Opened 18 months ago

Closed 18 months ago

Last modified 18 months ago

#5558 closed defect (wontfix)

concat protocol should run in "-safe 0" mode by default

Reported by: GrayFace Owned by:
Priority: important Component: avformat
Version: git-master Keywords: concat regression
Cc: Blocked By:
Blocking: Reproduced by developer: no
Analyzed by developer: no

Description

Summary of the bug:
It's very hard for me to imagine a task for which "-safe 1" makes sense. It probably involves list being obtained from outside source instead of being generated. What's for sure is that it's a sophisticated task for which figuring out and specifying additional parameters is not a problem.
For all regular users of "concat" option (me included) the "safe mode" brings only troubles, e.g. https://ffmpeg.org/pipermail/ffmpeg-user/2016-April/031560.html
No one knows why it's there, because the documentation doesn't say anything about rationale: https://www.ffmpeg.org/ffmpeg-formats.html#Options
Obviously, no backward compatibility.

How to reproduce:

% ffmpeg -nostats -f concat -i List.txt -c copy output
(List.txt contains absolute paths)
ffmpeg version N-79947-gcd244fa
built on 20160512

Change History (3)

comment:1 Changed 18 months ago by cehoyos

  • Resolution set to wontfix
  • Status changed from new to closed

comment:2 Changed 18 months ago by GrayFace

Replying to cehoyos:

http://seclists.org/oss-sec/2016/q1/85

Wow! Yet, I don't see how this applies to command-line "-f concat" parameter.
First, it talks about "concat:file1|file2" protocol, not "-f concat" demuxer (turns out I was wrong calling it "protocol" in the ticket name).
Second, it talks about it being found in a movie file, obviously an untrusted source, unlike command-line. Shouldn't the list explicitly specified in command line as "-f concat" be trusted (only the list itself, not the movies specified by it)?

Last edited 18 months ago by GrayFace (previous) (diff)

comment:3 Changed 18 months ago by cehoyos

  • Component changed from undetermined to avformat
  • Keywords concat regression added
  • Priority changed from normal to important
  • Version changed from unspecified to git-master

It is unlikely that the current behaviour will change but feel free to send a patch made with git format-patch to the development mailing list to discuss your intended change.

Note: See TracTickets for help on using tickets.