[FFmpeg-devel] [PATCH] Add FITS Demuxer

Nicolas George george at nsup.org
Tue Jul 4 12:34:07 EEST 2017


Le sextidi 16 messidor, an CCXXV, Reimar Döffinger a écrit :
> From a security standpoint, I believe any array and anything that is
> more than a handful bytes ideally should not be on the stack, if the
> added complexity is minimal.

If you change that into "a handful of kilo-octets", then for a project
like FFmpeg (which is not a monster like a Gui toolkit but neither meant
for embedded systems with tiny limits) I agree.

But "a handful bytes", I consider the added security to be the same
level as stopping people at the entrances of a mall to have a passing
glance at their handbag: pure theater. The wasted time could be more
efficiently be used to other security-related tasks. Reimplementing
FFmpeg in Rust for example.

Regards,

-- 
  Nicolas George
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: Digital signature
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20170704/4204941e/attachment.sig>


More information about the ffmpeg-devel mailing list