I honestly don't know if we've got anyone to particularly review C code... And do we have a history of reviewing stuff like this?

Lego's comments are probably more the sort of thing we want to be doing, looking more holistically at the package, it's upstream, packagers and stuff

In T199511#4422380, @Reedy wrote:

I honestly don't know if we've got anyone to particularly review C code... And do we have a history of reviewing stuff like this?

I don't know if @tstarling ever did any kind of review of lilypond or timidity.

Lego's comments are probably more the sort of thing we want to be doing, looking more holistically at the package, it's upstream, packagers and stuff

FWIW basic benchmarking of fluidsynth vs timidity was done in T181897#3873809 by @divadsn.

@Legoktm those benchmark results are a bit old, while fluidsynth might got an update, I can update them if required :)

In T199511#4426169, @divadsn wrote:

@Legoktm those benchmark results are a bit old, while fluidsynth might got an update, I can update them if required :)

Pretty sure the versions in debian stable aren't going to be newer than what you used ;)

In T199511#4424435, @Legoktm wrote:

I don't know if @tstarling ever did any kind of review of lilypond or timidity.

Lilypond is written in Scheme, I mostly just read the docs which have plenty of information about script injection and the like. I don't think I reviewed Timidity, although it probably would have been wise. I do have a Timidity source tree on my hard drive dated 2013 but I don't recall reviewing it. I did review the C code of Philip's Music Writer, which was proposed as an alternative to Lilypond. It was horrifying, full of buffer overflows. I tried to explain the (many) issues to the author but ended up just recommending to Debian that they drop the package (they didn't). This is why we don't have Philip's Music Writer.

Speaking of C reviews in general, I also did a security review of librsvg, and I wrote some patches to secure it. I don't think it's necessary to review external projects completely, line by line, but I think it's prudent to open up the source and see if it makes your eyes bleed, and to brainstorm any modes of attack which might be especially relevant to us. These kinds of projects are usually not written with adversarial input in mind.

In my opinion, DoS is not worth worrying about, unless it is something exotic like ephemeral port exhaustion. We have time and memory limits and there's plenty of ways to hit them.