[FFmpeg-devel] Re: question about submitting security patches

[Tobias Rapp via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

On 13/11/2025 15:50, Timo Rothenpieler via ffmpeg-devel wrote:

> On 13/11/2025 04:06, Michael Niedermayer via ffmpeg-devel wrote:
>> Hi Kieran
>>
>> On Wed, Nov 12, 2025 at 12:09:00AM -0800, Kieran Kunhya via 
>> ffmpeg-devel wrote:
>>> On Mon, 10 Nov 2025, 19:00 Michael Niedermayer via ffmpeg-devel, <
>>> ffmpeg-devel@ffmpeg.org> wrote:
>>>
>>>> Hi Remi
>>>>
>>>> On Mon, Nov 10, 2025 at 06:03:38PM +0200, Rémi Denis-Courmont via
>>>> ffmpeg-devel wrote:
>>>>> Le lauantaina 8. marraskuuta 2025, 10.34.24 Itä-Euroopan normaaliaika
>>>> Thomas
>>>>> Dullien via ffmpeg-devel a écrit :
>>>>>> What's the best way to submit these patches? There is the bug 
>>>>>> tracker,
>>>>>> there is this mailing list - what's the best way to contribute them?
>>>>>
>>>>> I don't think that DNN-generated patches are compatible with the 
>>>>> LGPL in
>>>> the
>>>>> first place, or it is at best very uncertain that they are. So 
>>>>> then you
>>>> cannot
>>>>> contribute DNN-generated patches in any useful way at all.
>>>>
>>>> If you have concrete legal analysis or case law that supports this 
>>>> claim,
>>>> please share it.
>>>>
>>>
>>> If an LLM was trained on the leaked Microsoft Windows source code 
>>> and it
>>> used elements of that code when asked to write an FFmpeg patch, 
>>> would that
>>> patch be acceptable in your eyes?
>>
>> If a human was trained on the leaked Microsoft Windows source code 
>> and he
>> used elements of that code when asked to write an FFmpeg patch, would 
>> that
>> patch be acceptable in your eyes?
>>
>> We should forbid human written code?
>
> I mean, that is in fact generally how situations like that are handled.
> At least I have seen it multiple times on Projects like the Dolphin 
> Emulator that people who read the leaked Nintendo code were barred 
> from ever contributing again once found out, cause it would give 
> Nintendo legal ground to take down the project.

That seems a bit over-cautious, like banning all contributions where 
LLMs have been involved.

The discussion was started with the topic of security patches in mind, 
and I don't think that the typical 1-3 line patch for buffer overruns or 
pointer double free can be considered copyrightable material. This is 
different from implementing a new codec, or creating a new filter.

Regards, Tobias

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org