Hacker News
A Vibecoded Fuzzer Found a Deterministic FFmpeg Crash in a 21-Byte File, and Maintainers Patched It in a Day
Dario Clavijo reported a divide-by-zero in FFmpeg's VPK demuxer on August 27, at libavformat/vpk.c:89 where vpk_read_packet divides by nb_channels without checking it is non-zero, causing SIGFPE on the final audio block. A malformed 21-byte VPK file triggers it deterministically, giving a denial of service against anything calling avformat_open_input and av_read_frame. The bug came out of Clavijo's own fuzzer at github.com/daedalus/fuzzer; Jun Zhao replied the same day and PR #24297 landed on August 28, a notably calmer maintainer reception than the AI-reported-bug fights FFmpeg has had before.
↳ Follow the thread