FFmpeg to Google: Fund us or stop sending bugs

Looks like this was a security issue.

I don't consider a security issue to be a "standard bug." I need to look at it, and [maybe] fix it, regardless of who reported it.

But in my projects, I have gotten requests (sometimes, demands) that I change things like the published API (a general-purpose API), to optimize some niche functionality for one user.

I'll usually politely decline these, and respond with an explanation as to why, along with suggestions for them to add it, after the fact.

It’s a security issue for a stream type almost nobody uses. It’s a little like saying your graphics program in 2025 is exploitable by a malformed PCX file, or your music player has a security bug only when playing an Impulse Tracker module.

Sure, triage it. It shouldn’t be publicly disclosed within a week of the report though, because the fix is still a relatively low priority.