Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We found a division by zero bug in FFmpeg with a vibecoded fuzzer

code.ffmpeg.org

Post reply on HN
Print view View original

151–160 of 274 posts

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#151

Post by inventor7777 »

semiquaver wrote: post #108
aeyes wrote: post #91

A patch for this was submitted in April: https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.o... Edit: And there was discussion about this back in 2024 as well

Oddly enough I can’t access that site, it just heats up my phone solving hashes. Gave up after about a minute and anubis had only made it less than halfway through. I doubt the real bots have any trouble bypassing it.

It's puzzling how mild the reactions are to Anubis compared to the people reacting to seeing one singular Cloudflare captcha checkbox. I'd much rather a checkbox than a brief CPU-intensive hashing session.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#152

Post by kurtoid »

semiquaver wrote: post #108
aeyes wrote: post #91

A patch for this was submitted in April: https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.o... Edit: And there was discussion about this back in 2024 as well

Oddly enough I can’t access that site, it just heats up my phone solving hashes. Gave up after about a minute and anubis had only made it less than halfway through. I doubt the real bots have any trouble bypassing it.

their anubis difficulty is wayyy to high; 6 is overkill

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#153

Post by myng111 »

bulder wrote: post #121
demibabs wrote: post #109

Earlier quoted context omitted.

Yeah, is it trying to mine bitcoin or something? Anubis usually takes a second but here I waited a minute and got 20% through on a modern phone.

Presumably they've configured it to use a higher difficulty challenge due to high rates of scraping on their bugtracker

Difficulty 6 which some parts of FFmpeg use, is about the highest difficulty you can assign with the default Anubis config. For me personally I only serve that difficulty if I'm near certain the user is a bot. Serving it to everyone sure is a choice.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#154

Post by da_chicken »

inventor7777 wrote: post #151
semiquaver wrote: post #108

Earlier quoted context omitted.

Oddly enough I can’t access that site, it just heats up my phone solving hashes. Gave up after about a minute and anubis had only made it less than halfway through. I doubt the real bots have any trouble bypassing it.

It's puzzling how mild the reactions are to Anubis compared to the people reacting to seeing one singular Cloudflare captcha checkbox. I'd much rather a checkbox than a brief CPU-intensive hashing session.

I think when people are complaining about Captcha they're complaining about yet another "pick 6-20 pictures of traffic lights/school busses/stairs/stop signs/bicycles."

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#156

Post by VladVladikoff »

inigyou wrote: post #96
cptroot wrote: post #86

This is not a real bug in FFmpeg. This is a demonstration that if you control a custom AVIO module it is possible to crash FFmpeg by giving it bad data.

Not custom. It's an existing module for a format called VPK. It's a quite trivial bug though, not exploitable apart from DOS and won't ever happen in a real file.

I even question if it is a DOS vector. So the thread crashes and then the system that controls the threads cleans it up and opens a new thread. Seems to be a trivial impact, unless it locks up the thread somehow.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#157

Post by mapontosevenths »

da_chicken wrote: post #154
inventor7777 wrote: post #151

Earlier quoted context omitted.

It's puzzling how mild the reactions are to Anubis compared to the people reacting to seeing one singular Cloudflare captcha checkbox. I'd much rather a checkbox than a brief CPU-intensive hashing session.

I think when people are complaining about Captcha they're complaining about yet another "pick 6-20 pictures of traffic lights/school busses/stairs/stop signs/bicycles."

If they want to train an AI they should pay for it like everyone else. Modern bots have zero problems solving these, it's just free training for them.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#158

Post by inigyou »

VladVladikoff wrote: post #156
inigyou wrote: post #96

Earlier quoted context omitted.

Not custom. It's an existing module for a format called VPK. It's a quite trivial bug though, not exploitable apart from DOS and won't ever happen in a real file.

I even question if it is a DOS vector. So the thread crashes and then the system that controls the threads cleans it up and opens a new thread. Seems to be a trivial impact, unless it locks up the thread somehow.

Threads don't work that way. A fatal exception on any thread kills the process.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#159

Post by kayamon »

nonethewiser wrote: post #34
dmix wrote: post #4

Earlier quoted context omitted.

Finding the bugs with LLMs is easy. Reviewing the output, cleaning it up, and making sure it doesn't break something else is the hard part.

No one can keep up with the volume of code AI produces. We wont stop using AI. We will use AI to check AI. Of course this is crazy, but it will also unlock pretty insane scaling and productivity and ultimately we will manage it on either end via requirements and tests.

Volume.....

It used to be considered a quality of good code that there would be less code, not more.

Some people always tryin to get the highscore on golf.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#160

Post by VladVladikoff »

inigyou wrote: post #158
VladVladikoff wrote: post #156

Earlier quoted context omitted.

I even question if it is a DOS vector. So the thread crashes and then the system that controls the threads cleans it up and opens a new thread. Seems to be a trivial impact, unless it locks up the thread somehow.

Threads don't work that way. A fatal exception on any thread kills the process.

And the parent will spawn a new process. Unless the server is terribly poorly misconfigured. Edit; for what it’s worth I’ve run a server processing video with FFMPEG for 10 years now, and there’s just so many things that can make FFMPEG crash. All sorts of corrupted videos people upload. If your server doesn’t recovery gracefully from a crashed FFMPEG thread, that’s on you, not FFMPEG.
Post reply on HN