4 ms·
Google operates a transcoder API which I suspect is just ffmpeg under the hood, and if you assume that they accept any input file, they really can't afford for
by lukeschlather 1y ago
Google operates a transcoder API which I suspect is just ffmpeg under the hood, and if you assume that they accept any input file, they really can't afford for decoders to have security vulnerabilities. Of course, then Google should be coming with more resources and not just filing bugs because it's Google that has the unusual use case.
- vreg 1y agoIf that is true then Google should be strictly sandboxing ffmpeg and filtering the input before it even gets there. A solid defense-in-depth approach would make sure it's highly unlikely this vulnerable code would be reached, and if it was, there would be effectively no impact. They should be building ffmpeg with a minimal feature set anyway, so none of these obscure codecs end up included in the final binary.
- tkfoss 1y agoThose decoders aren't even compiled and activated in the released binaries. But in any case, why would that be FFMPEGs problem?
- yegle 1y agoPlease stop spreading this misinformation. At least in Debian this is enabled by default (and as another post indicates, Ubuntu as well). Run the following command to confirm: ffmpeg -codecs|grep sanm
- astrange 1y agoIf you're using ffmpeg it's recommended to just enable the things you need, or only accept some container formats. But yes, in a generic package everything is enabled.
- tkfoss 11mo agoYou re right, thanks! ffmpeg version 8.0 Copyright (c) 2000-2025 the FFmpeg developers ... D.V.L. sanm LucasArts SANM/SMUSH video
- chris_wot 1y agoThen they can certainly afford to supply patches.