Current status: There's a conflict between Google cybersecurity researchers and the
@ffmpeg project that doesn't have the resources to fix the vulns Google finds.
So I'm busy trying to understand the bug to figure out how to patch it.
Google provided enough information to easily reproduce the bug, so I simply compile everything, then watch it crash in the debugger, then step through the code before it gets to that point to see what went wrong.
I've spent about 5 hours so far on this, mostly getting everything built properly on macOS, which is my preferred environment for debugging. I should be learning how to use VSCode on the Linux desktop as my source-level debugger. Fuck using raw gdb without a GUI frontend -- my philosophy for (checks notes) over 30 years.