PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Fuzzing between the lines in popular barcode software

blog.trailofbits.com | blog | #memory-safety | #denial-of-service | #fuzzing | #code-execution | #zbar | #barcode
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Trail of Bits fuzzed the ZBar barcode library despite a limited time budget, uncovering an out-of-bounds stack write that can enable code execution and a memory leak usable for denial of service.
Published
Collected

Related coverage

blog · projectzero.google
Effective Fuzzing: A Dav1d Case Study
A case study on effective fuzzing of dav1d, the open-source AV1 decoder, covering harnessing decisions, coverage strategy, and lessons for hunting codec vulnerabilities.
research · swarm.ptsecurity.com
Attack arithmetic: how an integer overflow in PostgreSQL libpq leads to denial of service
An integer overflow in PostgreSQL libpq's PQescapeInternal() makes it allocate too little and write hundreds of MB past the buffer, segfaulting applications — a denial-of-service vulnerability.
blog · blog.trailofbits.com
A “proof” of Fermat’s Last Theorem that fits the margin
Trail of Bits found a Lean ≤4.33.1 bug: String.Pos.Raw.extract returns a full string where its spec says empty — enough to 'prove' Fermat's Last Theorem. Not a soundness flaw; fixed in 4.34.0-rc1.
blog · bughunters.google.com
Scaling Memory Safety: AI-Assisted Rewrites of C/C++ Dependencies to Rust
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · blog.quarkslab.com
Internship Offers for the 2026-2027 Season
The internship 2026-2027 season at Quarkslab is open! Our internship positions cover a wide range of topics and expertise, and aim at tackling new challenges in various fields.
blog · bishopfox.com
Traefik | Version Through 3.7.11
Bishop Fox found that Traefik's request read timeout is not applied to HTTP/3, letting unauthenticated clients hold upstream connections open indefinitely; releases since 2.8.2 are affected.
Back