skia/api_raster_n32_canvas: Heap-buffer-overflow in void sse2::memsetT<unsigned int>

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5761078466707456 Project: skia Fuzzer: aflskiaapirastern32canvas Fuzz target binary: apirastern32canvas Job Type: aflasanskia Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Addres...

WebRTC - FEC Out-of-Bounds Read Exploit

Exploit for multiple platform in category dos / poc There is an out-of-bounds read in FEC processing in WebRTC. If a very short RTP packet is received, FEC will assume the packet is longer and process data outside of the allocated buffer. This bug causes the following ASAN crash: ==109993==ERROR:...

WebRTC - VP9 Processing Use-After-Free Exploit

Exploit for multiple platform in category dos / poc There is a use-after-free in VP9 processing in WebRTC. In the method RtpFrameReferenceFinder::ManageFrameVp9 the following code occurs: auto gofinfoit = gofinfo.findcodecheader.temporalidx == 0 ? codecheader.tl0picidx - 1 : codecheader.tl0picidx...

unicorn/fuzz_emu_x86_32: Crash in helper_pcmpestrm_xmm

Project: https://github.com/unicorn-engine/unicorn.git Detailed report: https://oss-fuzz.com/testcase?key=5651790742159360 Project: unicorn Fuzzer: aflunicornfuzzemux8632 Fuzz target binary: fuzzemux8632 Job Type: aflasanunicorn Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

WebRTC - FEC Out-of-Bounds Read

There is an out-of-bounds read in FEC processing in WebRTC. If a very short RTP packet is received, FEC will assume the packet is longer and process data outside of the allocated buffer. This bug causes the following ASAN crash: ==109993==ERROR: AddressSanitizer: heap-buffer-overflow on address...

WebRTC - VP9 Processing Use-After-Free

There is a use-after-free in VP9 processing in WebRTC. In the method RtpFrameReferenceFinder::ManageFrameVp9 the following code occurs: auto gofinfoit = gofinfo.findcodecheader.temporalidx == 0 ? codecheader.tl0picidx - 1 : codecheader.tl0picidx; ... // snip info = &gofinfoit-second; // Clean up...

WebRTC - FEC Out-of-Bounds Read

WebRTC - FEC Out-of-Bounds Read There is an out-of-bounds read in FEC processing in WebRTC. If a very short RTP packet is received, FEC will assume the packet is longer and process data outside of the allocated buffer. This bug causes the following ASAN crash: ==109993==ERROR: AddressSanitizer:...

libreoffice/docxfuzzer: Heap-buffer-overflow in emfplushelper::EmfPlusHelperData::processEmfPlusData

Detailed report: https://oss-fuzz.com/testcase?key=5682069892497408 Project: libreoffice Fuzzer: afllibreofficedocxfuzzer Fuzz target binary: docxfuzzer Job Type: aflasanlibreoffice Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x60500012e124 Crash State:...

keystone/fuzz_asm_x86_16: Heap-use-after-free in llvm_ks::X86Operand::getToken

Detailed report: https://oss-fuzz.com/testcase?key=5740417828519936 Project: keystone Fuzzer: libFuzzerkeystonefuzzasmx8616 Fuzz target binary: fuzzasmx8616 Job Type: libfuzzerasankeystone Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x60d0000003a8 Crash State:...

unicorn/fuzz_emu_m68k_be: Crash in [stack]

Project: https://github.com/unicorn-engine/unicorn.git Detailed report: https://oss-fuzz.com/testcase?key=5742284360908800 Project: unicorn Fuzzer: libFuzzerunicornfuzzemum68kbe Fuzz target binary: fuzzemum68kbe Job Type: libfuzzerasanunicorn Platform Id: linux Crash Type: UNKNOWN READ Crash...

graphicsmagick/coder_MNG_fuzzer: Heap-buffer-overflow in mng_get_long

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=5170869563817984 Project: graphicsmagick Fuzzer: libFuzzergraphicsmagickcoderMNGfuzzer Fuzz target binary: coderMNGfuzzer Job Type: libfuzzerasangraphicsmagick Platform Id: linux Crash Type:...

skia/region_set_path: Heap-buffer-overflow in SkRgnBuilder::blitH

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5727543865376768 Project: skia Fuzzer: aflskiaregionsetpath Fuzz target binary: regionsetpath Job Type: aflasanskia Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address:...

skia/region_set_path: Heap-buffer-overflow in SkRgnBuilder::blitH

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5762773770829824 Project: skia Fuzzer: aflskiaregionsetpath Fuzz target binary: regionsetpath Job Type: aflasanskia Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address:...

imagemagick/encoder_heic_fuzzer: Heap-buffer-overflow in ff_hevc_put_hevc_epel_pixels_8_sse

Detailed report: https://oss-fuzz.com/testcase?key=5676248198545408 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderheicfuzzer Fuzz target binary: encoderheicfuzzer Job Type: libfuzzerasanimagemagick Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x62300001c320...

skia/api_raster_n32_canvas: Heap-buffer-overflow in SkPath::Iter::doNext

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5758855720468480 Project: skia Fuzzer: aflskiaapirastern32canvas Fuzz target binary: apirastern32canvas Job Type: aflasanskia Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address...

harfbuzz/hb-shape-fuzzer: Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5679244475105280 Project: harfbuzz Fuzzer: aflharfbuzzhb-shape-fuzzer Fuzz target binary: hb-shape-fuzzer Job Type: aflasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

skia/region_set_path: Heap-buffer-overflow in SkPath::Iter::doNext

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5766950592970752 Project: skia Fuzzer: aflskiaregionsetpath Fuzz target binary: regionsetpath Job Type: aflasanskia Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address:...

harfbuzz/hb-subset-get-codepoints-fuzzer: Heap-buffer-overflow in OT::TableRecord::cmp

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5630904853069824 Project: harfbuzz Fuzzer: libFuzzerharfbuzzhb-subset-get-codepoints-fuzzer Fuzz target binary: hb-subset-get-codepoints-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux...

harfbuzz/hb-shape-fuzzer: Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5696686572175360 Project: harfbuzz Fuzzer: libFuzzerharfbuzzhb-shape-fuzzer Fuzz target binary: hb-shape-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow...

skia/api_image_filter: Heap-buffer-overflow in SkPathRef::Iter::next

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5728987444150272 Project: skia Fuzzer: aflskiaapiimagefilter Fuzz target binary: apiimagefilter Job Type: aflasanskia Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address:...