Benjamin Ali glitchfox
Vulnerability research & reverse engineering.
I find and responsibly disclose memory-safety bugs in C/C++ parsers of untrusted input — file-format decoders, network-protocol codecs, and archive libraries. Each finding is fuzzed (AFL++ with AddressSanitizer / UndefinedBehaviorSanitizer), root-caused to the underlying defect, and sent to the maintainer with a minimal proof-of-concept and a verified fix under coordinated disclosure — several already merged upstream with credit. Based in Banbury, UK.
Recent advisories
Recent writeups
-
Client-side memory-safety bugs in libnfs and libsmb2 went nowhere for two weeks, then got fixed within hours of one follow-up — and the parts worth remembering are the disclosure mechanics and the two moments verification saved the report.
-
libnfs's NFSv4 GETATTR decoder bounds-checked every field read, then forgot to subtract two consumed strings from its remaining-length counter — so the checks passed while the read pointer walked off the reply buffer. A study in how present checks get defeated by absent bookkeeping.
-
A malformed-input path in libebml's EBML reader was already guarded on the v1.x branch but never forward-ported to master — a look at the missing-backport bug class and being wrong about a PoC while still being useful.
Focus
- Parsers & decoders of untrusted input — audio, media, file formats
- Reverse engineering & binary analysis
- Root-causing crashes to the defect, then a verified fix