Re: [FFmpeg-devel] [fateserver PATCH] Move validation of parsed slot/date into split_header from load_report

2021-09-07 Thread Andreas Rheinhardt
Nicolas George: > Martin Storsjo (12021-09-07): >> This avoids using tainted data in the call to zcat in the main loop >> in index.cgi. >> >> This fixes the report listing for cases with a compile error. >> --- >> FATE.pm | 4 ++-- >> 1 file changed, 2 insertions(+), 2 deletions(-) > > That is ev

Re: [FFmpeg-devel] [fateserver PATCH] Move validation of parsed slot/date into split_header from load_report

2021-09-07 Thread Nicolas George
Martin Storsjo (12021-09-07): > This avoids using tainted data in the call to zcat in the main loop > in index.cgi. > > This fixes the report listing for cases with a compile error. > --- > FATE.pm | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) That is even better, thanks. Applied a

[FFmpeg-devel] [fateserver PATCH] Move validation of parsed slot/date into split_header from load_report

2021-09-07 Thread Martin Storsjö
This avoids using tainted data in the call to zcat in the main loop in index.cgi. This fixes the report listing for cases with a compile error. --- FATE.pm | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/FATE.pm b/FATE.pm index ccb8958..0d4603f 100644 --- a/FATE.pm +++ b/F

Re: [FFmpeg-devel] [fateserver PATCH 1/2] Add a missed taint check in report.cgi

2021-09-07 Thread Nicolas George
Martin Storsjo (12021-09-07): > This was missed in 505f620a5d22ffef86ad5ffa1328e87ba6dc191b. > --- > report.cgi | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) Thanks, both patches pushed and deployed. Regards, -- Nicolas George signature.asc Description: PGP signature

[FFmpeg-devel] [fateserver PATCH 2/2] Add missing validation of out of process data

2021-09-07 Thread Martin Storsjö
When invoking unxz, the variables making up the path passed to unxz need to be validated. load_summary normally only reads the "summary" file, but if missing, it tries to use unxz to unpack report.xz. In this case the slot value needs to be validated, which can be done in the main loop in index.cg

[FFmpeg-devel] [fateserver PATCH 1/2] Add a missed taint check in report.cgi

2021-09-07 Thread Martin Storsjö
This was missed in 505f620a5d22ffef86ad5ffa1328e87ba6dc191b. --- report.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/report.cgi b/report.cgi index 2b388e4..fb00fee 100755 --- a/report.cgi +++ b/report.cgi @@ -1,4 +1,4 @@ -#! /usr/bin/perl +#! /usr/bin/perl -T # # Copyr

[FFmpeg-devel] fateserver

2021-08-08 Thread Michael Niedermayer
Hi all on 8 Aug 2021 08:02:54 +0200 janne informed ffmpeg-security about a arbitrary code execution vulnerability in the fateserver code in both libav and ffmpeg. From the log janne showed us it was apparently used by someone yesterday to attempt to run sudo i did shutdown apache on fate.ffmpeg.or

Re: [FFmpeg-devel] [FATESERVER/PATCH] Update to new website style

2014-07-31 Thread Michael Niedermayer
On Thu, Jul 31, 2014 at 11:55:59PM +0200, Michael Niedermayer wrote: > On Thu, Jul 31, 2014 at 02:11:25PM -0700, Timothy Gu wrote: > > On Thu, Jul 31, 2014 at 12:54 PM, Michael Niedermayer > > wrote: > > > > > also light gray text on yellow/green is rather hard to read > > > > where? on index p

Re: [FFmpeg-devel] [FATESERVER/PATCH] Update to new website style

2014-07-31 Thread Michael Niedermayer
On Thu, Jul 31, 2014 at 02:11:25PM -0700, Timothy Gu wrote: > On Thu, Jul 31, 2014 at 12:54 PM, Michael Niedermayer > wrote: > > > also light gray text on yellow/green is rather hard to read > > where? on index page yellow corresponds to black text color, while > green corresponds to white. in

Re: [FFmpeg-devel] [FATESERVER/PATCH] Update to new website style

2014-07-31 Thread Timothy Gu
On Thu, Jul 31, 2014 at 12:54 PM, Michael Niedermayer wrote: > also light gray text on yellow/green is rather hard to read where? on index page yellow corresponds to black text color, while green corresponds to white. > and theres somethng wrong with the heart icon its much smaller and > unreco

Re: [FFmpeg-devel] [FATESERVER/PATCH] Update to new website style

2014-07-31 Thread Michael Niedermayer
On Wed, Jul 30, 2014 at 03:20:54PM -0700, Timothy Gu wrote: > Signed-off-by: Timothy Gu > --- > FATE.pm | 130 -- > fate.css| 154 > ++-- > history.cgi | 32 +++-- > index.cgi

[FFmpeg-devel] [FATESERVER/PATCH] Update to new website style

2014-07-30 Thread Timothy Gu
Signed-off-by: Timothy Gu --- FATE.pm | 130 -- fate.css| 154 ++-- history.cgi | 32 +++-- index.cgi | 117 - report.cgi | 46 +