So the decoder has to assume that any part of the encoded data could have been constructed maliciously by an attacker in order to trigger a bug in the decoder – which is often a complex piece of software.įor example, many image formats start by telling the decoder how wide and high the image is, and how many bytes are used to store each pixel, in order to help the decoder allocate the right amount of memory for the image once it’s unpacked.īut what if the data stored in the image doesn’t match the data that follows, and the decoder ends up reading in more pixel data than it allocated space for? The decoder generally doesn’t have any control over the original encoding process, because files received from outside will have been encoded by someone else, somewhere else, using encoding software entirely of their own choice. The security challenge here is that the -dec part of any codec – for example, the software that converts JPG files that are downloaded as part of a web page so your browser can display them – can’t blindly assume that the co- part of the process was trustworthy.

The -dec part does the reverse at the other end, reading in the file, decompressing it (most images and videos are compressed for transmission because this saves an enormous amount of bandwidth) and getting it back into its raw form so it can be displayed. The co- part of a codec takes something like a raw image, consisting of rows and rows of colour pixels, and wraps it up in a format such as JPG or PNG so it can saved into a file for downloading or streaming. Well, codec is short for encoder-decoder, and it’s the jargon term for the sort of software that takes data of some sort – notably the raw data that represents the pixels in a video or the sound in an audio file – and reworks it so it can be sent and received easily. Microsoft has just released emergency patches for two critical security holes in the Windows Codecs Library.īut what is a Codecs Library, and why are bugs in it such as a big deal that they need to be updated without waiting for the next Patch Tuesday to come round?

Microsoft fix it codec tool