pondlife wrote:
> I'd vote to remove CRC checks, but also maybe put a little effort in to
> check places where corrupt input data might cause crashes/lockups - e..g.
> ensuring loop counts are sane.
>
> We ought to be able to pass random data into any codec without fear of a
> crash - maybe try renaming some other files to .mp3 and playing them?
>
> pondlife

nobody prevents you from putting a correct CRC for corrupted/malicious data
and, IIRC most MP3 files in the wild don't have a CRC anyway....
So, relying on the CRC to keep the decoder "safe" does not help much.
Received on 2010-07-01