News for hackers. Stuff that matters.

A comment on Plain Text Doesn’t Exist: Unicode and encodings demystified. Parent comment

Re:Plain Text Doesn’t Exist: Unicode and encodings demystified by zokier on Monday August 26, 2013 @10:03AM (#6277071)
> The flip side of this is that there is such a thing as invalid UTF-8, i.e. a sequence of bytes that does not form a sequence of valid code units and so cannot be decoded as UTF-8.

In what sort of situation that is a problem?

[ Parent | on HN ]
Re:Plain Text Doesn’t Exist: Unicode and encodings demystified by millstone on Monday August 26, 2013 @01:04PM (#6278275)
It can allow for security exploits, if the different layers of your stack handle invalid code units differently.

There's a related issue with "non-shortest forms:" it's possible to encode the NUL character '\0' without actually using a null byte. This means that (for example) "round tripping" UTF-8 data can introduce a null byte, allowing for security exploits when mixed with C-style string processing.

[ Parent | on HN ]