Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We found a division by zero bug in FFmpeg with a vibecoded fuzzer

code.ffmpeg.org

Post reply on HN
Print view View original

221–230 of 274 posts

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#221

Post by zer00eyz »

noir_lord wrote: post #213
tredre3 wrote: post #172

Earlier quoted context omitted.

Anubis is usually less obtrusive than that, though. This is the longest anubis challenge I've ever had, to the point of being absurd. Hopefully they have a genuine reason for having set the difficulty so high.

I wonder if it's a bug/issue with specific browsers. It's near instant on desktop (Windows/FF/7950X3D) and I wouldn't expect the delta to be that large against a modern mobile device.

Safari takes minutes, FF is near instant on a M4 air.

And contrary to the directions, refreshing the page DOES help.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#222

Post by TiredOfLife »

zettabomb wrote: post #215
TiredOfLife wrote: post #214

Earlier quoted context omitted.

Cloudflare checkboxes don't come with pictures of underage girls

Why do you have a problem with this?

I was explaining this part

> how mild the reactions are to Anubis compared to the people reacting to seeing one singular Cloudflare captcha checkbox

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#223

Post by jeroenhd »

its-summertime wrote: post #140
aeyes wrote: post #91

A patch for this was submitted in April: https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.o... Edit: And there was discussion about this back in 2024 as well

For those with difficulty accessing: - - - From: Anthony Hurtado vpk_read_packet() divides vpk->last_block_size and (par->block_align - vpk->last_block_size) by par->ch_layout.nb_channels without checking for zero. While vpk_read_header() validates nb_channels > 0, the codec parameters may become zero through format probing misidentification (VPK probe score is 2/3 of AVPROBE_SCORE_MAX) or codec parameter reset, caus…

Damn, I've never seen Anubis set up that aggressively, I wonder what kind of attack their web servers must be under to set their bot filters up this strictly.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#224

Post by jeroenhd »

inventor7777 wrote: post #151
semiquaver wrote: post #108

Earlier quoted context omitted.

Oddly enough I can’t access that site, it just heats up my phone solving hashes. Gave up after about a minute and anubis had only made it less than halfway through. I doubt the real bots have any trouble bypassing it.

It's puzzling how mild the reactions are to Anubis compared to the people reacting to seeing one singular Cloudflare captcha checkbox. I'd much rather a checkbox than a brief CPU-intensive hashing session.

The proof-of-work approach is much better privacy-wise than what the usual CAPTCHA services are doing.

My ungrounded speakers have a tendency to pop and make noise when they come out of sleep (sleep? on a speaker? fuck you logitec) and every time these "simple" CAPTCHAs come up, even if I pass without solving their logic puzzles, I hear the speakers activate as the Javascript on the page is figuring out what kind of audio setup I have by playing a silent sound file.

The default Anubis config isn't really a problem for any devices I've tried, but the FFMPEG Anubis setup is quite extreme. I seem to be served the extra-difficult Javascript challenge, as well as a high-difficulty challenge, that takes even powerful computers quite a long time to complete.

Could just be countermeasures to the hug of death every website gets when they get linked on HN, though, but someone would need to set up auto-scaling for that.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#225

Post by dclavijo »

OP here: for those interested is not that an LLM found the bugs the fuzzer found them. My take on this matter was to implement as much information theory algorithms as possible, and try to extract as much structure with statistical importance from the binary being fuzzed. Also port as much features from other fuzzers and whie papers on the mater (llms are good at connecting dots across vast codebases and papers). I honestly can not take full credit for this work since I made it with AI, but I has taken two months of my time and 1100+ commits. My developing process was to use several models from several vendors not just Claude that decouples it from a single vendor/model and throws to the flor that llms regurgitate verbatim code. Also the interesting part is the developing pipeline I have had setup my own cicd with my own tool impactguard whitch saved me a couple of times and hard rules on the agent.md(70% to 80% of those rules i wrote them by hand). The pytest testing battery is also interesting, I adopted TDD and to me since I adopted it seems that llms make less bugs. Yes I know the code and the readme might look like ai slop as pointed out earlier but is efective at finding bugs. At the end of the day is all economy: you spend a lot of tokens once and keep the fuzzer forever, not the same as paying every time for tokens to find bugs. As pointed out in the readme, this fuzzer trades speed for edge novelty, maybe there is it's niche. Also we found earlier another bug with this fuzzer https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/23945. For the concerned IMO: rather than the results the methodology is more important. I welcome constructive criticism and feedback. Any input is useful to me.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#226

Post by ShinyLeftPad »

TeMPOraL wrote: post #218
ShinyLeftPad wrote: post #195

Earlier quoted context omitted.

A zero-interaction screen is better. If I can open it in a new tab and then come back and it's fully loaded, it's good.

Unfortunately, those tools are there specifically to detect and block "zero-interaction activity".

I thought it just hashed something...

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#227

Post by throwa356262 »

boomlinde wrote: post #212
throwa356262 wrote: post #209

Earlier quoted context omitted.

Because an attacker would not gain anything he not already has. This is basically local self-DOS.

That's not a quality of ffmpeg or this bug, but of the application you use it for. If you only expose your ffmpeg-based application to your own input then yes, of course it's a self-DOS. But if you, say, expose it as a web service passing arbitrary user input to ffmpeg, that no longer holds.

Even then it will be a self-dos: the video you uploaded won't be processed.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#229

Post by iso1631 »

vachina wrote: post #182
timpera wrote: post #143

Earlier quoted context omitted.

Thank you! I gave up after more than 2 whole minutes of waiting on a high-end smartphone. I'm not sure this keeps bots out, but it definitely keeps users out…

It keeps casual users (which most bots masquerade as) out. For frequent users of that site it is a solve once access forever.

I don't get it, it briefly flashed up on my iphone , about quarter second maybe, then passed on. Does the same in private mode.

Maybe it uses other heuristics like detecting if someone lives in the AI agent world

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#230

Post by iso1631 »

inventor7777 wrote: post #151
semiquaver wrote: post #108

Earlier quoted context omitted.

Oddly enough I can’t access that site, it just heats up my phone solving hashes. Gave up after about a minute and anubis had only made it less than halfway through. I doubt the real bots have any trouble bypassing it.

It's puzzling how mild the reactions are to Anubis compared to the people reacting to seeing one singular Cloudflare captcha checkbox. I'd much rather a checkbox than a brief CPU-intensive hashing session.

proof of work requires my computer do do something and not me

cloudflare requires me to work for them

Post reply on HN