extracting-nday-from-a-patch

# Extracting n-day from a patch: the fix is the map A security fix is a confession. It tells you exactly where the bug was, what the missing check should have been, and, by omission, which other paths the author did not think to cover. Reading a patch backward, from fix to bug, is one of the highest-yield techniques in vulnerability research: the hard part (locating the defect) is already done for you, and the incomplete fixes are waiting. ## When to use - A fix commit or security release landed and you want to know what it addressed. - An advisory is deliberately vague but links a diff, a PR, or a tag. - You maintain or depend on a fork and need to know if a fix upstream applies. - You confirmed one bug via its patch and want the instances the patch missed. ## Scope check You may read and reason about public patches and advisories freely. You may only *test or exploit* against code and systems you are authorized for (your own, OSS you run, CTF, in-scope engagement). Analysis is not authorization to attack. ## The loop 1. **Read the fix, infer the bug.** Look at what the patch *adds* or *tightens*, and name the vulnerability it implies. A new length or bounds check implies an out-of-bounds read or write. A new authorization call implies missing access control. A new escape or parameterization implies injection. A new normalization implies traversal or confusion. The added guard tells you the invariant that was being violated. 2. **Locate the pre-patch s...