I get a kick out of the fact that they recommend not using FFMPEG but they say that Chrome uses it.
[deleted]
FFmpeg and a thousand fixes
11–20 of 150 posts
Re: FFmpeg and a thousand fixes
#12This is cool. I wonder how many of the bugs led to code execution? If you managed to execute code, what privileges do you have in Chrome? I hope that Chrome was using OS sandboxing for video playing. After all, if they found 1000 bugs, there are probably a few more zero day's available. Does playing Flash video in Chrome/Firefox end up using ffmpeg? I'm not that knowledgeable about how video works, but there are prob…
> I wonder how many of the bugs led to code execution? Quite a few. We're often affected with VLC, and code execution is easy to get to. But with VLC, you're "only" in userland.
In other words, you're "only" dealing with a bug that would allow anything you downloaded from BitTorrent to own up your personal account on your computer. :)
(I know you know that, I'm just spelling it out for people).
Re: FFmpeg and a thousand fixes
#13Interesting that they are pushing fixes for both FFmpeg and the libav fork. I guess they decided not to pick sides in that war.
That is good. But this reminds me of the first time I installed 'ffmpeg' on Ubuntu only to have it not work with my well-tested parameters and also declare ffmpeg 'deprecated'. Only after some head scratching did I figure out it had installed libav and an ffmpeg wrapper that tried but failed to be compatible with the real ffmpeg interface.
I wasn't even aware of the split at the time, but this shenanigan definitely gave me a strong negative initial impression of libav.
Re: FFmpeg and a thousand fixes
#14This is cool. I wonder how many of the bugs led to code execution? If you managed to execute code, what privileges do you have in Chrome? I hope that Chrome was using OS sandboxing for video playing. After all, if they found 1000 bugs, there are probably a few more zero day's available. Does playing Flash video in Chrome/Firefox end up using ffmpeg? I'm not that knowledgeable about how video works, but there are prob…
> I wonder how many of the bugs led to code execution?
The linked blog article [1] suggests 10% - 20%:
Our personal feeling is that between 10% and 20% of the
problems could be considered easily exploitable security
issues; however, the estimation has not been formally
confirmed in any way.
Re: FFmpeg and a thousand fixes
#15Interesting that they are pushing fixes for both FFmpeg and the libav fork. I guess they decided not to pick sides in that war.
That is good. But this reminds me of the first time I installed 'ffmpeg' on Ubuntu only to have it not work with my well-tested parameters and also declare ffmpeg 'deprecated'. Only after some head scratching did I figure out it had installed libav and an ffmpeg wrapper that tried but failed to be compatible with the real ffmpeg interface. I wasn't even aware of the split at the time, but this shenanigan definitely g…
libav tries to ship a compatible wrapper called ffmpeg and a redone one called avconv. But ffmpeg itself just ships ffmpeg and puts incompatible changes in there, so you'd actually be worse off.
What issues were you having, and with what file types?
Re: FFmpeg and a thousand fixes
#16Interesting that they are pushing fixes for both FFmpeg and the libav fork. I guess they decided not to pick sides in that war.
That is good. But this reminds me of the first time I installed 'ffmpeg' on Ubuntu only to have it not work with my well-tested parameters and also declare ffmpeg 'deprecated'. Only after some head scratching did I figure out it had installed libav and an ffmpeg wrapper that tried but failed to be compatible with the real ffmpeg interface. I wasn't even aware of the split at the time, but this shenanigan definitely g…
For sure. The story of FFmpeg and libav is full of sneaky shenanigans like that.
Re: FFmpeg and a thousand fixes
#17Earlier quoted context omitted.
That is good. But this reminds me of the first time I installed 'ffmpeg' on Ubuntu only to have it not work with my well-tested parameters and also declare ffmpeg 'deprecated'. Only after some head scratching did I figure out it had installed libav and an ffmpeg wrapper that tried but failed to be compatible with the real ffmpeg interface. I wasn't even aware of the split at the time, but this shenanigan definitely g…
libav tries to ship a compatible wrapper called ffmpeg and a redone one called avconv. But ffmpeg itself just ships ffmpeg and puts incompatible changes in there, so you'd actually be worse off. What issues were you having, and with what file types?
Incompatible? Do you mean with libav?
Re: FFmpeg and a thousand fixes
#18I get a kick out of the fact that they recommend not using FFMPEG but they say that Chrome uses it.
Chrome is probably using a subset that represents 2% of FFMpeg. I'd guess they have thoroughly audited the code paths that are actually used to decode about 10 media different that chrome supports.
For instance, one fix mentioned was a fix the demuxer for .4xm files. 4xm is a proprietary container format for a now defunct company. Chrome would never have to worry about this bug, because it doesn't need to support playback of .4xm files.
Re: FFmpeg and a thousand fixes
#19Earlier quoted context omitted.
That is good. But this reminds me of the first time I installed 'ffmpeg' on Ubuntu only to have it not work with my well-tested parameters and also declare ffmpeg 'deprecated'. Only after some head scratching did I figure out it had installed libav and an ffmpeg wrapper that tried but failed to be compatible with the real ffmpeg interface. I wasn't even aware of the split at the time, but this shenanigan definitely g…
For sure. The story of FFmpeg and libav is full of sneaky shenanigans like that.
A good entry on this, for those interested: http://blog.pkh.me/p/13-the-ffmpeg-libav-situation.html
Re: FFmpeg and a thousand fixes
#20This must be one of the reasons it seems like there's a new update to VLC every time I launch it...