#cwe-476
2 writeups.
-
A null dereference in libE57Format's XML parser, found by fuzzing the E57 point-cloud decoder. The interesting part isn't the bug — it's that the corpus which found it had to be generated by the library itself, and that the reproducer wasn't real until its checksums were repaired.
-
A fuzzing-plus-static-review session against libConfuse turned up a null-pointer dereference in its comment lexer — the smallest reproducer is a single byte, and the story is about minimal-PoC discipline.