HTTP/2 is by far the most popular HTTP version, yet in practice, HTTP connections rarely occur over end-toend HTTP/2. This is due in large part to the fact that reverse proxies such as Content Delivery Networks (CDNs) between the client and server universally support HTTP/2 on the client side of the connection, but rarely on the server side. Proxies must therefore dynamically convert between HTTP/2 and HTTP/1, and anomalies in this conversion process can lead to critical vulnerabilities. Prior work proposed generational fuzzing techniques to discover these anomalies. However, such an approach lacks meaningful feedback, limiting the expressiveness of the generated requests and the number of anomalies it can induce. We, therefore, propose H2Fuzz, a black-box differential fuzzer for HTTP/2 which uses a comprehensive mutator and novel feedback system to drive a set of reverse proxies to increasingly divergent behavior, uncovering conversion anomalies in the process. We fuzz a set of 11 standalone reverse proxies and 5 CDNs with H2FUZZ, and find that it induces $50 \%$ more conversion anomalies than the state-of-the-art, many of which have immediate security implications.

We approach the problem of 2D and 3D puzzle solving by matching the geometric features of puzzle pieces three at a time. First, we define an affinity measure for a pair of pieces in two stages, one based on a coarse-scale representation of curves and one based on a fine-scale elastic curve matching method. This re-examination of the top coarse-scale matches at the fine scale results in an optimal relative pose as well as a matching cost which is used as the affinity measure for a pair of pieces. Pairings with overlapping boundaries are impossible and are removed from further consideration, resulting in a set of top valid candidate pairs. Second, triples arising from generic junctions are formed from this rank-ordered list of pairs. The puzzle is solved by a recursive grouping of triples using a best-first search strategy, with backtracking in the case of overlapping pieces. We also generalize aspects of this approach to matching of 3D pieces. Specifically, ridges of 3D fragments scanned using a laser range finder are detected using a dynamic programming method. A pair of ridges are matched using a generalization of the 2D curve matching approach to space curves by using an energy solution involving curvature and torsion, which are computed using a novel robust numerical method. The reconstruction of map fragments and broken tiles using this method is illustrated.