Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We found a division by zero bug in FFmpeg with a vibecoded fuzzer

code.ffmpeg.org

Post reply on HN
Print view View original

81–90 of 274 posts

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#81

Post by colechristensen »

roadbuster wrote: post #62
robertlagrant wrote: post #30

What we need is a numeric type that cannot be zero.

The only way to achieve this is to either put a runtime software check on a variable whenever it's assigned/used, or to literally add hardware support in processors themselves which literally throws an interrupt when a "neverShallBeZero" variable is assigned to zero. There's no viable way to statically prove at compile-time that these variables will never become zero at runtime, ultimately forcing a system of endless…

You're kind of saying the only way to do it is in software or hardware :)

An alternative https://en.wikipedia.org/wiki/Projectively_extended_real_lin...

The projectively extended real line defines division by zero, no reason you couldn't have a floating point type that implemented it.

>There's no viable way to statically prove at compile-time that these variables will never become zero at runtime

strongly typed programming languages like Ada allow for types which have ranges such as disallowing zero -- but also any arbitrary thing like you can create a floating point "degrees" type which is [0.0, 360.0] or any other ranged type

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#82

Post by tensegrist »

note that this seems to be a bug in what i expect (feel free to correct me) is a code path for a little-used codec

maybe we'll just see them remove support for these long-tail formats the way linux has been removing drivers for similar reasons https://www.phoronix.com/news/Linux-Retiring-Moxa-Driver

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#83

Post by merb »

simonjuk wrote: post #78
dabinat wrote: post #2

It’s interesting how AI may both raise and lower the quality of software. It’s very easy to send an AI agent on an open-ended bug hunt, and if it wastes a bunch of time and effort and finds nothing, no big deal. Time is much more important for a human developer with a salary.

In my experience, there are two ways to use AI: speed or quality. Speed is where you give the AI a task to do and you review it; quality is where you write the code yourself and you get AI to review it. Both are valid for different situations.

My plan for bigger things is mostly:

Generate multiple solutions- they do not to work 100% correctly. And than I check which I would prefer. Which is more to our applications taste.

And than I would take the vibe output as a kind of a ‚plan‘ which I use to implement but not follow 100% and at the end I take my solution and review it. I gain speed with that because I often can quickly see the pros and cons of a solution way better than when I would manually do it and hang on a major roadblock and also I even see such roadblocks in the vibe output - it’s mostly the part with an unnecessary amount of new code that looks nonsensical.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#84

Post by krona »

TacticalCoder wrote: post #51
krona wrote: post #36

Earlier quoted context omitted.

You're suggesting that LLMs get better at fixing bugs/vulnerabilities, but at the same time stop getting better at finding them? What if this difference is inherent and essential?

> You're suggesting that LLMs get better at fixing bugs/vulnerabilities, but at the same time stop getting better at finding them? Are you implying that all code writing by LLMs atm is bug-free?

Absolutely not. By most accounts they're terrible at fixing anything other than trivial bugs in complex codebases e.g. Linux kernel, but they're much better at finding them.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#85

Post by parl_match »

tensegrist wrote: post #82

note that this seems to be a bug in what i expect (feel free to correct me) is a code path for a little-used codec maybe we'll just see them remove support for these long-tail formats the way linux has been removing drivers for similar reasons https://www.phoronix.com/news/Linux-Retiring-Moxa-Driver

it's widely used but in "industry" applications. so ffmpeg is probably being used in a lot of offices (studios) and maybe even being included in end user software.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#87

Post by [deleted] »

shevy-java wrote: post #14
dabinat wrote: post #2

It’s interesting how AI may both raise and lower the quality of software. It’s very easy to send an AI agent on an open-ended bug hunt, and if it wastes a bunch of time and effort and finds nothing, no big deal. Time is much more important for a human developer with a salary.

I dislike AI, but if AI finds real bugs then this is in my opinion objectively a positive thing. Of course the question is what constitutes a real bug.

[deleted]

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#88

Post by justonenote »

Whatever about the specifics of this bug and whether its a useful vector, this is not surprising even in the slightest?

My current opinion on LLMs is that they are superhuman in that they lack fatigue, they have close to full knowledge across all subjects which are known to humans at least publicly, and the fact that you can vibe code a harness to look for bugs in a famously complicated C codebase is intern level stuff and hardly news.

Smart aspiring blackhats will be targeting tmux next, both with light llm jailbreaks, light supply chain attacks (web search results) and LPEs within certain environments which weren't particularly useful before but with agents running on auto mode for hours become a very valuable springboard. I'm not sure on the quality of tmux code but I know its written in C and is very complex and was not at all designed to defend against this type of threat.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#90

Post by senordevnyc »

justonenote wrote: post #88

Whatever about the specifics of this bug and whether its a useful vector, this is not surprising even in the slightest? My current opinion on LLMs is that they are superhuman in that they lack fatigue, they have close to full knowledge across all subjects which are known to humans at least publicly, and the fact that you can vibe code a harness to look for bugs in a famously complicated C codebase is intern level stu…

the fact that you can vibe code a harness to look for bugs in a famously complicated C codebase is intern level stuff and hardly news

It seems like this would have been pure fantasy not that long ago though. So why isn’t it noteworthy again? I don’t really follow what you’re complaining about.

Post reply on HN