FFmpeg and a thousand fixes
googleonlinesecurity.blogspot.com
FFmpeg and a thousand fixes
1–10 of 150 posts
Re: FFmpeg and a thousand fixes
#2It is interesting that YouTube isn't mentioned in this blogpost, despite there being good evidence that ffmpeg has been used there[1].
The fuzz testing they mention is based around constructing malformed (or at least "exotic") input files and then monitoring for failures... ie simulating exactly the kind of attack someone might use against YouTube's transcoding infrastructure.
Re: FFmpeg and a thousand fixes
#3Interesting that they are pushing fixes for both FFmpeg and the libav fork. I guess they decided not to pick sides in that war.
Re: FFmpeg and a thousand fixes
#4I get a kick out of the fact that they recommend not using FFMPEG but they say that Chrome uses it.
Re: FFmpeg and a thousand fixes
#5This is cool. I wonder how many of the bugs led to code execution?
If you managed to execute code, what privileges do you have in Chrome? I hope that Chrome was using OS sandboxing for video playing. After all, if they found 1000 bugs, there are probably a few more zero day's available.
Does playing Flash video in Chrome/Firefox end up using ffmpeg? I'm not that knowledgeable about how video works, but there are probably at least two execution contexts: playing .mp4 natively in Chrome, or playing it via a Flash container.
Re: FFmpeg and a thousand fixes
#6Once again I am happy that ‘Segmentation fault. Core dumped.’ is a perfectly reasonable reaction to malformed user input in my field of work, which only increases my respect for those who write real-world software. Thanks! :)
Re: FFmpeg and a thousand fixes
#7I get a kick out of the fact that they recommend not using FFMPEG but they say that Chrome uses it.
> I get a kick out of the fact that they recommend not using FFMPEG
More specifically Google is recommending you don't use it to "process untrusted media files"
Re: FFmpeg and a thousand fixes
#8I get a kick out of the fact that they recommend not using FFMPEG but they say that Chrome uses it.
They aren't just flat out not recommending using FFmpeg, just that you need to take appropriate measures when dealing with untrusted media sources.
Re: FFmpeg and a thousand fixes
#9This is cool. I wonder how many of the bugs led to code execution? If you managed to execute code, what privileges do you have in Chrome? I hope that Chrome was using OS sandboxing for video playing. After all, if they found 1000 bugs, there are probably a few more zero day's available. Does playing Flash video in Chrome/Firefox end up using ffmpeg? I'm not that knowledgeable about how video works, but there are prob…
Playing .mp4's natively uses FFmpeg, but Flash video does not. Both plugins are sandboxed in a "privilege separation" environment that they mention in the post.
Re: FFmpeg and a thousand fixes
#10This is cool. I wonder how many of the bugs led to code execution? If you managed to execute code, what privileges do you have in Chrome? I hope that Chrome was using OS sandboxing for video playing. After all, if they found 1000 bugs, there are probably a few more zero day's available. Does playing Flash video in Chrome/Firefox end up using ffmpeg? I'm not that knowledgeable about how video works, but there are prob…
> I wonder how many of the bugs led to code execution?
Quite a few. We're often affected with VLC, and code execution is easy to get to. But with VLC, you're "only" in userland.