Benjamin Ali glitchfox
Vulnerability research & reverse engineering.
I find and responsibly disclose memory-safety bugs in C/C++ parsers of untrusted input — file-format decoders, network-protocol codecs, and archive libraries. Each finding is fuzzed (AFL++ with AddressSanitizer / UndefinedBehaviorSanitizer), root-caused to the underlying defect, and sent to the maintainer with a minimal proof-of-concept and a verified fix under coordinated disclosure — several already merged upstream with credit. Based in Banbury, UK.
Recent advisories
Recent writeups
-
Three memory-safety bugs in libtsm's terminal escape-sequence parser — but the part worth remembering isn't the bugs, it's how a clean-gate target got chosen from a thin pool, and the moment the fork I fuzzed turned out to be the wrong place to send the report.
-
I reported four memory-safety bugs in zchunk privately; the same afternoon an independent contributor opened a public PR fixing one of them — but not its sibling. The part worth remembering is how a narrow fix leaves a matching hole one field over, and why reporting the whole cluster matters.
-
Client-side memory-safety bugs in libnfs and libsmb2 went nowhere for two weeks, then got fixed within hours of one follow-up — and the parts worth remembering are the disclosure mechanics and the two moments verification saved the report.
Focus
- Parsers & decoders of untrusted input — audio, media, file formats
- Reverse engineering & binary analysis
- Root-causing crashes to the defect, then a verified fix