[FFmpeg-devel] [PATCH] lavf: add ffprobe demuxer

[Rostislav Pehlivanov]

On 4 December 2016 at 21:54, Andreas Cadhalpun <
andreas.cadhalpun at googlemail.com> wrote:

> On 31.10.2016 09:51, Stefano Sabatini wrote:
> > From 7f209e27aa33e8f43444e5cfc44c68f664b69e06 Mon Sep 17 00:00:00 2001
> > From: Nicolas George <george at nsup.org>
> > Date: Sat, 11 Jan 2014 19:42:41 +0100
> > Subject: [PATCH] lavf: add ffprobe demuxer
> >
> > With several modifications and documentation by Stefano Sabatini
> > <stefasab at gmail.com>.
> >
> > Signed-off-by: Nicolas George <george at nsup.org>
> > ---
> >  configure                |   3 +
> >  doc/demuxers.texi        |  18 ++
> >  doc/ffprobe-format.texi  | 121 +++++++++++++
> >  doc/formats.texi         |   1 +
> >  libavformat/Makefile     |   1 +
> >  libavformat/allformats.c |   1 +
> >  libavformat/ffprobedec.c | 439 ++++++++++++++++++++++++++++++
> +++++++++++++++++
> >  7 files changed, 584 insertions(+)
> >  create mode 100644 doc/ffprobe-format.texi
> >  create mode 100644 libavformat/ffprobedec.c
> >
> > diff --git a/configure b/configure
> > index 72ffaea..71b9d73 100755
> > --- a/configure
> > +++ b/configure
> > @@ -3349,6 +3349,9 @@ for n in $COMPONENT_LIST; do
> >      eval ${n}_if_any="\$$v"
> >  done
> >
> > +# Disable ffprobe demuxer for security concerns
> > +disable ffprobe_demuxer
> > +
>
> As I already wrote elsewhere, I don't think disabling this by default is
> good,
> as it will likely cause it to bitrot. Better require '-strict
> experimental'.
>
>
What about the security reasons listed below?


>
> > +For security reasons this demuxer is disabled by default, should be
> > +enabled though the @code{--enable-demuxer=ffprobe} configure option.
> > +
>
>
Does that mean the demuxer needs to be fuzzed or does it need to be
insecure to work?