[FFmpeg-cvslog] r12241 - trunk/libavformat/mov.c

[Benoit Fouet]

Baptiste Coudurier wrote:
> Reimar D?ffinger wrote:
>   
>> On Wed, Feb 27, 2008 at 12:33:08PM +0100, Baptiste Coudurier wrote:
>>     
>>> Now Im curious, considering mov layout and libavformat mechanisms, what
>>> would you expect to leak or read, besides what the user application is
>>> allowed to read anyway (url_fopen suceeds), and what would be different
>>> than garbage from a genuine self-contained file.
>>>       
>> Do you really not get the point? You code allows the _container_ to
>> cause a read, outside of any and all control of the _application_.
>>     
>
> What's so different from playlist files accessing both http
> streams/network devices and local files ? Except that playlist file
> might be human readable.
>
>   

don't you think this is a huge diff?rence ?

> Again, if you want a feature to explicitly disable external refs, this
> can be possible, or disable by default and explicitly enable, this can
> also be discussed. I'm in favor of enabling by default like you can see,
> but I won't oppose to the majority.
> Adding control is a good thing, yes.
>
>   

i agree here, and i would vote for disabling it by default.

-- 
Benoit Fouet
Purple Labs S.A.
www.purplelabs.com