<story><title>Fuzzing FFmpeg for fun and profit</title><url>http://obe.tv/about-us/obe-blog/item/26-fuzzing-ffmpeg-for-fun-and-profit</url></story><parent_chain><item><author>jamesrom</author><text>Can someone explain why you would want to fuzz ffmpeg?&lt;p&gt;What&amp;#x27;s wrong with ffmpeg crashing when you feed it invalid input? What&amp;#x27;s the alternative to it not crashing? Should it continue transcoding or should it exit quietly?&lt;p&gt;What&amp;#x27;s the problem here trying to be solved?</text></item></parent_chain><comment><author>001spartan</author><text>Fuzzing is useful for finding bugs that may or may not be serious security issues. If a program crashes when you feed it invalid input, it could potentially crash in a way that allows code execution.&lt;p&gt;After finding a crash, a researcher will generally explore this to see if it allows for arbitrary code execution. If it does, it is possible for someone to create a weaponized exploit.&lt;p&gt;For a utility as widely-used as ffmpeg, any bugs pose a threat to many systems. Fuzzing it makes the Linux ecosystem safer for all of us (hopefully).</text></comment>
<story><title>Fuzzing FFmpeg for fun and profit</title><url>http://obe.tv/about-us/obe-blog/item/26-fuzzing-ffmpeg-for-fun-and-profit</url></story><parent_chain><item><author>jamesrom</author><text>Can someone explain why you would want to fuzz ffmpeg?&lt;p&gt;What&amp;#x27;s wrong with ffmpeg crashing when you feed it invalid input? What&amp;#x27;s the alternative to it not crashing? Should it continue transcoding or should it exit quietly?&lt;p&gt;What&amp;#x27;s the problem here trying to be solved?</text></item></parent_chain><comment><author>baz_</author><text>There is nothing wrong with crashing if you can do it in a &amp;quot;safe&amp;quot; manner. If an invalid input allows an attacker to take over your computer, then that is a problem :). Especially for something as wide-spread as ffmpeg.</text></comment>