[FFmpeg-devel] Security issues?

Michael Niedermayer michaelni
Wed Sep 23 11:33:33 CEST 2009

On Tue, Sep 22, 2009 at 08:09:08PM +0200, Michael Niedermayer wrote:
> Hi
> lars has mailed me the following 2 links
> http://www.heise.de/newsticker/Sicherheitsluecken-in-VLC-und-FFmpeg--/meldung/145655
> http://secunia.com/advisories/36805/

next is for mov:


this probably isnt security relevant but still should be fixed
issue is that 32bits are read into an (signed) int and thus one can
end with a negative time_scale, chromes patch looks wrong
changing time_scale to unsigned seems the solution at first but its
assigned to sample_rate and time_base which themselfs are signed ...

Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Thouse who are best at talking, realize last or never when they are wrong.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
URL: <http://lists.mplayerhq.hu/pipermail/ffmpeg-devel/attachments/20090923/b1af734b/attachment.pgp>

More information about the ffmpeg-devel mailing list