macOS/iOS ImageIO - Heap Corruption when Processing Malformed TIFF Image

The attached tiff image causes a crash in ImageIO on the latest macOS and iOS. To reproduce the issue, the attached code tester.m can be used. I've attached another code snippet to reproduce the issue on iOS as well. With tester.m compiled with ASAN, processing the attached tiff image should cras...

firefox:CompositorManagerParentIPC: Crash in mozilla::layers::TextureReadLock::AddRef

Detailed Report: https://oss-fuzz.com/testcase?key=5692629583134720 Project: firefox Fuzzing Engine: libFuzzer Fuzz Target: CompositorManagerParentIPC Job Type: libfuzzerasanfirefox Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x21807fff8001 Crash State:...

jbig2dec:jbig2_fuzzer: Heap-buffer-overflow in template_image_compose_opt

Project: git://git.ghostscript.com/jbig2dec.git Detailed Report: https://oss-fuzz.com/testcase?key=5647271708590080 Project: jbig2dec Fuzzing Engine: libFuzzer Fuzz Target: jbig2fuzzer Job Type: libfuzzerasanjbig2dec Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address:...

mysql-server:fuzz_real_query: Crash in net_field_length_size

Project: https://github.com/mysql/mysql-server.git Detailed Report: https://oss-fuzz.com/testcase?key=5639359625953280 Project: mysql-server Fuzzing Engine: libFuzzer Fuzz Target: fuzzrealquery Job Type: libfuzzerasanmysql-server Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

harfbuzz:hb-subset-fuzzer: Global-buffer-overflow in hb_array_t<OT::IntType<unsigned char, 1u> const> hb_array_t<OT::IntType<unsigned

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5747280156295168 Project: harfbuzz Fuzzing Engine: afl Fuzz Target: hb-subset-fuzzer Job Type: aflasanharfbuzz Platform Id: linux Crash Type: Global-buffer-overflow READ 1 Crash Address:...

php:php-fuzz-mbstring: Heap-use-after-free in quantifiers_memory_node_info

Detailed Report: https://oss-fuzz.com/testcase?key=5672130576646144 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-mbstring Job Type: libfuzzerasani386php Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0xf5239f80 Crash State: quantifiersmemorynodeinfo...

graphicsmagick:coder_WPG_fuzzer: Heap-buffer-overflow in InsertRow

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=5718137723158528 Project: graphicsmagick Fuzzing Engine: afl Fuzz Target: coderWPGfuzzer Job Type: aflasangraphicsmagick Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 2 Crash Addres...

rapidjson:fuzzer: Crash in void rapidjson::PutN<rapidjson::GenericStringBuffer<rapidjson::UTF8<char>, rapid

Detailed Report: https://oss-fuzz.com/testcase?key=5737460289503232 Project: rapidjson Fuzzing Engine: libFuzzer Fuzz Target: fuzzer Job Type: libfuzzerasani386rapidjson Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x4f5cf10a Crash State: void rapidjson::PutN, rapid...

arrow:arrow-ipc-stream-fuzz: Crash in arrow::ipc::internal::FieldFromFlatbuffer

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=5185274653179904 Project: arrow Fuzzing Engine: afl Fuzz Target: arrow-ipc-stream-fuzz Job Type: aflasanarrow Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x61c100f9e0b8 Crash State:...

unbound:fuzz_1_fuzzer: Heap-buffer-overflow in dname_pkt_compare

Project: https://github.com/NLnetLabs/unbound.git Detailed Report: https://oss-fuzz.com/testcase?key=6316796672212992 Project: unbound Fuzzing Engine: libFuzzer Fuzz Target: fuzz1fuzzer Job Type: libfuzzerasanunbound Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

php:php-fuzz-mbstring: Heap-use-after-free in optimize_nodes

Detailed Report: https://oss-fuzz.com/testcase?key=5688240959127552 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-mbstring Job Type: libfuzzerasani386php Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0xf52376a0 Crash State: optimizenodes optimizenodes...

mysql-server:fuzz_stmt_fetch: Heap-use-after-free in strmake_root

Project: https://github.com/mysql/mysql-server.git Detailed Report: https://oss-fuzz.com/testcase?key=5130976300892160 Project: mysql-server Fuzzing Engine: libFuzzer Fuzz Target: fuzzstmtfetch Job Type: libfuzzerasanmysql-server Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash...

graphicsmagick:coder_PICT_fuzzer: Heap-buffer-overflow in DecodeImage

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=5753808735174656 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderPICTfuzzer Job Type: libfuzzerasangraphicsmagick Platform Id: linux Crash Type: Heap-buffer-overflow READ...

graphicsmagick:coder_PICT_fuzzer: Heap-buffer-overflow in ExpandBuffer

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=5671372340854784 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderPICTfuzzer Job Type: libfuzzerasangraphicsmagick Platform Id: linux Crash Type: Heap-buffer-overflow READ 1...

harfbuzz:hb-subset-fuzzer: Heap-buffer-overflow in hb_array_t<OT::IntType<unsigned char, 1u> const> hb_array_t<OT::IntType<unsigned

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5747028458209280 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

wireshark:fuzzshark_ip: Heap-use-after-free in wmem_str_hash

Detailed Report: https://oss-fuzz.com/testcase?key=5661786670104576 Project: wireshark Fuzzing Engine: honggfuzz Fuzz Target: fuzzsharkip Job Type: honggfuzzasanwireshark Platform Id: linux Crash Type: Heap-use-after-free READ 2 Crash Address: 0x603000134ed0 Crash State: wmemstrhash wmemmaplookup...

arrow:arrow-ipc-file-fuzz: Crash in arrow::ipc::RecordBatchFileReader::RecordBatchFileReaderImpl::ReadDictionaries

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=5707423356813312 Project: arrow Fuzzing Engine: libFuzzer Fuzz Target: arrow-ipc-file-fuzz Job Type: libfuzzerasanarrow Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x617100000891 Crash...

mysql-server:fuzz_initfile: Heap-buffer-overflow in read_bootstrap_query

Detailed Report: https://oss-fuzz.com/testcase?key=5634736898965504 Project: mysql-server Fuzzing Engine: libFuzzer Fuzz Target: fuzzinitfile Job Type: libfuzzerasanmysql-server Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x631001642913 Crash State: readbootstrapquery...

dav1d:dav1d_fuzzer: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5670595304095744 Project: dav1d Fuzzing Engine: libFuzzer Fuzz Target: dav1dfuzzer Job Type: libfuzzerasandav1d Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL Sanitizer: address ASAN Crash...

cras:rclient_message: Null-dereference READ in audio_thread_start

Detailed Report: https://oss-fuzz.com/testcase?key=5642115451453440 Project: cras Fuzzing Engine: libFuzzer Fuzz Target: rclientmessage Job Type: libfuzzerasancras Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: audiothreadstart crasiodevlistinit...