FFmpeg VPK Demuxer Vulnerability: Divide-by-Zero Denial of Service

A medium-severity vulnerability has been identified in FFmpeg's VPK demuxer that causes a crash when processing malformed files. The crash is triggered by an integer divide-by-zero error when the number of audio channels is set to zero in the file header. The author recommends implementing a simple check in the source code to reject such invalid data and prevent the application from crashing.

Key Points

• A vulnerability in the VPK demuxer allows a 21-byte malicious file to crash FFmpeg-based applications.
• The root cause is a missing check for zero channels in the vpk_read_packet function, leading to a divide-by-zero exception (SIGFPE).
• The bug was identified using a specialized fuzzer and is highly deterministic and easy to reproduce.
• The issue is categorized as a Denial of Service (DoS) rather than a code-execution exploit because it does not involve memory corruption.
• A fix is proposed to return an error code (AVERROR_INVALIDDATA) if nb_channels is zero at the start of the packet reading process.

Sentiment

Cautiously optimistic; users are impressed by the utility of AI for security auditing but remain skeptical of its autonomy and the quality of its fixes.

In Agreement

• AI agents are cost-effective for open-ended bug hunting because they don't require a salary and can work indefinitely.
• LLMs can find real bugs that humans might miss or lack the time to look for.
• Using AI to generate fuzzers is faster than manually developing complex looping algorithms.
• AI can be a net positive for software security if it successfully identifies exploitable vulnerabilities.

Opposed

• The time saved finding bugs may be offset by the time required for humans to review, clean up, and verify the AI's output.
• Generating malformed input is the easy part of fuzzing; the hard part is generating valid complex inputs that reach deep call stacks.
• There is a risk that AI-generated code or fixes could subtly break other parts of a system.
• It is not yet clear if AI provides a net time savings when the entire development lifecycle is considered.