Reconsidering ffmpeg in Debian

It won't find all the security bugs arising out of improper handling of input streams, but would at least flag places which rely on user-controllable input that look suspicious, and that will give the developers a thought about the security aspect there.

Also, after the heartbleed fiasco, coverity is gaining some smarts in recognizing places that accept user input, so it's only a good thing to point coverity to a codebase that handles a lot of potentially hostile input.