I have read the article. The expectation for a tool like ffmpeg is that regardless of what kind of file you put into it, it safely handles it. This is an actu

I have read the article. The expectation for a tool like ffmpeg is that regardless of what kind of file you put into it, it safely handles it. This is an actual bug in submitted code. It doesn't matter that it's for some obscure codec, it's technically maintained by the ffmpeg project and is fair game for vulnerability reports. Given that Google is also a major contributor to open-source video, this is more like a food manufacturer making sure that grocery stores are following health code when they stock their food. Mind you, the grocery store has no obligation to listen to them in this metaphor and is free to just let the report/CVE sit for a while.