OSV-2018-172 UNKNOWN READ in _hb_ot_shape_fallback_kern

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10762 Crash type: UNKNOWN READ Crash state: hbotshapefallbackkern hbotposition hbotshapeinternal...

OSV-2018-175 Heap-buffer-overflow in rawspeed::VC5Decompressor::Wavelet::HighPassBand::decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11429 Crash type: Heap-buffer-overflow WRITE 2 Crash state: rawspeed::VC5Decompressor::Wavelet::HighPassBand::decode rawspeed::VC5Decompressor::decode VC5Decompressor.cpp...

OSV-2018-174 Heap-buffer-overflow in BEInt<unsigned char, 1>::operator unsigned char

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11245 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned char OT::KernSubTableFormat3::getkerning hbkernmachinet::kern...

OSV-2018-173 Stack-buffer-overflow in nullable_memcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10865 Crash type: Stack-buffer-overflow READ Crash state: nullablememcpy nshkeytoattr parseodppushnshaction...

OSV-2018-167 Heap-buffer-overflow in cff_parser_run

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9967 Crash type: Heap-buffer-overflow WRITE 1 Crash state: cffparserrun cffsubfontload cfffontload...

OSV-2018-170 Heap-use-after-free in yr_re_ast_split_at_chaining_point

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11752 Crash type: Heap-use-after-free READ 4 Crash state: yrreastsplitatchainingpoint yrparserreducestringdeclaration yarayyparse...

OSV-2018-158 Heap-buffer-overflow in ofpbuf_insert

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11253 Crash type: Heap-buffer-overflow WRITE Crash state: ofpbufinsert nxputraw nxputmatch...

OSV-2018-157 Heap-double-free in minimatch_destroy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11408 Crash type: Heap-double-free Crash state: minimatchdestroy ofctlparseflow ofctlparsetarget.c...

OSV-2018-161 Heap-buffer-overflow in BEInt<unsigned short, 2>::set

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11081 Crash type: Heap-buffer-overflow WRITE 1 Crash state: BEInt::set OT::Script::subset void OT::OffsetTo, true::serialize...

OSV-2018-159 Use-of-uninitialized-value in AAT::LookupFormat8<OT::IntType<unsigned short, 2u> >::get_value

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10953 Crash type: Use-of-uninitialized-value Crash state: AAT::LookupFormat8 ::getvalue AAT::Lookup ::getvalue AAT::StateTable::getclass...

OSV-2018-162 Heap-buffer-overflow in BEInt<unsigned int, 4>::operator unsigned int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10948 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned int OT::OffsetTo , OT::IntTypeunsigned i AAT::KerxSubTableFormat1::drivercontextt::drivercontextt...

OSV-2018-156 Heap-buffer-overflow in dotnet_parse_us

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11945 Crash type: Heap-buffer-overflow READ 1 Crash state: dotnetparseus dotnetparsecom dotnetload...

OSV-2018-160 Heap-buffer-overflow in do_uncompress_block

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11011 Crash type: Heap-buffer-overflow WRITE 1 Crash state: douncompressblock processblock douncompressfile...

OSV-2018-155 Stack-buffer-overflow in cff_parser_run

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9865 Crash type: Stack-buffer-overflow READ 8 Crash state: cffparserrun cffsubfontload cfffontload...

OSV-2018-154 Heap-use-after-free in XRefEntry::setFlag

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11244 Crash type: Heap-use-after-free READ 4 Crash state: XRefEntry::setFlag Parser::makeStream Parser::getObj...

OSV-2018-153 Heap-buffer-overflow in asn1_ex_i2c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7696 Crash type: Heap-buffer-overflow READ 4 Crash state: asn1exi2c asn1i2dexprimitive ASN1itemexi2d...

OSV-2018-152 Heap-buffer-overflow in dhcp6_option_parse_status

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10746 Crash type: Heap-buffer-overflow READ 2 Crash state: dhcp6optionparsestatus dhcp6optionparsepdprefix dhcp6optionparseia...

OSV-2018-149 Heap-buffer-overflow in BEInt<unsigned int, 4>::operator unsigned int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11033 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned int AAT::KerxSubTableFormat2::sanitize hbsanitizecontextt::returnt AAT::KerxTable::dispatch...

OSV-2018-145 Heap-buffer-overflow in cras_rclient_message_from_client

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9242 Crash type: Heap-buffer-overflow READ 4 Crash state: crasrclientmessagefromclient crasrclientbufferfromclient rclientmessage.cc...

OSV-2018-146 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11526 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short OT::KernSubTable::getsize void hbsanitizecontextt::setobjectOT::KernSubTableOT::KernOTSubTableHeader...