Post

Developed with Codex. I saw exceptions from bulk_extractor’s winpe scanner and asked Codex to reproduce them, trace execution, find the cause, and prepare a tested fix. It did: github.com/simsong/bulk... A thread 🧵

The PE metadata implied an executable extent of 24,390,512 bytes—beyond the bytes available to this scanner invocation. The input-derived length reached sbuf_t, whose bounds check rejected the slice with a controlled exception.

This was not exploitable out-of-bounds access: reads and slices are mediated by sbuf_t. The fix preserves the recognized PE feature, skips an incomplete carve, safely hashes short buffers, and adds a real-fixture regression test.