See also Perl::Visualize which allows you to run Perl code embedded in GIF image files (this module is hard to find because it's not in the Acme namespace) ... "a picture speaks a thousand words, now it can run".

GIF offers good possibilities for this sort of thing. Although Perl::Visualize doesn't seem to take advantage of this feature of the format, one interesting thing about GIF is that after the image data has finished, all subsequent contents of the file are ignored by renderers. Many image editors take advantage of this by allowing you to add a short textual "comment" to GIF images, but in fact, arbitrary binary data can be shoved there.

ZIP has even more potential for fun though. ZIP stores its "header" at the tail end of the file. This is a throwback to the world of floppy disks. Sometimes a ZIP file you were creating would span multiple disks, and the zip program would prompt you to insert disk after disk. Only after the final piece of compressed data had been written was the zip program actually able to build the header. Thus the header got written on the last disk (not the first), at the tail end of the file.

And so, you can actually add arbitrary data to the beginning of a ZIP file and it will be ignored when decompressing. (zip2exe tools take advantage of that.)

Assuming that foo.gif is a valid GIF file, and foo.zip is a valid ZIP file, then:

cat foo.gif foo.zip > foo.gif_zip

Will create a file that is both a valid GIF file and a valid ZIP file.

Similarly, if foo.pl is a Perl script that does not read from *DATA, then the following also works:

echo "__DATA__" > middle.txt && \
  cat foo.pl middle.txt foo.zip > foo.pl_zip && \
  rm middle.txt
[download]

Of course, it is also possible to write foo.pl so that it does read from *DATA and somehow uses the compressed data found there. Plenty of potential there.

Wow, I didn't know about this module.

I've made a similar polyglot of Perl and Windows Bitmap (BMP) image once. You can find it here: Re: [OT] Perl Code Embedded in an Image.

Comments and content-length limits of graphics formats and the like are sometimes used nefariously. In some web applications, you can easily upload a GIF file (or in others a file with the .gif extension which is assumed to be safe since it's that extension) but not something that looks like a PHP script (or not that has the .php extension in some cases).

Since GIF allows the trailing content and PHP passes data that's not within its tags through to output unchanged, some applications will be fooled into accepting GIF files with PHP inside which act as both GIF and PHP scripts. Then the other half of the attack is just to convince the system to treat it as PHP, which for the purposes of this post is left as an exercise.

+ +

Now, can we please have a version that works with WordStar?

Update: Deserved more formatting and bloat; got it

This dovetails nicely with this thread.