Re: prominent message on website about "use only on trusted input"?

Am Sat, 29 Jul 2017 09:56:32 +0200
schrieb [email protected]: 

> I think that it's very reasonable to assume that only developpers would 
> use the frame analyser (it's painfull enough to build, so only motivated 
> people will ge through it :-)). There is absolutely no use of it for a 
> regular user.

It's not that painful. I just had to specify -std=gnu89 for anything
involving gtk+1 (conflicts with glib otherwise). Well, OK, you need to
build gtk+1 as it's not included in binary distros anymore AFAIK, but
that is no issue for me … who cares about binary distros? ;-)

It seems to run just fine, built using GCC 6.3.0 here. And apart from
that … there is not _that_ much GUI involved, as it seems. So porting
to newer Gtk or anything else probably, would be an afternoon walk for
a seasoned GUI programmer, wouldn't it?

> Thus, mpglib for the analyser and mpg123 for "regular" decoding likely 
> would not cause any "usability" issue.

Also, the analyser is hooked into the encoder, right? I am starting to
look into the code … could it be that it's using the generic way to get
at PCM input, decoding MP3 along the way, and then hooks mpglib
directly into what lame itself produces? So having the initial decoding
to PCM happen in libmpg123 and only the analyzing stage with mpglib and
its extra hooks would also avoid any danger from malicious input files.
Lame is not producing malicious MP3 data, is it?


Alrighty then,

Thomas
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Lame-dev mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/lame-dev