EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Hacker News·Aug 27·5 min read
We found a division by zero bug in FFmpeg with a vibecoded fuzzer
TL;DR
A division by zero bug was discovered in FFmpeg using the vibecoded fuzzer, which can crash applications handling malicious .vpk files. This vulnerability arises from a malformed VPK header setting the number of audio channels to zero.
✦ Why It Matters
Ensure your FFmpeg-based applications validate input files to prevent crashes from this vulnerability.
Key Takeaways
- Review and validate audio channel counts in demuxers.
- Use fuzzing tools to identify similar vulnerabilities.
- Implement error handling for zero divisors in code.
- Stay updated on FFmpeg patches and security advisories.
How It Works
The bug occurs in the vpk_read_packet function, where the last block size is divided by the number of channels. If the number of channels is zero due to a malformed header, this results in a SIGFPE error.
The fuzzer generated a specific input that exploits this flaw, demonstrating how crafted data can lead to application crashes.