In this blog post, we show how we fuzzed the ZBar barcode scanning library and why, despite our limited time budget, we found serious bugs: an out-of-bounds stack buffer write that can lead to arbitrary code execution with a malicious barcode, and a memory leak that can be used to perform a denial-of-service attack. By this point we knew two things about ZBar: it was barely fuzzed (or not fuzzed at all), and we identified starting points for creating our own fuzzing campaign.