Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twenty One Zero-Days in FFmpeg

depthfirst.com

Post reply on HN
Print view View original

111–120 of 216 posts

Re: Twenty One Zero-Days in FFmpeg

#111

Post by cubefox »

defrost wrote: post #99
ReactiveJelly wrote: post #94

Earlier quoted context omitted.

I think Chromium already does sandbox ffmpeg in the renderer process because of their "Rule of Two": https://chromium.googlesource.com/chromium/src/+/HEAD/docs/s... Thus: 1. Code which processes untrusted input 2. Code written in unsafe languages like C or C++ 3. Code that runs without a sandbox So ffmpeg should be sandboxed, same as the network code and GPU process are sandboxed.

I completely agree, with regard for the GP's point about Android TV's with onboard ffmpeg libraries and Addon Apps that call on said libraries (or pull in their own) .. Cheap arse low resource TVs should either include some form of sandboxing OR the entire device should be treated as a "can fall over" sandbox .. well isolated from any household LAN of consequence, etc. It seems unlikely that BoxStore Brand Android TV…

Am I getting this right, you expect TVs which are running Google TV (Android TV is the old name) to be less secure than TVs which are running a different operating system? I think the opposite is the case, because Google TV is developed by Google, which has a lot of experience with software security, while other TV operating systems are developed by companies which clearly don't have that experience.

Re: Twenty One Zero-Days in FFmpeg

#112

Post by plaguuuuuu »

pibaker wrote: post #87
oinoom wrote: post #68

Earlier quoted context omitted.

Funny, John Carmack was just admiring the creator of ffmpeg the other day for being a better programmer. https://x.com/id_aa_carmack/status/2064095424420487226?s=46

[flagged]

Can't help laughing at a random ad hominem against John Carmack of all people, and about his opinion on a guy who is already widely regarded as an especially talented programmer.

Re: Twenty One Zero-Days in FFmpeg

#113

Post by mjg59 »

oinoom wrote: post #68
zerobees wrote: post #19

Ffmpeg has an exceptionally terrible track record when it comes to security. People have been throwing fuzzers at it for as long as I remember and coming back with a nearly inexhaustible supply of memory corruption bugs. Here's an effort by one Googler a decade ago: https://security.googleblog.com/2014/01/ffmpeg-and-thousand-... So, while it's a demo of the capabilities of LLMs, this should not be at all surprising.…

Funny, John Carmack was just admiring the creator of ffmpeg the other day for being a better programmer. https://x.com/id_aa_carmack/status/2064095424420487226?s=46

The majority of code in ffmpeg today isn't written by Fabrice, but also there's multiple axes that people view programming ability on. Some people can write software that will do things you couldn't imagine given the constraints. Some people can write software that is resilient against all malformed input. Sometimes these people are the same people, but frequently they're not.

Re: Twenty One Zero-Days in FFmpeg

#114

Post by teravor »

zerobees wrote: post #19

Ffmpeg has an exceptionally terrible track record when it comes to security. People have been throwing fuzzers at it for as long as I remember and coming back with a nearly inexhaustible supply of memory corruption bugs. Here's an effort by one Googler a decade ago: https://security.googleblog.com/2014/01/ffmpeg-and-thousand-... So, while it's a demo of the capabilities of LLMs, this should not be at all surprising.…

while sandboxing ffmpeg directly isn't difficult, unfortunately with something like MPV/VLC that uses ffmpeg it's more challenging. until recently (virtio gpu native context) it wasn't even possible to sandbox a video player without losing all hardware acceleration. at least not from the outside, they could always try to sequester ffmpeg and seccomp it to hell like chromium.

Re: Twenty One Zero-Days in FFmpeg

#115

Post by defrost »

cubefox wrote: post #111
defrost wrote: post #99

Earlier quoted context omitted.

I completely agree, with regard for the GP's point about Android TV's with onboard ffmpeg libraries and Addon Apps that call on said libraries (or pull in their own) .. Cheap arse low resource TVs should either include some form of sandboxing OR the entire device should be treated as a "can fall over" sandbox .. well isolated from any household LAN of consequence, etc. It seems unlikely that BoxStore Brand Android TV…

Am I getting this right, you expect TVs which are running Google TV (Android TV is the old name) to be less secure than TVs which are running a different operating system? I think the opposite is the case, because Google TV is developed by Google, which has a lot of experience with software security, while other TV operating systems are developed by companies which clearly don't have that experience.

There are a lot of "Android like" TVs out there.

Re: Twenty One Zero-Days in FFmpeg

#116

Post by Thev00d00 »

rcbdev wrote: post #105
tkocmathla wrote: post #103

Earlier quoted context omitted.

What? https://github.com/apple

I genuinely didn't know about their OSS efforts, thanks!

I wouldn't go so far as efforts, so much as legally required publication of 3rd party code they use, or open wrappers to their proprietary libraries

Re: Twenty One Zero-Days in FFmpeg

#118

Post by HappMacDonald »

zerobees wrote: post #109
pibaker wrote: post #87

Earlier quoted context omitted.

[flagged]

I don't think that's fair. There's a lot of talent and grit behind ffmpeg. But for better or worse, getting the code to do what it's supposed to do requires a different mindset than getting it to not do anything else (i.e., to handle malicious inputs correctly). The developers of ffmpeg are very good at the first thing and not very good at the second. But few people on this planet, if instructed to write a complex vi…

So all I am hearing is.. Rust

Re: Twenty One Zero-Days in FFmpeg

#119

Post by Sesse__ »

harrall wrote: post #86
hugmynutus wrote: post #77

Earlier quoted context omitted.

GStreamer is just a different front end to ffmpeg. ffmpeg's core functionality (encode, decode, streams, pipes, channels) are all implemented in `libav` which gstreamer links against.

GStreamer doesn’t use ffmpeg’s pipeline at all. It implements a much more advanced directed graph with disconnect, connection and pad negotiation. You can dynamically swap out the entire filter graph during live playback with zero disruption. Swap feeds, outputs, effects… all at runtime. ffmpeg and other media frameworks (Windows Media Foundation, Apple’s AVFramwork) only support static pipelines. You can use “switch…

> ffmpeg and other media frameworks (Windows Media Foundation, Apple’s AVFramwork) only support static pipelines.

FFmpeg doesn't do “pipelines”. It's a library, not a framework.

Post reply on HN