Hi, i looked a bit at the asf demuxer. This whole thing with the asf descrambeling will also fail if several demuxer are opened at the same time. So while at it i fixed that too. Unless someone speakup i'm going to commit this patch in the next hours. Albeu
Hi, On 3/29/06, Alban Bedel <albeu@free.fr> wrote:
Hi,
i looked a bit at the asf demuxer. This whole thing with the asf descrambeling will also fail if several demuxer are opened at the same time. So while at it i fixed that too. Unless someone speakup i'm going to commit this patch in the next hours.
Does this patch has smth to do with the security advisory? (I assume not, but better ask). Guillaume -- I am disillusioned enough to know that no man's opinion on any subject is worth a damn unless backed up with enough genuine information to make him really know what he's talking about. -- H. P. Lovecraft (about the flamewars on FFmpeg and MPlayer-dev mailing lists) http://www.brainyquote.com/quotes/quotes/h/hplovecr278144.html
On Wed, 29 Mar 2006 19:54:20 +0200 "Guillaume POIRIER" <poirierg@gmail.com> wrote:
Hi,
On 3/29/06, Alban Bedel <albeu@free.fr> wrote:
Hi,
i looked a bit at the asf demuxer. This whole thing with the asf descrambeling will also fail if several demuxer are opened at the same time. So while at it i fixed that too. Unless someone speakup i'm going to commit this patch in the next hours.
Does this patch has smth to do with the security advisory? (I assume not, but better ask).
The initial intent was to fix that bug, but when a saw that the whole thing needed a bit deeper changes anyways, i did them too. Albeu
On Wed, 29 Mar 2006 18:29:41 +0200 Alban Bedel <albeu@free.fr> wrote:
i looked a bit at the asf demuxer. This whole thing with the asf descrambeling will also fail if several demuxer are opened at the same time. So while at it i fixed that too. Unless someone speakup i'm going to commit this patch in the next hours.
Did anyone check whether xine is also affected (heise claims this to be the case). If so, we should notify them too. If not, we should put this in the advisory we put up. Oh, btw: please do not put the name of xfocus into the advisory. I dont want to give credit to such stupid people. (Their answer to my rant was "bugreport.html says that we should write to mplayer-users") Attila Kinali -- 心をこめて聞け心をこめて話せ
Hi, Attila Kinali wrote:
On Wed, 29 Mar 2006 18:29:41 +0200
Oh, btw: please do not put the name of xfocus into the advisory. I dont want to give credit to such stupid people. (Their answer to my rant was "bugreport.html says that we should write to mplayer-users")
If the doc was clearly stating where to send security advisories, this wouldn't have happened (or at least they wouln't have any excuse). I'll add this to my todo-list... Guillaume
On Wed, 29 Mar 2006 22:32:56 +0200 Guillaume POIRIER <gpoirier@mplayerhq.hu> wrote:
If the doc was clearly stating where to send security advisories, this wouldn't have happened (or at least they wouln't have any excuse).
Yes and no. They just CC'ed -users, while sending it also to a bunch of security mailinglist. So it would have been no use even if they would have send it to a developer instead of -users. Attila Kinali -- 心をこめて聞け心をこめて話せ
Moin, I've seen a few commits on the asf code. Is the "exploit" fixed now? If so, does anyone care about writing a complete patch for pre7try2 and putting up a news entry? If not, what's missing? Attila Kinali -- 心をこめて聞け心をこめて話せ
participants (4)
-
Alban Bedel -
Attila Kinali -
Guillaume POIRIER -
Guillaume POIRIER