#fuzzing
8 writeups.
-
A null dereference in libE57Format's XML parser, found by fuzzing the E57 point-cloud decoder. The interesting part isn't the bug — it's that the corpus which found it had to be generated by the library itself, and that the reproducer wasn't real until its checksums were repaired.
-
Three memory-safety bugs in libtsm's terminal escape-sequence parser — but the part worth remembering isn't the bugs, it's how a clean-gate target got chosen from a thin pool, and the moment the fork I fuzzed turned out to be the wrong place to send the report.
-
I reported four memory-safety bugs in zchunk privately; the same afternoon an independent contributor opened a public PR fixing one of them — but not its sibling. The part worth remembering is how a narrow fix leaves a matching hole one field over, and why reporting the whole cluster matters.
-
Client-side memory-safety bugs in libnfs and libsmb2 went nowhere for two weeks, then got fixed within hours of one follow-up — and the parts worth remembering are the disclosure mechanics and the two moments verification saved the report.
-
A malformed-input path in libebml's EBML reader was already guarded on the v1.x branch but never forward-ported to master — a look at the missing-backport bug class and being wrong about a PoC while still being useful.
- From fuzzer crash to credible disclosure 21 Jul 2026
A practical workflow for turning parser crashes into verified, coordinated vulnerability disclosures.
-
A fuzzing-plus-static-review session against libConfuse turned up a null-pointer dereference in its comment lexer — the smallest reproducer is a single byte, and the story is about minimal-PoC discipline.
-
A short, targeted fuzzing session against dr_libs turned up a heap out-of-bounds read in dr_flac's SEEKTABLE metadata handling — and the interesting part was the discipline around the bug, not the bug.