Blue-teaming for Exiv2: three rules of bug fixing for better OSS security

When you’re fixing a bug, especially a security vulnerability, you should add a regression test, fix the bug, and find & fix variants.