C, C++ and Rust

Fuzz a parser and turn crashes into lasting regressions

Build a narrow harness, observe memory and resource failures, minimize the input, and test the repaired parser.

Testing · Developers, AppSec engineers

Find, fix and contain memory-safety bugs in C and C++

Recognize out-of-bounds access, use after free, NULL dereference and integer overflow in C and C++, fix them with checked lengths and single ownership, harden release builds, catch the rest with sanitizers and fuzzing, and plan new code in a memory-safe language.

Development, Testing · Developers, Platform engineers and SREs

Audit unsafe Rust, FFI boundaries and crate dependencies

Know what the Rust compiler proves and what it leaves to you: review unsafe code for soundness, wrap foreign calls in small safe functions, decide how overflow and panics behave in release builds, gate crates with RustSec, and replace C one boundary at a time.

Development · Developers, AppSec engineers

Case study: the xz Utils backdoor (CVE-2024-3094)

How a multi-year maintainer takeover planted a backdoor in xz Utils release tarballs, how build-time injection hid it from the git repository, why a performance anomaly exposed it, which systems shipped it, and what it teaches about reproducible builds and maintainer health.

Development, Release, Maintenance, Security program · Developers, AppSec engineers, Platform engineers and SREs

Buffer over-read lab: Stop a heartbeat over-read

A model of C memory: a TLS heartbeat handler echoes as many bytes as the request claims, not as many as arrived, so a short request returns the next client’s cookie, as Heartbleed did. Add the bounds checks.