OSV-2021-618 Heap-buffer-overflow in OT::AnchorFormat1* hb_serialize_context_t::embed<OT::AnchorFormat1>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33031 Crash type: Heap-buffer-overflow READ 6 Crash state: OT::AnchorFormat1 hbserializecontextt::embed OT::AnchorFormat1::copy OT::Anchor::subset...

OSV-2020-509 Use-of-uninitialized-value in hb_hashmap_t<hb_serialize_context_t::object_t const*, unsigned int,

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14641 Crash type: Use-of-uninitialized-value Crash state: hbhashmapthbserializecontextt::objectt const, unsigned int, hbhashmapthbserializecontextt::objectt const, unsigned int, hbhashmapthbserializecontextt::objectt const,...

OSV-2020-54 Heap-buffer-overflow in OT::HintingDevice* hb_serialize_context_t::embed<OT::HintingDevice>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20211 Crash type: Heap-buffer-overflow READ Crash state: OT::HintingDevice hbserializecontextt::embed OT::HintingDevice::copy OT::Device::copy...