Top
Best
New

Posted by dclavijo 12 hours ago

We found a division by zero bug in FFmpeg with a vibecoded fuzzer(code.ffmpeg.org)
201 points | 156 commentspage 2
tensegrist 8 hours ago|
note that this seems to be a bug in what i expect (feel free to correct me) is a code path for a little-used codec

maybe we'll just see them remove support for these long-tail formats the way linux has been removing drivers for similar reasons https://www.phoronix.com/news/Linux-Retiring-Moxa-Driver

parl_match 8 hours ago|
it's widely used but in "industry" applications. so ffmpeg is probably being used in a lot of offices (studios) and maybe even being included in end user software.
inigyou 8 hours ago||
Understatement of the year. Almost everything that processes video uses ffmpeg.
1saadcodes 6 hours ago||
I find it pretty cool that a fuzzer thrown together this way actually found a bug in ffmpeg
driverdan 6 hours ago||
The README for the fuzzer is an AI slop mess. https://github.com/daedalus/fuzzer/
dclavijo 4 hours ago|
OP here: You are welcome to send a PR if you like. I'll be grateful if someone makes the readme more human.
jeffbee 9 hours ago||
I imagine the discussion will center around this application of AI, but to me this is just the Nth proof of the proven fact that you must build ffmpeg, if you insist on using it, with only an allow-list of file formats that you expect to encounter, and not with the kitchen sink of stuff you are never going to need.
Surac 11 hours ago||
send patches
rs_rs_rs_rs_rs 11 hours ago|
...they did.
ligarota 11 hours ago||
Where?

They only suggested a basic guard, chich can be useless if this case never happens

12j3afAv 11 hours ago||
Generating an incorrect input file seems to be the easiest task of all for any fuzzer.

Generating correct input to get deep into the call stack and then finding something is the hard part.

aaron695 6 hours ago||
[dead]
akshay_akula 11 hours ago||
[flagged]
wy35 10 hours ago|
Unrelated to the submitted link -- just checked your comment history and all of your comments are AI-generated like this one. What's the motivation for this?
f311a 10 hours ago|||
He won’t reply, he’s busy promoting himself and his peojects with AI.
bigfishrunning 10 hours ago||||
probably karma farming
akshay_akula 4 hours ago|||
LoL I just sound botted
whatsThisBtn4 9 hours ago||
[flagged]
cpriest 9 hours ago|
Nice find. The interesting part isn't "AI wrote the fuzzer." It's that a cheap random harness still hits classical bugs in ancient parsers. Keep the corpus; throw away the hype.