OSV-2022-111 Heap-use-after-free in OT::CoverageFormat1::intersected_coverage_glyphs

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44257 Crash type: Heap-use-after-free READ 4 Crash state: OT::CoverageFormat1::intersectedcoverageglyphs OT::ChainContextFormat3::closure OT::hbclosurecontextt::returnt OT::SubstLookupSubTable::dispatchOT::hbclos...

OSV-2022-110 Heap-buffer-overflow in ZSTD_compressLiterals

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44239 Crash type: Heap-buffer-overflow WRITE 1 Crash state: ZSTDcompressLiterals ZSTDentropyCompressSeqStore ZSTDcompressSequences...

OSV-2022-108 Heap-buffer-overflow in void apply_string<GSUBProxy>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44212 Crash type: Heap-buffer-overflow READ 2 Crash state: void applystring void hbotmapt::apply hbotmapt::substitute...

OSV-2022-105 Heap-buffer-overflow in parse_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44199 Crash type: Heap-buffer-overflow READ 4 Crash state: parseobject parseobject parseobject...

OSV-2022-104 Heap-use-after-free in hb_bit_set_invertible_t::intersects

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44198 Crash type: Heap-use-after-free READ 1 Crash state: hbbitsetinvertiblet::intersects OT::CoverageFormat2::intersectedcoverageglyphs OT::ChainContextFormat1::closure...

OSV-2022-101 Heap-double-free in flb_sds_destroy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44153 Crash type: Heap-double-free Crash state: flbsdsdestroy flbparserconffile configrandomfuzzer.c...

OSV-2022-99 UNKNOWN WRITE in helper_shl_cc_arm

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44136 Crash type: UNKNOWN WRITE Crash state: helpershlccarm...

OSV-2022-97 Heap-buffer-overflow in gs_interpret

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44123 Crash type: Heap-buffer-overflow WRITE 16 Crash state: gsinterpret gsmainrunstringwithlength gsmainrunstring...

OSV-2022-96 Heap-buffer-overflow in sequence_compression_api.c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44122 Crash type: Heap-buffer-overflow WRITE 16 Crash state: sequencecompressionapi.c...

OSV-2022-94 Heap-buffer-overflow in cli_strlcat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44087 Crash type: Heap-buffer-overflow WRITE 1 Crash state: clistrlcat yarayyparse yrlexparserulesfile...

OSV-2022-93 Heap-buffer-overflow in strtol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44089 Crash type: Heap-buffer-overflow READ 2 Crash state: strtol parseprimitive plistfromjson...

OSV-2022-91 Heap-buffer-overflow in pixCountArbInRect

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44008 Crash type: Heap-buffer-overflow READ 1 Crash state: pixCountArbInRect pix3fuzzer.cc...

OSV-2021-1806 Stack-buffer-overflow in pdfi_open_CIDFont_substitute_file

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44034 Crash type: Stack-buffer-overflow WRITE Crash state: pdfiopenCIDFontsubstitutefile pdfiloadfont pdfireadtype0font...

OSV-2022-90 Heap-double-free in cli_extract_xlm_macros_and_images

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44040 Crash type: Heap-double-free Crash state: cliextractxlmmacrosandimages cliole2scantempdir cliscanole2...

OSV-2022-87 Heap-use-after-free in zend_std_get_property_ptr_ptr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43988 Crash type: Heap-use-after-free READ 8 Crash state: zendstdgetpropertyptrptr zendfetchpropertyaddress ZENDFETCHOBJWSPECCVCONSTHANDLER...

OSV-2022-85 UNKNOWN READ in pdfi_setcolorN

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43994 Crash type: UNKNOWN READ Crash state: pdfisetcolorN pdfiinterpretstreamoperator pdfiinterpretcontentstream...

OSV-2022-84 Heap-buffer-overflow in Core::Stream::File::open_path

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43978 Crash type: Heap-buffer-overflow READ Crash state: Core::Stream::File::openpath Core::Stream::File::open Audio::FlacLoaderPlugin::FlacLoaderPlugin...

OSV-2022-83 Heap-use-after-free in gx_monitor_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43981 Crash type: Heap-use-after-free READ 8 Crash state: gxmonitorfree icclinkcachefinalize ifreeobject...

OSV-2022-81 Global-buffer-overflow in get_space_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43991 Crash type: Global-buffer-overflow READ 1 Crash state: getspaceobject zsetcolorspace gsinterpret...

OSV-2022-80 Null-dereference READ in gstate_clone_core

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43989 Crash type: Null-dereference READ Crash state: gstateclonecore gsgsave gsoutputpage...