“Even with this simple approach, we managed to find some bugs in the library.”
ZBar is a C barcode library, and Trail of Bits found no public record of anyone fuzzing it. A tiny image harness turned up a stack out-of-bounds write in lookup_sequence, CVE-2023-40890. Error paths skip memory cleanup, so repeated scans of hostile codes exhaust memory. Every barcode is untrusted input and nobody had bothered to check.