Division by Zero Bug Found in FFmpeg's Sony PS2 VPK Demuxer

A security researcher has identified a medium-severity integer divide-by-zero vulnerability within FFmpeg's Sony PlayStation 2 VPK demuxer. The flaw allows a specially crafted file to trigger a deterministic crash in any application utilizing the FFmpeg library to process VPK data.

The vulnerability is located in the `vpk_read_packet` function within `libavformat/vpk.c` at line 89. According to the FFmpeg issue tracker, the crash occurs when the software attempts to divide `vpk->last_block_size` by `par->ch_layout.nb_channels` without first verifying that the number of channels is non-zero. A crafted input of only 21 bytes is sufficient to trigger a SIGFPE arithmetic exception, resulting in an immediate application crash.

Technical Context

The VPK demuxer is designed to read audio blocks from a custom container format associated with the Sony PlayStation 2. While the `vpk_read_header` function typically includes validation for channel counts, the researcher discovered that a divergence in a custom-AVIO path allowed the `vpk_read_packet` function to be reached with a zero divisor. The bug was uncovered using a specialized fuzzer available via GitHub at the daedalus/fuzzer repository.

Industry Implications

While the flaw does not involve memory corruption and therefore does not allow for remote code execution, it provides a reliable Denial-of-Service (DoS) primitive. Any software that employs FFmpeg's `avformat_open_input` and `av_read_frame` functions on untrusted VPK data is susceptible to this crash. For applications that automatically process user-uploaded media, this represents a significant stability risk, as a single malicious file can take down the processing service.

Next Steps

Developers utilizing FFmpeg are encouraged to monitor the project's official releases for a patch that implements the necessary non-zero verification for channel layouts in the VPK demuxer. Until such a fix is deployed, the primary mitigation is to restrict the processing of untrusted VPK files or implement additional validation layers before passing data to the `libavformat` library.