# Signal for Android Attachment Bug

DevFeed: [Signal for Android Attachment Bug](<https://devfeed.tech/articles/signal-for-android-attachment-bug-1824.md>)

Original publisher: [Read original article](<https://signal.org/blog/signal-android-attachment-bug/>)

Published: 2016-09-20T00:00:00Z

Content type: article

Language: en

Sources: [Signal Blog](<https://devfeed.tech/sources/signal-blog.md>)

Topics: [bug](<https://devfeed.tech/topics/bug.md>), [LineageOS](<https://devfeed.tech/topics/lineageos.md>), [App](<https://devfeed.tech/topics/app.md>), [Code](<https://devfeed.tech/topics/code.md>)

Tags: [android](<https://devfeed.tech/tags/android.md>), [app](<https://devfeed.tech/tags/app.md>), [audio](<https://devfeed.tech/tags/audio.md>), [bug](<https://devfeed.tech/tags/bug.md>), [code](<https://devfeed.tech/tags/code.md>), [cryptographic](<https://devfeed.tech/tags/cryptographic.md>), [hack](<https://devfeed.tech/tags/hack.md>), [image](<https://devfeed.tech/tags/image.md>), [update](<https://devfeed.tech/tags/update.md>), [video](<https://devfeed.tech/tags/video.md>)

## AI overview

Signal for Android had a bug in its processing of image, audio, and video attachments. A 32-bit attachment-length calculation could wrap around for attachments larger than 4 GB, allowing an attacker who had compromised the Signal server to append data without detection. Signal released an Android app update to address the issue, which it assessed as low risk to users.

## Source excerpt

We recently received a great bug report from Jean-Philippe Aumasson and Markus Vervier, who identified a problem with the way that image, audio, and video attachments are processed by the Signal for Android code. We consider the implications of the bug to be low risk to Signal users, but have released an update for the Signal Android app that addresses the problems they reported. Read more...