AI-assisted fuzzer finds division-by-zero bug in FFmpeg using a 21-byte file

·1 views

Security researcher Darío Clavijo discovered a division-by-zero vulnerability in FFmpeg using a fuzzer built with AI assistance, which he shared on Hacker News this week. The bug resides in libavformat/vpk.c, the demuxer for Sony PS2 VPK audio files, and can crash any FFmpeg-based application that processes a specially crafted 21-byte input file. The fuzzer took just over 10 hours on a single machine and ran nearly 500,000 executions before isolating the deterministic crash, which triggers when the audio channel count is set to zero at a specific byte offset. The crash occurs via a specific custom I/O path used in the fuzzer's harness, meaning standard command-line FFmpeg usage may not reproduce it identically. The vulnerability is rated medium severity — a reliable denial-of-service rather than a code-execution flaw — and the proposed fix involves a two-line guard on the channel count variable.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Use Excel for Data Analytics: Cleaning an 876-Row HR Dataset

Microsoft Excel remains one of the most widely used tools for data organization, exploration, and cleaning due to its accessible interface. A practical exercise involves working with a deliberately 'dirty' HR dataset containing 876 employee records across 21 columns. The dataset includes attributes such as Employee ID, First Name, and Last Name, each stored in separate columns representing individual variables. In Excel, rows correspond to individual records — in this case, one row per employee — while cells hold specific data values. Understanding this foundational structure is the first step toward performing meaningful data cleaning and analysis.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

pdf-inspector Routes PDFs Before OCR, Cutting Unnecessary Processing Costs

A new open-source library called pdf-inspector aims to reduce the cost and time of document-ingestion pipelines by classifying PDFs before deciding whether to apply OCR. The tool detects whether a PDF contains native text, scanned images, or a mix of both, and routes only the pages that genuinely lack usable text to the OCR engine. For text-based pages, it extracts content locally and converts it to Markdown, preserving structure such as headings, tables, lists, and reading order. The library is available for Python, Node.js, and WebAssembly, making it usable across server and browser environments. A benchmark against a 200-document corpus published by the project in July 2026 reported strong table and reading-order scores, though developers are advised to test against their own document sets before deploying to production.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How 125B-Parameter AI Models Work by Activating Only a Fraction at a Time

Large AI models can carry 125 billion parameters yet activate only around 6 billion for each token they process, a design that puzzles many users encountering these specs for the first time. This is made possible by an architecture called Mixture of Experts (MoE), where the model is divided into multiple specialized groups of parameters known as experts. A routing component decides which experts are engaged for any given token, meaning the full parameter count is never used all at once. The approach allows developers to build models with vast total capacity while keeping per-token computation manageable and efficient. As a result, a 125B MoE model can deliver broad capability without the cost of running all 125 billion parameters on every single inference step.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Static analysis rules are hypotheses, not facts — a ComfyUI tool learned that the hard way

A developer built a tool to predict which ComfyUI custom node packs would break after upstream updates, initially focusing on missing import names. After extending the tool to detect mismatched function signatures — a common source of TypeErrors — the developer tested it against 1,273 Python files from the 20 most popular node packs before release. Manual verification revealed two critical false-positive patterns: calls to locally redefined functions were wrongly flagged as breaks, and runtime compatibility checks using dead-code branches were misread as failures. The developer notes that different static analysis rules warrant different tolerance thresholds depending on the cost of a wrong answer — a false positive on a build check is far more damaging than one on a passive warning. The core lesson is that a rule derived from a specification is only a hypothesis until validated against real-world code.

0 comments Read more at DEV Community