3 ms·

I see you didn't read the article. The problem isn't Google reporting vulnerabilities. It's Google using AI to find obscure bugs that affect 2 people on the pl

by Yokolos 11mo ago

I see you didn't read the article. The problem isn't Google reporting vulnerabilities. It's Google using AI to find obscure bugs that affect 2 people on the planet, then making a CVE out of it, without putting any effort into fixing it themselves or funding the project. What are the ffmpeg maintainers supposed to do about this? It's a complete waste of everybody's time. > The latest episode was sparked after a Google AI agent found an especially obscure bug in FFmpeg. How obscure? This “medium impact issue in ffmpeg,” which the FFmpeg developers did patch, is “an issue with decoding LucasArts Smush codec, specifically the first 10-20 frames of Rebel Assault 2, a game from 1995.”

inkysigma 11mo ago
I don't think that's an accurate description of the full scope of the problem. The codec itself is mostly unused but the code path can possibly be triggered from file fuzzing that ffmpeg uses so a maliciously crafted payload (e.g. any run of ffmpeg that touches user input without disabling this codec) could possibly be exploited.
- seb1204 11mo ago
  Why does google simply build their own ffmpeg from source without the codec?
  - woodruffw 11mo ago
    They almost certainly do. But it's also in the public interest to responsibly disclose vulnerabilities in components that don't directly affect you.
saagarjha 11mo ago
Close the bug, if they don’t care. They don’t want to do that because then people will yell at them for not caring.
Dylan16807 11mo ago
> that affect 2 people on the planet Wrong. The original files only affect 2 people. A malicious file could be anywhere. Do you remember when certain sequences of letters could crash iphones? The solution was not "only two people are likely to ever type that, minimum priority". Because people started spreading it on purpose.
seb1204 11mo ago
Mark it low, and estimate by when it can be fixed (3, 4 months from now). Advise google of it. Google does not need to disclose this bug that fast. If I do something one the side or as hobby and big corp comes by to tell me to hurry up I feel inclined to say no thanks.

by Yokolos 11mo ago

inkysigma 11mo ago

I don't think that's an accurate description of the full scope of the problem. The codec itself is mostly unused but the code path can possibly be triggered from file fuzzing that ffmpeg uses so a maliciously crafted payload (e.g. any run of ffmpeg that touches user input without disabling this codec) could possibly be exploited.

seb1204 11mo ago
Why does google simply build their own ffmpeg from source without the codec?
- woodruffw 11mo ago
  They almost certainly do. But it's also in the public interest to responsibly disclose vulnerabilities in components that don't directly affect you.

saagarjha 11mo ago

Close the bug, if they don’t care. They don’t want to do that because then people will yell at them for not caring.

Dylan16807 11mo ago

> that affect 2 people on the planet Wrong. The original files only affect 2 people. A malicious file could be anywhere. Do you remember when certain sequences of letters could crash iphones? The solution was not "only two people are likely to ever type that, minimum priority". Because people started spreading it on purpose.

seb1204 11mo ago

Mark it low, and estimate by when it can be fixed (3, 4 months from now). Advise google of it. Google does not need to disclose this bug that fast. If I do something one the side or as hobby and big corp comes by to tell me to hurry up I feel inclined to say no thanks.