OSV-2018-142 UNKNOWN READ in cff_decoder_parse_charstrings

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11157 Crash type: UNKNOWN READ Crash state: cffdecoderparsecharstrings cffslotload FTLoadGlyph...

OSV-2018-143 Global-buffer-overflow in CFF::BlendArg::set_blends

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11714 Crash type: Global-buffer-overflow READ 8 Crash state: CFF::BlendArg::setblends CFF::CFF2CSOpSetCFF2CSOpSetSubrSubset, CFF::SubrSubsetParam, CFF::PathProcsNul CFF2CSOpSetSubrSubset::processop...

OSV-2018-140 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11074 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short AAT::LookupFormat10 ::sanitize AAT::Lookup ::sanitize...

OSV-2018-138 Heap-buffer-overflow in parse_odp_key_mask_attr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11160 Crash type: Heap-buffer-overflow READ 1 Crash state: parseodpkeymaskattr odpflowfromstring parsekeys...

OSV-2018-134 Heap-buffer-overflow in bloaty::DisassembleFindReferences

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5873 Crash type: Heap-buffer-overflow READ 4 Crash state: bloaty::DisassembleFindReferences bloaty::ReadELFSymbols bloaty::ReadELFSymbols...

OSV-2018-137 Heap-buffer-overflow in set_char_prefix

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10159 Crash type: Heap-buffer-overflow WRITE 1 Crash state: setcharprefix parseincludeddirectories setlongoption...

OSV-2018-130 Stack-buffer-overflow in parse_tables

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12466 Crash type: Stack-buffer-overflow WRITE 7 Crash state: parsetables processblock douncompressfile...

OSV-2018-131 Use-of-uninitialized-value in json_string_unescape

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11473 Crash type: Use-of-uninitialized-value Crash state: jsonstringunescape ofputiltablefromstring parseofpstr...

OSV-2018-129 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11657 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int CFF::Charset12 ::getglyph...

OSV-2018-128 Use-of-uninitialized-value in iclip

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11392 Crash type: Use-of-uninitialized-value Crash state: iclip avgc dav1dreconbinter16bpc...

OSV-2018-126 UNKNOWN READ in BEInt<int, 4>::operator int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10900 Crash type: UNKNOWN READ Crash state: BEInt::operator int AAT::KerxSubTableFormat6::getkerning hbkernmachinet::kern...

OSV-2018-124 UNKNOWN READ in netdev_get

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11314 Crash type: UNKNOWN READ Crash state: netdevget configparsenetdev nextassignment...

OSV-2018-127 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10341 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short OT::Offset, true::isnull OT::OffsetToOT::ArrayOfM1OT::ResourceTypeRecord, OT::IntTypeunsigned short, 2...

OSV-2018-117 Heap-buffer-overflow in Envoy::StringUtil::itoa

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10038 Crash type: Heap-buffer-overflow WRITE 1 Crash state: Envoy::StringUtil::itoa Envoy::Http::HeaderString::setInteger Envoy::TestOneProtoInput...

OSV-2018-115 Global-buffer-overflow in CFF::BlendArg::set_blends

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11691 Crash type: Global-buffer-overflow READ 8 Crash state: CFF::BlendArg::setblends CFF::CFF2CSOpSet::proc CFF::CSInterpreter::int...

OSV-2018-116 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11060 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short AAT::LookupFormat10 ::sanitize AAT::Lookup ::sanitize...

OSV-2018-113 Use-of-uninitialized-value in iclip

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11466 Crash type: Use-of-uninitialized-value Crash state: iclip applytorowuv dav1dapplygrain8bpc...

OSV-2018-114 Heap-buffer-overflow in BEInt<unsigned int, 4>::operator unsigned int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10933 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned int OT::OffsetTo , OT::IntTypeunsigned i AAT::KerxSubTableFormat2::getkerning...

OSV-2018-112 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10356 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short OT::BinSearchHeader::operator unsigned int OT::OffsetTable::findtableindex...

OSV-2018-111 Heap-buffer-overflow in format_generic_odp_key

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10850 Crash type: Heap-buffer-overflow READ 1 Crash state: formatgenericodpkey checkattrlen formatodpkeyattr...