  A blind spot is any input to a program that can be arbitrarily mutated
without affecting the program's output. Blind spots can be used for
steganography or to embed malware payloads. If blind spots overlap file format
keywords, they indicate parsing bugs that can lead to exploitable
differentials. For example, one could craft a document that renders one way in
one viewer and a completely different way in another viewer. They have also
been used to circumvent code signing in Android binaries, to coerce certificate
authorities to misbehave, and to execute HTTP request smuggling and parameter
pollution attacks. This paper formalizes the operational semantics of blind
spots, leading to a technique based on dynamic information flow tracking that
automatically detects blind spots. An efficient implementation is introduced
and evaluated against a corpus of over a thousand diverse PDFs parsed through
MuPDF, revealing exploitable bugs in the parser. All of the blind spot
classifications are confirmed to be correct and the missed detection rate is no
higher than 11%. On average, at least 5% of each PDF file is completely ignored
by the parser. Our results show promise that this technique is an efficient
automated means to detect exploitable parser bugs, over-permissiveness and
differentials. Nothing in the technique is tied to PDF in general, so it can be
immediately applied to other notoriously difficult-to-parse formats like ELF,
X.509, and XML.
