Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We found a division by zero bug in FFmpeg with a vibecoded fuzzer

code.ffmpeg.org

Post reply on HN
Print view View original

171–180 of 274 posts

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#171

Post by [deleted] »

timpera wrote: post #143
its-summertime wrote: post #140

Earlier quoted context omitted.

For those with difficulty accessing: - - - From: Anthony Hurtado vpk_read_packet() divides vpk->last_block_size and (par->block_align - vpk->last_block_size) by par->ch_layout.nb_channels without checking for zero. While vpk_read_header() validates nb_channels > 0, the codec parameters may become zero through format probing misidentification (VPK probe score is 2/3 of AVPROBE_SCORE_MAX) or codec parameter reset, caus…

Thank you! I gave up after more than 2 whole minutes of waiting on a high-end smartphone. I'm not sure this keeps bots out, but it definitely keeps users out…

[deleted]

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#172

Post by tredre3 »

inventor7777 wrote: post #151
semiquaver wrote: post #108

Earlier quoted context omitted.

Oddly enough I can’t access that site, it just heats up my phone solving hashes. Gave up after about a minute and anubis had only made it less than halfway through. I doubt the real bots have any trouble bypassing it.

It's puzzling how mild the reactions are to Anubis compared to the people reacting to seeing one singular Cloudflare captcha checkbox. I'd much rather a checkbox than a brief CPU-intensive hashing session.

Anubis is usually less obtrusive than that, though. This is the longest anubis challenge I've ever had, to the point of being absurd. Hopefully they have a genuine reason for having set the difficulty so high.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#173

Post by 8bitsrule »

bartread wrote: post #113
semiquaver wrote: post #108

Earlier quoted context omitted.

Oddly enough I can’t access that site, it just heats up my phone solving hashes. Gave up after about a minute and anubis had only made it less than halfway through. I doubt the real bots have any trouble bypassing it.

[flagged]

It's indeed very annoying.

I've only seen 1 or 2 that know what they're doing. One's at lemmy.world ... just hovering over it is verified ...

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#174

Post by Izkata »

inventor7777 wrote: post #170
da_chicken wrote: post #154

Earlier quoted context omitted.

I think when people are complaining about Captcha they're complaining about yet another "pick 6-20 pictures of traffic lights/school busses/stairs/stop signs/bicycles."

Not in this case. I wish I could find the actual post, but I recall reading a post on HN recently where a majority of the commenters were claiming that when they even see a Cloudflare verification checkbox that they leave the website. This makes no sense to me as in my experience, you click the checkbox and then it verifies you without extra steps.

Usually but not always. The challenge is after clicking the checkbox, if it can't manage to verify automatically. So those users have learned not to bother.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#175

Post by deepsun »

theowaway wrote: post #168
aeyes wrote: post #91

A patch for this was submitted in April: https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.o... Edit: And there was discussion about this back in 2024 as well

[flagged]

It's Anubis and it's actually cool and loved project here. It's an open-source Captcha that filters out bots, and it doesn't track you around the web, unlike Google or cloudflare captcha.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#176

Post by deepsun »

black_knight wrote: post #59
dmix wrote: post #4

Earlier quoted context omitted.

Finding the bugs with LLMs is easy. Reviewing the output, cleaning it up, and making sure it doesn't break something else is the hard part.

This is where I believe strong typing (like, Haskell-strong or stronger) and functional programming in general will be a win. The confidence I have that my fixes are localised when fixing Haskell code is infinitely stronger than fixing even Java, not speak about C, code.

You haven't mentioned the dynamic typed languages that I believe should die -- Python and Javascript. The only good use case for dynamic typing is notebooks (niche of R lang) where you're throwing out the code you just wrote after getting the result you wanted from it.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#177

Post by Jaxan »

inigyou wrote: post #116
skupig wrote: post #89

Am I missing something? Who cares? This isn't a security issue, it's just an unexploitable crash on bad data.

No, you're not. It's a minor bug, probably with an easy fix, that deserves to be fixed. It's not worthy of front page HN...

I guess it’s submitted for the method rather than the result.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#178

Post by DarmokTanagra »

dabinat wrote: post #2

It’s interesting how AI may both raise and lower the quality of software. It’s very easy to send an AI agent on an open-ended bug hunt, and if it wastes a bunch of time and effort and finds nothing, no big deal. Time is much more important for a human developer with a salary.

Having worked in a few vibe coded codebases over the last few years I can safely say that AI is not raising the quality of anything.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#179

Post by krona »

a2ff6eeb0 wrote: post #163
krona wrote: post #84

Earlier quoted context omitted.

Absolutely not. By most accounts they're terrible at fixing anything other than trivial bugs in complex codebases e.g. Linux kernel, but they're much better at finding them.

So you put it in a loop and tell it to find the bugs in the code it wrote. What's the issue?

This is a self confession if I ever saw one.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#180

Post by tome »

astrange wrote: post #67
black_knight wrote: post #59

Earlier quoted context omitted.

This is where I believe strong typing (like, Haskell-strong or stronger) and functional programming in general will be a win. The confidence I have that my fixes are localised when fixing Haskell code is infinitely stronger than fixing even Java, not speak about C, code.

Haskell's type system would not easily prevent this bug. It's not good at numeric/logic issues like that. When people say "Haskell makes it impossible to write bugs" they mean "Haskell has enums" (ADTs).

People don’t say "Haskell makes it impossible to write bugs"! You may have heard "if it compiles it works" which is somewhat tongue in cheek, but also true for a sufficiently loose interpretation of "works" in a way it is not true for languages with a less strong and flexible type system.
Post reply on HN