With an eye toward performance, interoperability, or legacy concerns, low-level system
software often must parse binary encoded data formats. Few tools are available for this task …

Vulnerability management strategy, from both organizational and public policy perspectives,
hinges on an understanding of the supply of undiscovered vulnerabilities. If the number of …

Despite decades of contributions to the theoretical foundations of parsing and the many
tools available to aid in parser development, many security attacks in the wild still exploit …

Safety-and security-critical developers have long recognized the importance of applying a
high degree of scrutiny to a system's (or subsystem's) I/O messages. However, lack of care in …

Any computer program processing input from the user or network must validate the input.
Input-handling vulnerabilities occur in programs when the software component responsible …

ICC profiles are widely used to provide faithful digital color reproduction across a variety of
devices, such as monitors, printers, and cameras. In this paper, we document our efforts on …

In many practical and security-critical formats, the interpretation of a document segment as a
Document Object Model (DOM) graph depends on a concept of reference and complex …

Abstract We introduce Contiguity Types, a formalism for network message formats, aimed
especially at self-describing formats. Contiguity types provide an intermediate layer between …

File formats specify how data is encoded for persistent storage. They cannot be formalized
as context-free grammars since their specifications include context-sensitive patterns such …

Since parsers are the line of defense between binaries and untrusted data, they are some of
the most common sources of vulnerabilities in software. Language-Theoretic Security …