OSV-2018-61 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12312 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::OffsetTo...

OSV-2018-54 UNKNOWN READ in BEInt<short, 2>::operator short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11305 Crash type: UNKNOWN READ Crash state: BEInt::operator short AAT::KerxSubTableFormat1::drivercontextt::transition void AAT::StateTableDriver::EntryDat...

OSV-2018-26 UNKNOWN READ in BEInt<unsigned char, 1>::operator unsigned char

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11351 Crash type: UNKNOWN READ Crash state: BEInt::operator unsigned char OT::DeviceRecord::serialize OT::hdmx::serialize...

OSV-2018-1 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10897 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short AAT::StateTable ::sanitize AAT::KerxSubTableFormat1::sanitize...

OSV-2020-1325 Global-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21769 Crash type: Global-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int CFF::Charset0::getglyph...

OSV-2020-708 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14919 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int hbmapiterthbmapiterthbarraytOT::OffsetToOT::AxisValue, OT::IntTypeu...

OSV-2020-698 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18515 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::ArrayOf, OT::IntType ::...

OSV-2020-704 Heap-buffer-overflow in BEInt<unsigned char, 1>::set

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13736 Crash type: Heap-buffer-overflow WRITE 1 Crash state: BEInt::set CFF::CFFIndex ::setoffsetat bool CFF::FDArray ::serializeCFF::cff2fontdict...

OSV-2020-412 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18503 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int decltype...

OSV-2020-347 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14825 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::AxisValue::sanitize...

OSV-2020-244 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20036 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::IndexArray::addindexesto...

OSV-2020-233 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20022 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int decltype...

OSV-2020-188 Heap-buffer-overflow in BEInt<short, 2>::operator short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20924 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator short OT::IntType::operator int OT::TupleVarHeader::calculatescalar...

OSV-2020-147 Heap-buffer-overflow in BEInt<short, 2>::operator short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21026 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator short OT::IntType::operator int OT::TupleVarHeader::calculatescalar...

OSV-2020-149 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator=

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21580 Crash type: Heap-buffer-overflow WRITE 1 Crash state: BEInt::operator= OT::IntType::operator= bool OT::ClassDefFormat1::serializehbzipiterthbsortedarraytOT::HBGlyphI...

OSV-2020-121 Heap-buffer-overflow in BEInt<short, 2>::operator short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21092 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator short OT::IntType::operator int OT::SegmentMaps::map...

OSV-2020-107 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20944 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::gvar::getoffset...

OSV-2020-16 Heap-use-after-free in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20906 Crash type: Heap-use-after-free READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::GlyphVarData::hasdata...

harfbuzz:hb-draw-fuzzer: Heap-buffer-overflow in BEInt<short, 2>::operator short

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5681465586352128 Project: harfbuzz Fuzzing Engine: afl Fuzz Target: hb-draw-fuzzer Job Type: aflasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x62100198466...

harfbuzz/hb-shape-fuzzer: Crash in BEInt<int, 4>::operator int

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5695615258853376 Project: harfbuzz Fuzzer: aflharfbuzzhb-shape-fuzzer Fuzz target binary: hb-shape-fuzzer Job Type: aflasanharfbuzz Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...