Yearly Archives: 2008

Coping With Injections

I admit that a major issue I had with launching the second iteration of my build/test infrastructure was getting over my severe phobia of web database programming. I did a little web database programming circa 2001 but lost the thread shortly thereafter. Meanwhile, in the intervening years, I have read story after IT horror story about database-driven websites being subverted with something called SQL injection attacks. However, the problem is not quite as scary once you understand the key causes and what language features are in place to prevent abuse.

I now recognize that my web database programming from 2001 was probably vulnerable to a variety of SQL injections. I should dig up those old PHP scripts for an audit.

For the uninitiated, an SQL injection occurs when user input is passed to an SQL query without proper (or, indeed, any validation). If your program constructs an SQL query that looks like:

Continue reading →

Finally Building

At long last, I have a reasonable — and much improved — autobuild/test infrastructure running for FFmpeg. Visit it at builds.multimedia.cx. It’s a bit sparse right now as it only covers builds for 2 platforms (x86_32 and PowerPC, both on Linux) and only a handful of tests, which are actually pseudo-tests, only logging the filesizes of the ‘ffmpeg’, ‘ffplay’, and ‘ffserver’ binaries. Also, you will notice that the testbed makes an effort to keep up with recent SVN builds of gcc.

I’m hopeful for this new infrastructure; the sky’s the proverbial limit. In the short term, I will be adding x86_64/Linux builds. Solaris/Sparc and Mac OS X builds might be on the way as well. My other high priority right now is to create an administrative web form that will enable me (and hopefully some co-admins) to add and edit test specifications easily. It’s not ergonomic to do this through the MySQL console. Here are the top test ideas so far:

  • All of those ‘make test’ regression tests– break those up into individual tests
  • Type ‘ffmpeg -formats’– set up tests for each and every one of those individual modules; use the libavformat/framecrcenc module here
  • Fetch collections of conformance vectors for various MPEG standards and run through them

The comments section is open for suggestions. Be ambitious. However, here’s an algorithmic challenge if you’re up to it. Look at the stderr output from this build of gcc 2.95.3/x86_32 that failed. It would be useful to highlight the errors. How do I search the text and find the error so I can highlight them, and also insert HTML anchor links for easy skipping? The best I can think to do is searching for ‘***’ to indicate errors and search back somehow.