Re: [Cellar] New Version Notification - draft-ietf-cellar-ffv1-18.txt

[Dave Rice <[e-mail]>]

Hi Roman, Spencer,

> On Oct 30, 2020, at 1:41 PM, Dave Rice <[e-mail]> wrote:
> 
> Thank you Roman,
> 
>> On Oct 21, 2020, at 2:03 PM, Spencer Dawkins at IETF <[e-mail]> wrote:
>> 
>> Hi, Roman,
>> 
>> On Wed, Oct 21, 2020 at 12:38 PM Roman Danyliw <[e-mail]> wrote:
>> Hi!
>> (I can't find your response email to my ballot in my mail client despite it being in the archive, so apologizes for making the new thread).
>> 
>> Thanks for the -18 which cleared most of the COMMENTs.  I updated my ballot.
>> 
>> In the spirit of clearing what I consider a straightforward DISCUSS, might I suggest:
>> 
>> OLD
>> 
>>   Implementations of the FFV1 codec need to take appropriate security
>>    considerations into account, as outlined in [RFC4732].  It is
>>    extremely important for the decoder to be robust against malicious
>>    payloads.  Malicious payloads MUST NOT cause the decoder to overrun
>>    its allocated memory or to take an excessive amount of resources to
>>    decode.  The same applies to the encoder, ... 
>> 
>> NEW
>> 
>> Implementations of the FFV1 codec need to take appropriate security considerations into account.  Those related to denial of service are outlined in Section 2.1 of [RFC4732].  It is extremely important for the decoder to be robust against malicious payloads.  Malicious payloads MUST NOT cause the decoder to overrun its allocated memory or to take an excessive amount of resources to decode.    An overrun in allocated memory could lead to arbitrary code execution by an attacker.  The same applies to the encoder, ...
> 
> The recommendation looks appropriate to me and more clear. I moved it to a pull request at https://github.com/FFmpeg/FFV1/pull/253 for the consideration of the other authors.

Please note that we just updated the draft to include the recommended changes for security considerations on denial of service, which can be reviewed in version 19 of https://datatracker.ietf.org/doc/draft-ietf-cellar-ffv1/. Here’s a link to the diff of version 18 and 19: https://www.ietf.org/rfcdiff?url1=draft-ietf-cellar-ffv1-18&url2=draft-ietf-cellar-ffv1-19&difftype=--html.

Kind Regards,
Dave Rice