulayini awubange usasuswa ngemva kokubhalwa kabusha. .
Ngamafuphi, iphutha elithi "aCropalypse" livumele othile ukuthi athathe isithombe-skrini esinqanyuliwe se-PNG ku-Markup futhi ahlehlise okungenani okunye ukuhlelwa kwesithombe. Kulula ukucabanga ngezimo lapho umlingisi omubi angasebenzisa kabi lelo khono. Isibonelo, uma umnikazi we-Pixel esebenzisa i-Markup ukuze ahlele kabusha isithombe esifaka phakathi ulwazi olubucayi olumayelana naye, othile angase asebenzise iphutha ukuze adalule lolo lwazi.
Kuyafaneleka ukusho lokho I-Google ikhiphe i-Cropalypse kuzo Izibuyekezo zokuphepha ze-Pixel zikaMashi (ngaphambi nje kokuthi kukhishwe imininingwane yokuba sengozini):
Konke kuhamba kahle futhi kuhle esikhathini esizayo: manje ungakwazi ukunqampuna, uhlele kabusha, futhi wabelane ngaphandle kokwesaba ukuthi izithombe zakho zesikhathi esizayo zingase zibuyiswe, kodwa azikho izithombe-skrini ezingabiwe ezisengozini yokuxhashazwa esezidlulile, zilayishwe ku-Discord, njll.
Okokugcina uma unentshisekelo yokwazi kabanzi ngakho mayelana nokuba sengozini, ungathintana nokushicilelwe kwasekuqaleni kokuthi isixhumanisi esilandelayo.