Internet Bug Bounty: Buffer over-write in finfo_open with malformed magic file.

https://bugs.php.net/bug.php?id=71527 This bug causes a segfault when running with environment variable USEZENDALLOC set to 0, and also when compiled with ASAN with USEZENDALLOC set and unset. To reproduce, run the following PHP file, with the example magic file below. $ cat magic-open.php Magic...

yara/dex_fuzzer: Heap-buffer-overflow in read_uleb128

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=5664859499266048 Project: yara Fuzzer: libFuzzeryaradexfuzzer Fuzz target binary: dexfuzzer Job Type: libfuzzerasanyara Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

libidn2/libidn2_to_ascii_8z_fuzzer: Heap-buffer-overflow in idn2_to_ascii_4i

Project: https://gitlab.com/libidn/libidn2.git Detailed report: https://oss-fuzz.com/testcase?key=5644466457673728 Project: libidn2 Fuzzer: libFuzzerlibidn2toascii8zfuzzer Fuzz target binary: libidn2toascii8zfuzzer Job Type: libfuzzerasanlibidn2 Platform Id: linux Crash Type: Heap-buffer-overflow...

libxml2/libxml2_xml_reader_for_file_fuzzer: Heap-double-free in xmlFreeID

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed report: https://oss-fuzz.com/testcase?key=5633679915745280 Project: libxml2 Fuzzer: afllibxml2xmlreaderforfilefuzzer Fuzz target binary: libxml2xmlreaderforfilefuzzer Job Type: aflasanlibxml2 Platform Id: linux Crash Type:...

radare2/ia_fuzz: Heap-buffer-overflow in r_read_le32

Project: https://github.com/radare/radare2.git https://github.com/radareorg/radare2.git Detailed report: https://oss-fuzz.com/testcase?key=5741698980773888 Project: radare2 Fuzzer: aflradare2iafuzz Fuzz target binary: iafuzz Job Type: aflasanradare2 Platform Id: linux Crash Type:...

ffmpeg/ffmpeg_AV_CODEC_ID_HYMT_fuzzer: Crash in ff_add_left_pred_unaligned_avx2

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=5722087214284800 Project: ffmpeg Fuzzer: libFuzzerffmpegAVCODECIDHYMTfuzzer Fuzz target binary: ffmpegAVCODECIDHYMTfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: UNKNOWN WRITE Crash...

ffmpeg/ffmpeg_AV_CODEC_ID_HYMT_fuzzer: Crash in ff_bswap32_buf_avx2

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=5662313959391232 Project: ffmpeg Fuzzer: aflffmpegAVCODECIDHYMTfuzzer Fuzz target binary: ffmpegAVCODECIDHYMTfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

gdal/gdal_translate_fuzzer: Heap-buffer-overflow in VSIMemHandle::Read

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5757307697233920 Project: gdal Fuzzer: libFuzzergdaltranslatefuzzer Fuzz target binary: gdaltranslatefuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash...

openvswitch/ofctl_parse_target: Heap-buffer-overflow in encode_LEARN

Project: https://github.com/openvswitch/ovs.git Detailed report: https://oss-fuzz.com/testcase?key=5651435740463104 Project: openvswitch Fuzzer: libFuzzeropenvswitchofctlparsetarget Fuzz target binary: ofctlparsetarget Job Type: libfuzzerasanopenvswitch Platform Id: linux Crash Type:...

harfbuzz/hb-shape-fuzzer: Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5631444412530688 Project: harfbuzz Fuzzer: libFuzzerharfbuzzhb-shape-fuzzer Fuzz target binary: hb-shape-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow...

tidy-html5/tidy_fuzzer: Crash in GetSurrogatePair

Project: https://github.com/htacg/tidy-html5.git Detailed report: https://oss-fuzz.com/testcase?key=5123069669015552 Project: tidy-html5 Fuzzer: libFuzzertidy-html5tidyfuzzer Fuzz target binary: tidyfuzzer Job Type: libfuzzerasantidy-html5 Platform Id: linux Crash Type: UNKNOWN READ Crash Address...

envoy/h1_capture_fuzz_test: Crash in Envoy::TestUtility::findCounter

Detailed report: https://oss-fuzz.com/testcase?key=5760304764420096 Project: envoy Fuzzer: libFuzzerenvoyh1capturefuzztest Fuzz target binary: h1capturefuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7f23827ad980 Crash State:...

openvswitch/odp_target: Heap-buffer-overflow in format_generic_odp_key

Project: https://github.com/openvswitch/ovs.git Detailed report: https://oss-fuzz.com/testcase?key=5691937953153024 Project: openvswitch Fuzzer: libFuzzerodptarget Fuzz target binary: odptarget Job Type: libfuzzerasanopenvswitch Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

harfbuzz/hb-subset-fuzzer: Heap-double-free in hb_vector_t<CFF::op_str_t, 8u>::fini

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5695865298092032 Project: harfbuzz Fuzzer: libFuzzerhb-subset-fuzzer Fuzz target binary: hb-subset-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Heap-double-free Crash...

grpc/api_fuzzer: Heap-use-after-free in grpc_core::channelz::CallCountingHelper::RecordCallFailed

Detailed report: https://oss-fuzz.com/testcase?key=5717773926268928 Project: grpc Fuzzer: libFuzzerapifuzzer Fuzz target binary: apifuzzer Job Type: libfuzzerasangrpc Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x60e0000012d0 Crash State:...

imagemagick/ping_jps_fuzzer: Heap-buffer-overflow in ParseInternalDoctype

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5701330543312896 Project: imagemagick Fuzzer: libFuzzerpingjpsfuzzer Fuzz target binary: pingjpsfuzzer Job Type: libfuzzerasanimagemagick Platform Id: linux Crash Type: Heap-buffer-overflow...

clamav/clamav_scanmap_PDF_fuzzer: Heap-buffer-overflow in pdf_nextlinestart

Detailed report: https://oss-fuzz.com/testcase?key=5168958492114944 Project: clamav Fuzzer: aflclamavscanmapPDFfuzzer Fuzz target binary: clamavscanmapPDFfuzzer Job Type: aflasanclamav Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x611000188a6a Crash State:...

curl/curl_fuzzer_ftp: Crash in ftp_disconnect

Project: https://github.com/curl/curl.git Detailed report: https://oss-fuzz.com/testcase?key=5176327364149248 Project: curl Fuzzer: libFuzzercurlfuzzerftp Fuzz target binary: curlfuzzerftp Job Type: libfuzzerasancurl Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0000000015b0 Crash...

clamav/clamav_scanfile_PDF_fuzzer: Heap-buffer-overflow in pdf_parseobj

Detailed report: https://oss-fuzz.com/testcase?key=5727598227750912 Project: clamav Fuzzer: aflclamavscanfilePDFfuzzer Fuzz target binary: clamavscanfilePDFfuzzer Job Type: aflasanclamav Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x60900001fd8f Crash State:...

clamav/clamav_scanmap_OLE2_fuzzer: Heap-buffer-overflow in uniq_add

Detailed report: https://oss-fuzz.com/testcase?key=5744082379341824 Project: clamav Fuzzer: aflclamavscanmapOLE2fuzzer Fuzz target binary: clamavscanmapOLE2fuzzer Job Type: aflasanclamav Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0x60c000000e48 Crash State: uniqadd...