[MPlayer-dev-eng] buffer overflow of the month

[Attila Kinali]

On Thu, 25 Aug 2005 13:24:18 -0400
The Wanderer <inverseparadox at comcast.net> wrote:

> On the date cited in that text file for 'vendor contacted', there is a
> post by someone with the name cited in 'issue found by' on -users which
> appears at a glance to contain the same information as the text file. I
> don't know why there was no reaction (people were busy and didn't notice
> it?), but he does not appear to be lying.

I can tell you why nobody reacted: It is neither a security
advisory nor a bugreport. It's just a mail from a lame user who
thinks he found something. (Yes, you might quote me on this)

We now have the sample file, but noone of us can reproduce
the segfault. If you want to try it yourself, join us on
irc or contact me off list (i dont want to make the url too public).

Anyways, i plan to write a news entry on this flaming this guy
to death. But first i want to be sure that it cannot be exploited
at all (yes, i know it's the audio buffer which is on heap, but
i want to be damn sure before i write something)


				Attila Kinali
-- 
心をこめて聞け心をこめて話せ