GNOME Bugzilla – Bug 774533
Remove vmnc plugin
Last modified: 2018-11-03 13:57:20 UTC
It looks basically unmaintained, has quite bad code quality and there is a decoder in ffmpeg. There seems to be no point in keeping it, and it's dangerous: https://scarybeastsecurity.blogspot.gr/2016/11/0day-poc-risky-design-decisions-in.html
commit 4cb1bcf1422bbcd79c0f683edb7ee85e3f7a31fe Author: Sebastian Dröge <sebastian@centricular.com> Date: Wed Nov 16 20:41:39 2016 +0200 vmncdec: Sanity-check width/height before using it We will allocate a screen area of width*height*bpp bytes, however this calculation can easily overflow if too high width or height are given inside the stream. Nonetheless we would just assume that enough memory was allocated, try to fill it and overwrite as much memory as wanted. Also allocate the screen area filled with zeroes to ensure that we start with full-black and not any random (or not so random) data. https://scarybeastsecurity.blogspot.gr/2016/11/0day-poc-risky-design-decisions-in.html Ideally we should just remove this plugin in favour of the one in gst-libav, which generally seems to be of better code quality. https://bugzilla.gnome.org/show_bug.cgi?id=774533 commit 088aebfda90f328f4c103cd20224db4f2ff021dc Author: Sebastian Dröge <sebastian@centricular.com> Date: Wed Nov 16 20:48:28 2016 +0200 riff: Extract bpp from the strf for vnmc Needed for avdec_vnmc to work. Considering all this, the main "advantage" of our decoder seems to be that it extracts the video format information from the stream, while the ffmpeg one requires them to be given from the outside in the AVI container.
The only reason why it doesn't explode also in ffmpeg (in another case: if the container contains wrong information) is the following check: https://github.com/FFmpeg/FFmpeg/blob/b70e9b4906a3d1a61c542da02793decba1dbabba/libavutil/imgutils.c#L259 Maybe we want something similar somewhere.
-- GitLab Migration Automatic Message -- This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity. You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/issues/447.