Hi, the immediate trigger of the bug is fixed by commit https://dev.lovelyhq.com/libburnia/libisofs/commit/91490d5f34422d514b042a9e597be8d614a3a1ea "Preventing use of zero sized SUSP CE entry which causes SIGSEGV. Debian bug 872590. Thanks Jakub Wilk and American Fuzzy Lop."
Further i installed a size curb for loading CE areas. For that i now only read the amount of blocks which is necessary and refuse on more than 1 MiB. https://dev.lovelyhq.com/libburnia/libisofs/commit/31088d9acc154779975da0eb429fb680971274f9 "Avoid to read blocks from start of CE area which do not belong to the given file" A test for proper block addresses of CE areas was added: https://dev.lovelyhq.com/libburnia/libisofs/commit/2a64d89e6e6fee4893ab4809342870acba0ea465 "Refuse to read CE data blocks from after the end of ISO filesystem" If the second or third change are bad, then the regression consequences are severe. So i compared ISO reading of xorriso-1.4.6 with the one of development version 1.4.7. The results got cleaned of systematic differences by a few sed expressions: xorriso=... path to xorriso 1.4.6 or 1.4.7 ... run=... "old" or "new" ... for i in *.iso do valgrind "$xorriso" \ -report_about note -for_backup -hfsplus on \ -indev "$i" \ -find / -exec lsdl -- \ -find / -has_any_xattr -exec get_any_xattr -- \ -find / -exec getfacl -- \ 2>&1 done \ | sed \ -e 's/^==[0-9][0-9]*=//' \ -e 's/xorriso 1.4.[67]/xorriso 1.4.X/g' \ -e 's/^= Command:.*$//' \ -e 's/^= total heap usage:.*$//' \ >/tmp/log_"$run" Comparison of both log files yields only insignifcant differences and the improvements which were achieved by fixing the recent bugs found by AFL. The log file size with my ISO 9660 collection is 90 MB. So there is a decent statistical base. Have a nice day :) Thomas