We found a division by zero bug in FFmpeg with a vibecoded fuzzer
Points and comments are a snapshot, not live.
A 21-byte crafted VPK file triggers an integer divide-by-zero in FFmpeg's demuxer.
A fuzzer found a SIGFPE crash in FFmpeg's VPK demuxer (`vpk_read_packet`). The root cause is missing a check for zero channels before dividing `vpk->last_block_size` by `nb_channels`. A 21-byte malicious input can crash any FFmpeg-based application that opens a crafted `.vpk` file. The author evaluates severity as medium (reliable DoS, no code execution) and proposes adding a guard to return `AVERROR_INVALIDDATA` for zero-channel streams.
What commenters are saying
Commenters discuss AI's role in software quality. Some argue that LLM-based fuzzers find real bugs cheaply and that the value is in reproducible test cases. Others contend that AI-generated code introduces bloat and subtle bugs that waste more time than they save. A few suggest that strong type systems or formal methods could mitigate risks, though note that Haskell's type system would not easily prevent this numeric bug. The author of the report already included a suggested fix and patch.