News for hackers. Stuff that matters.
Re:Fuzzing FFmpeg for fun and profit by jamesrom on Sunday November 01, 2015 @11:53PM (#10490058)
Can someone explain why you would want to fuzz ffmpeg?

What's wrong with ffmpeg crashing when you feed it invalid input? What's the alternative to it not crashing? Should it continue transcoding or should it exit quietly?

What's the problem here trying to be solved?

Re:Fuzzing FFmpeg for fun and profit by 001spartan on Monday November 02, 2015 @12:09AM (#10490124)
Fuzzing is useful for finding bugs that may or may not be serious security issues. If a program crashes when you feed it invalid input, it could potentially crash in a way that allows code execution.

After finding a crash, a researcher will generally explore this to see if it allows for arbitrary code execution. If it does, it is possible for someone to create a weaponized exploit.

For a utility as widely-used as ffmpeg, any bugs pose a threat to many systems. Fuzzing it makes the Linux ecosystem safer for all of us (hopefully).

Re:Fuzzing FFmpeg for fun and profit by mikeash on Monday November 02, 2015 @12:12AM (#10490134)
The alternative to crashing is exiting cleanly with an error. A crash can often be transformed into remote code execution with some work. That would mean that your computer could be taken over if you transcode the wrong video using ffmpeg. Which is pretty wrong.
Re:Fuzzing FFmpeg for fun and profit by baz_ on Monday November 02, 2015 @12:14AM (#10490145)
There is nothing wrong with crashing if you can do it in a "safe" manner. If an invalid input allows an attacker to take over your computer, then that is a problem :). Especially for something as wide-spread as ffmpeg.
Re:Fuzzing FFmpeg for fun and profit by PepeGomez on Monday November 02, 2015 @02:32AM (#10490533)
Video can often come from a less than perfectly reliable source (eg. satellite downlink), so video transcoders should be able to handle errors as gracefully as possible.
Re:Fuzzing FFmpeg for fun and profit by eli on Sunday November 01, 2015 @11:57PM (#10490072)
It's built into many products and workflows that accept user submitted content.