[FFmpeg-cvslog] r12241 - trunk/libavformat/mov.c

[Reimar Döffinger]

On Wed, Feb 27, 2008 at 12:33:08PM +0100, Baptiste Coudurier wrote:
> Now Im curious, considering mov layout and libavformat mechanisms, what
> would you expect to leak or read, besides what the user application is
> allowed to read anyway (url_fopen suceeds), and what would be different
> than garbage from a genuine self-contained file.

Do you really not get the point? You code allows the _container_ to
cause a read, outside of any and all control of the _application_.
But ok, let us consider yet another scenario:
A user has a file that contains a normal audio and video stream, which
the user regularly watches.
In addition, the file contains a extra audio stream that is reference to
http://someplace.com/specialaudio.mov.
Also consider the user is not in the middle of a modern country, but
instead has dialup with a (for his location rather cheap) 1c/min
internet dialup connection.
With your current code, upon playing the file, ffplay will now open an
internet connection, which in addition to making the file play really
slow will cause the user costs of 1c for each minute he watches the
video although he has no benefit at all and no reason to suspect
anything (unless the modem makes audible sounds).
Now I admit it is a rather stupid user for running auto-dialin on such a
costy line, but I personally felt forced to do such setups for a
company that could not get broadband at their location (and this is
southern Germany, not some remote location), they would have been able
to afford the connection running through a few days, but it would have
been a waste of money still.