Writeups
Root-cause deep dives and research notes. Browse by tag →
-
A null dereference in libE57Format's XML parser, found by fuzzing the E57 point-cloud decoder. The interesting part isn't the bug — it's that the corpus which found it had to be generated by the library itself, and that the reproducer wasn't real until its checksums were repaired.
- Writing firmware for a watch that had none published: reverse engineering the Ollee Watch One 25 Aug 2026
An STM32WB board that turns a Casio F-91W into a smartwatch, with no public documentation. Its own firmware gave up the display map, the character font and two undocumented BLE commands — enough to write a replacement that kept time on my wrist. Then I bricked it with four bytes of vector table.
-
Three memory-safety bugs in libtsm's terminal escape-sequence parser — but the part worth remembering isn't the bugs, it's how a clean-gate target got chosen from a thin pool, and the moment the fork I fuzzed turned out to be the wrong place to send the report.
-
I reported four memory-safety bugs in zchunk privately; the same afternoon an independent contributor opened a public PR fixing one of them — but not its sibling. The part worth remembering is how a narrow fix leaves a matching hole one field over, and why reporting the whole cluster matters.
-
Client-side memory-safety bugs in libnfs and libsmb2 went nowhere for two weeks, then got fixed within hours of one follow-up — and the parts worth remembering are the disclosure mechanics and the two moments verification saved the report.
-
libnfs's NFSv4 GETATTR decoder bounds-checked every field read, then forgot to subtract two consumed strings from its remaining-length counter — so the checks passed while the read pointer walked off the reply buffer. A study in how present checks get defeated by absent bookkeeping.
-
A malformed-input path in libebml's EBML reader was already guarded on the v1.x branch but never forward-ported to master — a look at the missing-backport bug class and being wrong about a PoC while still being useful.
- From fuzzer crash to credible disclosure 21 Jul 2026
A practical workflow for turning parser crashes into verified, coordinated vulnerability disclosures.
-
A fuzzing-plus-static-review session against libConfuse turned up a null-pointer dereference in its comment lexer — the smallest reproducer is a single byte, and the story is about minimal-PoC discipline.
-
Two bugs in basis_universal's KTX2 parser with the same root shape — a size check written as integer arithmetic on attacker-controlled numbers that overflow. A 16 GiB allocation bomb and a wrap-past-the-bounds-check out-of-bounds read.
-
A short, targeted fuzzing session against dr_libs turned up a heap out-of-bounds read in dr_flac's SEEKTABLE metadata handling — and the interesting part was the discipline around the bug, not the bug.