FFmpeg dealing with a security researcher

Post by FINDarkside » Wed, Nov 05, 2025, 2:11 AM UTC

estimator7292 wrote: post #112

ndiddy wrote: post #110

Earlier quoted context omitted.

My point of view is that the unpaid ffmpeg maintainers should stop playing along with the corporate "security researchers" and not prioritize a bug over everything else simply because it's a CVE. In this case, the "high priority CVE" is from a reverse-engineered codec a hobbyist wrote to decode video from 1990s LucasArts video games. I think it's unreasonable to expect the maintainers to drop everything to fix a bug…

You're completely missing the point. The problem isn't that volunteer devs are harassed into work. The problem is being harassed . Whether or not you "care" or feel the need to do any work or accept responsibility, constant harassment will destroy anyone , even you.

Post by jsnell » Tue, Nov 11, 2025, 8:06 PM UTC

godelski wrote: post #166

bawolff wrote: post #142

Earlier quoted context omitted.

> Not to mention they just have a vested interest in getting the problem solved. Even if we don't talk about money. Correct me if im wrong, but based on the report this looks like something that would affect regular users of ffmpeg but not google's use.

FWIW I tried replicating it and didn't get the same result. I end up with a failed conversion, exit code 69[0]. Same thing when I run with my installed version of ffmpeg. But I think Google would still be concerned. Even if they're running ffmpeg in a sandbox you can escape sandboxes. The sandbox is a security layer, not what makes the thing safe. You should be using it as a layer of defense for unknown vulns, and tr…