OSV-2018-210 Heap-use-after-free in UA_SecureChannel_deleteMembersCleanup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5499 Crash type: Heap-use-after-free READ 8 Crash state: UASecureChanneldeleteMembersCleanup removeSecureChannelCallback UAServerrunshutdown...

OSV-2018-208 Global-buffer-overflow in bloaty::wasm::Section::Read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9540 Crash type: Global-buffer-overflow READ 8 Crash state: bloaty::wasm::Section::Read bloaty::wasm::ParseSections bloaty::wasm::WebAssemblyObjectFile::ProcessFile...

OSV-2017-22 Heap-buffer-overflow in opj_tcd_mct_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3331 Crash type: Heap-buffer-overflow READ 4 Crash state: opjtcdmctdecode opjtcddecodetile opjj2kdecodetile...

OSV-2018-206 Heap-buffer-overflow in parse_sigalgs_list

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9808 Crash type: Heap-buffer-overflow READ 1 Crash state: parsesigalgslist SSLCTXset1sigalgslist std::1::functionvoid...

OSV-2018-202 Heap-buffer-overflow in parse_mode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11167 Crash type: Heap-buffer-overflow READ 1 Crash state: parsemode gittreeparseraw gitobjectfromraw...

OSV-2018-200 Heap-buffer-overflow in SplashPath::lineTo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10148 Crash type: Heap-buffer-overflow READ 1 Crash state: SplashPath::lineTo Splash::makeDashedPath Splash::stroke...

OSV-2018-201 Heap-buffer-overflow in r_str_utf16_to_utf8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10487 Crash type: Heap-buffer-overflow READ 1 Crash state: rstrutf16toutf8 sections rbinobjectsetitems...

OSV-2018-195 Heap-buffer-overflow in gmp_emsa_pkcs1_signature_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10671 Crash type: Heap-buffer-overflow WRITE 1 Crash state: gmpemsapkcs1signaturedata verifyemsapkcs1signature verify...

OSV-2018-196 Use-of-uninitialized-value in _pkcs12_decode_safe_contents

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10216 Crash type: Use-of-uninitialized-value Crash state: pkcs12decodesafecontents parsesafecontents gnutlspkcs12getbag...

OSV-2018-199 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10986 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short AAT::LookupSegmentSingle ::cmp AAT::LookupSegmentSingle const OT::VarSizedBi...

OSV-2018-198 Heap-buffer-overflow in r_read_le32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11308 Crash type: Heap-buffer-overflow READ 1 Crash state: rreadle32 rreadle64 rbinfilegetstrings...

OSV-2018-192 Stack-buffer-overflow in highbd_dr_prediction_z1_64xN_avx2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11517 Crash type: Stack-buffer-overflow READ 16 Crash state: highbddrpredictionz164xNavx2 av1highbddrpredictionz1avx2 av1predictintrablock...

OSV-2018-194 Heap-use-after-free in r_core_task_decref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11359 Crash type: Heap-use-after-free READ 8 Crash state: rcoretaskdecref rlistdelete rlistpurge...

OSV-2018-190 Heap-buffer-overflow in OT::Coverage::intersects

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10084 Crash type: Heap-buffer-overflow READ 8 Crash state: OT::Coverage::intersects OT::ContextFormat2::closure hbvoidt const OT::hbclosurecontextt::dispatch...

OSV-2018-186 Use-of-uninitialized-value in decode_complex_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10137 Crash type: Use-of-uninitialized-value Crash state: decodecomplexstring gnutlsx509dntostring appendelements...

OSV-2018-182 Stack-buffer-overflow in cdma2k_message_HANDOFF_DIR

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11633 Crash type: Stack-buffer-overflow READ 2 Crash state: cdma2kmessageHANDOFFDIR cdma2kmessagedecode dissectcdma2k...

OSV-2018-179 Heap-buffer-overflow in OT::post::accelerator_t::cmp_gids

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11290 Crash type: Heap-buffer-overflow READ 5 Crash state: OT::post::acceleratort::cmpgids sortrcmpswap sortrsimple...

OSV-2018-180 UNKNOWN READ in [stack]

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10445 Crash type: UNKNOWN READ Crash state: stack...

OSV-2018-176 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10899 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short AAT::LookupSegmentSingle ::cmp AAT::LookupSegmentSingle const OT::VarSizedBi...

OSV-2018-177 Heap-buffer-overflow in prefixcmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11007 Crash type: Heap-buffer-overflow READ 1 Crash state: prefixcmp gitprefixcmp gitcommitparseraw...