From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id ACA7347CAB for ; Thu, 14 Aug 2025 16:44:27 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id 2374568D1B5; Thu, 14 Aug 2025 19:44:23 +0300 (EEST) Received: from relay1-d.mail.gandi.net (relay1-d.mail.gandi.net [217.70.183.193]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id CBD2368CB22 for ; Thu, 14 Aug 2025 19:44:16 +0300 (EEST) Received: by mail.gandi.net (Postfix) with ESMTPSA id C5F6E44342 for ; Thu, 14 Aug 2025 16:44:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1755189855; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=rn80dVmAQUMq1ceARQ9vTWqGecxzU4uebxwPbseFwmA=; b=GzDy6a2jxQUokWRfjD8tkSnO93sFt7ZikLpgH9JOQ/ThzgOI7wE9uaP4JLy2KQ7gddSOfY ankxq07ahqEtJgHuEcKrcYPQgbHN5RrC3fJvIipwN9l7X25lKNINyAd0AUf8X3i5uGymMc 2TIRTLJ5zN2DiUc+mZVYvfUoY5rO/z6jtu2XUvOSGw1+mWt9MBcS/HJvBlhsoDheWxN3fy XpRAVbHnmhZQGOzIffuUB4YHpCX4xhWa1fiUrcGpEMw6eeyx4LE7dYY6BHxOPMAFnl8Kq2 I4gh7JwciS4rvK4zgvZX09reXnWXl8FbBUoO3l42+bK2ayUvXDlnXDdevH6Plg== Date: Thu, 14 Aug 2025 18:44:14 +0200 From: Michael Niedermayer To: FFmpeg development discussions and patches Message-ID: <20250814164414.GQ29660@pb2> References: <20250814002549.6431A68CFFE@ffbox0-bg.ffmpeg.org> <20250814100755.GP29660@pb2> MIME-Version: 1.0 In-Reply-To: X-GND-State: clean X-GND-Score: -70 X-GND-Cause: gggruggvucftvghtrhhoucdtuddrgeeffedrtdefgddugeduiedtucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecuifetpfffkfdpucggtfgfnhhsuhgsshgtrhhisggvnecuuegrihhlohhuthemuceftddunecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenfghrlhcuvffnffculdeftddmnecujfgurhepfffhvffukfhfgggtuggjsehgtderredttdejnecuhfhrohhmpefoihgthhgrvghlucfpihgvuggvrhhmrgihvghruceomhhitghhrggvlhesnhhivgguvghrmhgrhigvrhdrtggtqeenucggtffrrghtthgvrhhnpeelkeeggfffiedufeejueffjeduhedttdduledtheevveevtdeiueelhfdtuedtkeenucfkphepgedurdeiiedrieehrddujeeinecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehinhgvthepgedurdeiiedrieehrddujeeipdhhvghloheplhhotggrlhhhohhsthdpmhgrihhlfhhrohhmpehmihgthhgrvghlsehnihgvuggvrhhmrgihvghrrdgttgdpnhgspghrtghpthhtohepuddprhgtphhtthhopehffhhmphgvghdquggvvhgvlhesfhhfmhhpvghgrdhorhhg X-GND-Sasl: michael@niedermayer.cc Subject: Re: [FFmpeg-devel] [PATCH] avutil/timecode: Check for integer overflow in av_timecode_init_from_components() (PR #20236) X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: multipart/mixed; boundary="===============1151587975271912239==" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: --===============1151587975271912239== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="hVjA2QACq2ZGiXSs" Content-Disposition: inline --hVjA2QACq2ZGiXSs Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Aug 14, 2025 at 04:18:03PM +0200, Nicolas George wrote: > Kieran Kunhya via ffmpeg-devel (HE12025-08-14): > > I don't think we should partake in this "security vulnerability farming" > > exercise. This isn't a security issue and it spams the code with integer > > overflow checks to fix a theoretical issue. >=20 > This is my take on this kind of =E2=80=9Cbugs=E2=80=9D too. I have no oppinion on this, but if INT_MAX hours gives undefined behavior then the API documentation has to exclude that as valid input range and all callers must be checked. (which may imply equivalent checks in some callers) Maybe we should specify in the commit that this is not a security fix but a normal bug fix But the code is buggy if part of the valid API input range results in undefined behavior thx [...] --=20 Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety -- Benjamin Franklin --hVjA2QACq2ZGiXSs Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iF0EABEKAB0WIQSf8hKLFH72cwut8TNhHseHBAsPqwUCaJ4SWgAKCRBhHseHBAsP q33wAJ9tEEd1+4bgo9SYL1u5SFNShzOwMwCfSkYwWF1rF49Ll8RGrtLz5G1y+68= =bVcH -----END PGP SIGNATURE----- --hVjA2QACq2ZGiXSs-- --===============1151587975271912239== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". --===============1151587975271912239==--