They claimed that this was not a problem since the codec was so uncommon, but without doing steps like removing it from the main tree or making it not built by

They claimed that this was not a problem since the codec was so uncommon, but without doing steps like removing it from the main tree or making it not built by default in major distros. I understand that from the perspective of "how many people will this crash for", but from a security perspective it is nonsensical. Even if it is an uncommon codec if the authors decide to keep the codepath there by default it is exploitable in most installs. I love ffmpeg but that whole episode left a bit of a bad taste.