wireshark/fuzzshark_ip_proto-udp: Crash in tvb_ensure_bytes_exist

Project: https://code.wireshark.org/review/wireshark Detailed report: https://oss-fuzz.com/testcase?key=5709248316571648 Project: wireshark Fuzzer: libFuzzerwiresharkfuzzsharkipproto-udp Fuzz target binary: fuzzsharkipproto-udp Job Type: libfuzzerubsanwireshark Platform Id: linux Crash Type:...

mruby/mruby_fuzzer: Use-of-uninitialized-value in ht_copy

Project: https://github.com/mruby/mruby.git Detailed report: https://oss-fuzz.com/testcase?key=5098398899765248 Project: mruby Fuzzer: libFuzzermrubyfuzzer Fuzz target binary: mrubyfuzzer Job Type: libfuzzermsanmruby Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

open62541/fuzz_binary_message: Use-of-uninitialized-value in __RefHead_ZIP_INSERT

Project: https://github.com/open62541/open62541.git Detailed report: https://oss-fuzz.com/testcase?key=5721711044984832 Project: open62541 Fuzzer: libFuzzeropen62541fuzzbinarymessage Fuzz target binary: fuzzbinarymessage Job Type: libfuzzermsanopen62541 Platform Id: linux Crash Type:...

hostap/ap-mgmt-fuzzer: Crash in handle_auth

Project: git://w1.fi/srv/git/hostap.git Detailed report: https://oss-fuzz.com/testcase?key=5686935802085376 Project: hostap Fuzzer: libFuzzerhostapap-mgmt-fuzzer Fuzz target binary: ap-mgmt-fuzzer Job Type: libfuzzermsanhostap Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

llvm/llvm-opt-fuzzer--x86_64-loop_vectorize: Heap-use-after-free in WriteAsOperandInternal

Detailed report: https://oss-fuzz.com/testcase?key=5692243106594816 Project: llvm Fuzzer: libFuzzerllvmllvm-opt-fuzzer--x8664-loopvectorize Fuzz target binary: llvm-opt-fuzzer--x8664-loopvectorize Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address:...

gdal/gdal_translate_fuzzer: Heap-buffer-overflow in GTiffRasterBand::IReadBlock

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5764371029950464 Project: gdal Fuzzer: libFuzzergdaltranslatefuzzer Fuzz target binary: gdaltranslatefuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash...

openthread/ncp-uart-received-fuzzer: Stack-buffer-overflow in ot::Ip6::OptionPadN::Init

Project: https://github.com/openthread/openthread.git Detailed report: https://oss-fuzz.com/testcase?key=5768121945686016 Project: openthread Fuzzer: libFuzzeropenthreadncp-uart-received-fuzzer Fuzz target binary: ncp-uart-received-fuzzer Job Type: libfuzzerasanopenthread Platform Id: linux Crash...

keystone/fuzz_asm_sparc64be: Crash in llvm_ks::SmallVectorBase::grow_pod

Detailed report: https://oss-fuzz.com/testcase?key=5688354168897536 Project: keystone Fuzzer: libFuzzerkeystonefuzzasmsparc64be Fuzz target binary: fuzzasmsparc64be Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7180004447e0 Crash State:...

freetype2/ftfuzzer: Crash in TT_Process_Simple_Glyph

Detailed report: https://oss-fuzz.com/testcase?key=5666646934421504 Project: freetype2 Fuzzer: libFuzzerfreetype2ftfuzzer Fuzz target binary: ftfuzzer Job Type: libfuzzerubsanfreetype2 Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7fff00000009 Crash State: TTProcessSimpleGlyph...

systemd/fuzz-varlink: Use-of-uninitialized-value in varlink_write

Project: https://github.com/systemd/systemd.git Detailed report: https://oss-fuzz.com/testcase?key=5730863070838784 Project: systemd Fuzzer: libFuzzersystemdfuzz-varlink Fuzz target binary: fuzz-varlink Job Type: libfuzzermsansystemd Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

keystone/fuzz_asm_x86_64: Bad-cast to llvm_ks::X86OperandX86AsmParser::MatchAndEmitATTInstruction in AsmParser::parseStatement

Detailed report: https://oss-fuzz.com/testcase?key=5121855985287168 Project: keystone Fuzzer: libFuzzerkeystonefuzzasmx8664 Fuzz target binary: fuzzasmx8664 Job Type: libfuzzerubsankeystone Platform Id: linux Crash Type: Bad-cast Crash Address: 0x00000210d120 Crash State: Bad-cast to...

cryptofuzz/cryptofuzz-openssl-noasm: Use-of-uninitialized-value in EVP_EncryptFinal_ex

Project: https://github.com/guidovranken/cryptofuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5721503011700736 Project: cryptofuzz Fuzzer: libFuzzercryptofuzzcryptofuzz-openssl-noasm Fuzz target binary: cryptofuzz-openssl-noasm Job Type: libfuzzermsancryptofuzz Platform Id: linux Cra...

karchive/karchive_fuzzer: Use-of-uninitialized-value in qstrlen

Project: git://anongit.kde.org/karchive Detailed report: https://oss-fuzz.com/testcase?key=5640360216231936 Project: karchive Fuzzer: libFuzzerkarchivefuzzer Fuzz target binary: karchivefuzzer Job Type: libfuzzermsankarchive Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

lwan/request_fuzzer: Global-buffer-overflow in parse_headers

Project: git://github.com/lpereira/lwan Detailed report: https://oss-fuzz.com/testcase?key=5673683021987840 Project: lwan Fuzzer: afllwanrequestfuzzer Fuzz target binary: requestfuzzer Job Type: aflasanlwan Platform Id: linux Crash Type: Global-buffer-overflow READ 4 Crash Address: 0x0000012320ff...

sqlite3/ossfuzz: Use-of-uninitialized-value in accessPayload

Detailed report: https://oss-fuzz.com/testcase?key=5707266847670272 Project: sqlite3 Fuzzer: libFuzzersqlite3ossfuzz Fuzz target binary: ossfuzz Job Type: libfuzzermsansqlite3 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: accessPayload vdbeMemFromBtreeResiz...

opencv/imdecode_fuzzer: Incorrect-function-pointer-type in cv::Mat::convertTo

Project: https://github.com/opencv/opencv.git Detailed report: https://oss-fuzz.com/testcase?key=5643625308880896 Project: opencv Fuzzer: libFuzzerimdecodefuzzer Fuzz target binary: imdecodefuzzer Job Type: libfuzzerubsanopencv Platform Id: linux Crash Type: Incorrect-function-pointer-type Crash...

kimageformats/kimgio_fuzzer: Negative-size-param in QImage::fill

Project: git://anongit.kde.org/kimageformats Detailed report: https://oss-fuzz.com/testcase?key=5118681342803968 Project: kimageformats Fuzzer: aflkimageformatskimgiofuzzer Fuzz target binary: kimgiofuzzer Job Type: aflasankimageformats Platform Id: linux Crash Type: Negative-size-param Crash...

systemd/fuzz-link-parser: Heap-use-after-free in condition_free_list_type

Project: https://github.com/systemd/systemd.git Detailed report: https://oss-fuzz.com/testcase?key=5751069692395520 Project: systemd Fuzzer: libFuzzersystemdfuzz-link-parser Fuzz target binary: fuzz-link-parser Job Type: libfuzzerasansystemd Platform Id: linux Crash Type: Heap-use-after-free READ...

tesseract-ocr/fuzzer-api: Index-out-of-bounds in ScratchEvidence::UpdateSumOfProtoEvidences

Detailed report: https://oss-fuzz.com/testcase?key=5738676530708480 Project: tesseract-ocr Fuzzer: libFuzzertesseract-ocrfuzzer-api Fuzz target binary: fuzzer-api Job Type: libfuzzerubsantesseract-ocr Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...

Google Chrome < M73 - Double-Destruction Race in StoragePartitionService

There's a race condition in the destruction of the BindingState for bindings to the StoragePartitionService. It looks like the root cause of the issue is that since we can get two concurrent calls to callbacks returned from mojo::BindingSet::GetBadMessageCallback from the same BindingSet, which...