Re: [security-report]Lame multi memory error bug && CVE Request

> > absolutely legal and tested in the courts, for any individual or
> > entity to copy and convert copyrighted media for which they hold a
> > license to (ie, a CD) into alternate formats for backup and playback
> > that does not copy beyond the original license holder.

Citation needed. This kind of copying is widely believed to fall under fair 
use, but AFAIK there have been no cases in the U.S. courts where such a 
determination has been made. The Betamax case was about recording broadcasts 
for the purpose of time shifting. The Diamond Rio case had some interesting 
yet non-binding commentary from the judge, and was really only about the 
manufacturer's royalty obligations under the Audio Home Recording Act, and 
which served more to clarify that portable digital media players aren't 
"digital recording devices" covered by the AHRA at all, therefore they enjoy 
no special allowances w.r.t. copyright, and in that regard their use is 
restricted by the usual licensing requirements.

When pressed on this issue in an NPR interview in 2008, the RIAA was quite 
cagey about it, saying only "we haven't sued anyone for it yet." And in the 
UK, the public's ignorance and disregard for the illegality of this kind of 
copying is what led to the Hargreaves Review and the recently struck-down 
attempt to craft a personal-use exception for what people have long been 
assuming was legal, when in fact it was not.[1][2]

The developers should always maintain a position of not supporting any uses of 
the software for which they could be held vicariously liable. If someone drags 
them into court, they can't very well say "some guy on lame-dev said..." (and 
that goes for what I say, too; IANAL!)

[1] https://web.archive.org/web/20140812121709/www.gov.uk/government/uploads/system/uploads/attachment_data/file/314995/copyright-guidance-consumers.pdf
[2] http://www.theguardian.com/uk-news/2015/jul/17/high-court-quashes-regulations-copy-cds-musicians
    
> LAME is not a remotely exposed software like a webserver, a mail user
> agent, a mail server or a web-application.

Just off the top of my head, LAME is used by BandCamp and SoundCloud to 
process whatever people upload to those services. I wouldn't be surprised if 
it is also used by online vendors and digital content distribution networks 
(the legal ones like 7Digital) to process arbitrary input supplied by record 
companies, publishers, and artists. I would not want to wager on whether any 
of thse places have safeguards against specially crafted files crashing their 
encoders and whatever can happen as a result of that.

------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140