1
$\begingroup$

Lets assume I'm talking about Jpeg and Mp4 and a general video player(not sure if different ones load it differently, if they do please tell)

So do video players (process) usually load the entire Jpeg or Mp4 including metadata into its own memory space right? like lets say we have a 1920x1080 picture with 10 bytes of metadata, does the picture viewer's process loads this into its own heap or maybe stack? and does it read it sequentially in order to display it?

I'm asking this because i want to know what stops criminals to for example inject some part of a video or picture with malware, lets say 10 malicious instructions are hidden in that file in a frame of a video or part of a picture, what stops the operating system with no good anti virus from executing these malicious instructions?

| cite | improve this question | |
$\endgroup$
  • $\begingroup$ There are exploits based on pictures and videos. $\endgroup$ – Yuval Filmus Sep 28 '18 at 6:59
  • $\begingroup$ @YuvalFilmus i just want to know how they are usually loaded in the process's memory space and what will happen if i inject some part of a video/picture with malicious instructions? will the instructions be executed or what stops it from happening? $\endgroup$ – John P Sep 28 '18 at 7:00
  • $\begingroup$ This probably depends on the piece of software, but large files are probably loaded in chunks rather than all at once. $\endgroup$ – Yuval Filmus Sep 28 '18 at 7:01
  • 1
    $\begingroup$ See this: security.stackexchange.com/questions/97856/…. It seems your question is more suitable to that stackexchange. $\endgroup$ – Yuval Filmus Sep 28 '18 at 7:05
  • 1
    $\begingroup$ What a particular piece of software does is entirely up to the author of that software. While there are probably patterns that are common to most pieces of software that perform some function, that's just because it's the most natural thing to do. You can't assume that every video player behaves in the same way. $\endgroup$ – David Richerby Sep 28 '18 at 11:18
2
$\begingroup$

Just having malicious instructions loaded into memory is not a problem in itself. Instructions (code) is just binary, so it might be stored in the data segment.

Where it becomes a problem is if something causes that code to be executed. It's not clear why a video player would jump to data inside an image. If it had a security vulnerability, that could happen, but if it has a vulnerability, almost by definition bad things could happen, so that's not really saying much.

| cite | improve this answer | |
$\endgroup$

Not the answer you're looking for? Browse other questions tagged or ask your own question.