Integer Divide-by-Zero in `vpk_read_packet` (VPK Demuxer)
code.ffmpeg.org
Hello. This is a bug found with our fuzzer: https://github.com/daedalus/fuzzer/ **File**: `libavformat/vpk.c:89` **Severity**: Medium — crafted 21-byte input crashes any FFmpeg-based application that opens a malicious `.vpk` file or stream **Root cause**: `vpk_read_packet` divides `vpk->l...
  • sxh3mr@discuss.tchncs.deEnglish
    71·
    2 days ago

    With a history like ffmpegs, it’s just very likely that fuzzer findings have already been reported once. That the fuzzer is vibecoded is kinda irrelevant