Heap-based Buffer Overflow in squell/id3

✍️ Description Hello! We compiled id3 from commit 857ac8 with Clang-13 + ASan, and we discovered a crafted file which triggers a heap-buffer-overflow, WRITE of size 1. This and the previous bug were discovered with the help of honggfuzz. 🕵️‍♂️ Proof of Concept echo...

ffmpeg:ffmpeg_AV_CODEC_ID_MAGICYUV_fuzzer: Heap-buffer-overflow in magy_decode_slice

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=6005121199374336 Project: ffmpeg Fuzzing Engine: honggfuzz Fuzz Target: ffmpegAVCODECIDMAGICYUVfuzzer Job Type: honggfuzzasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Addres...

libreoffice:htmlfuzzer: Heap-use-after-free in SfxItemSet::Count

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=5699610401832960 Project: libreoffice Fuzzing Engine: honggfuzz Fuzz Target: htmlfuzzer Job Type: honggfuzzasanlibreoffice Platform Id: linux Crash Type: Heap-use-after-free READ 2 Crash...

mupdf:pdf_fuzzer: Crash in template_affine_N_near_fb0

Project: git://git.ghostscript.com/mupdf.git Detailed Report: https://oss-fuzz.com/testcase?key=4867473373134848 Project: mupdf Fuzzing Engine: honggfuzz Fuzz Target: pdffuzzer Job Type: honggfuzzasanmupdf Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7ff23addb19e Crash State:...

binutils:fuzz_bfd: Heap-buffer-overflow in _bfd_vms_save_sized_string

Detailed Report: https://oss-fuzz.com/testcase?key=5191938237792256 Project: binutils Fuzzing Engine: honggfuzz Fuzz Target: fuzzbfd Job Type: honggfuzzasanbinutils Platform Id: linux Crash Type: Heap-buffer-overflow READ 12 Crash Address: 0x615000000280 Crash State: bfdvmssavesizedstring...

libyal:libfshfs_volume_fuzzer: Heap-buffer-overflow in libfshfs_catalog_btree_file_get_directory_entry_from_leaf_node_by_thread_record

Detailed Report: https://oss-fuzz.com/testcase?key=6246736336781312 Project: libyal Fuzzing Engine: honggfuzz Fuzz Target: libfshfsvolumefuzzer Job Type: honggfuzzasanlibyal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x61c000000774 Crash State:...

ffmpeg:ffmpeg_dem_OBU_fuzzer: Stack-buffer-overflow in get_bits

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5128116420476928 Project: ffmpeg Fuzzing Engine: honggfuzz Fuzz Target: ffmpegdemOBUfuzzer Job Type: honggfuzzasanffmpeg Platform Id: linux Crash Type: Stack-buffer-overflow READ 4 Crash Address:...

zeek:zeek-packet-fuzzer: Heap-buffer-overflow in zeek::packet_analysis::GRE::GREAnalyzer::AnalyzePacket

Project: https://github.com/zeek/zeek.git Detailed Report: https://oss-fuzz.com/testcase?key=5436906734878720 Project: zeek Fuzzing Engine: honggfuzz Fuzz Target: zeek-packet-fuzzer Job Type: honggfuzzasanzeek Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x60300127b09...

opensc:fuzz_pkcs15_reader: Heap-buffer-overflow in sc_oberthur_parse_privateinfo

Project: https://github.com/OpenSC/OpenSC.git Detailed Report: https://oss-fuzz.com/testcase?key=5096082311479296 Project: opensc Fuzzing Engine: honggfuzz Fuzz Target: fuzzpkcs15reader Job Type: honggfuzzasanopensc Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

ffmpeg:ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer: Heap-buffer-overflow in predict_motion

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5688995402743808 Project: ffmpeg Fuzzing Engine: honggfuzz Fuzz Target: ffmpegAVCODECIDMOBICLIPfuzzer Job Type: honggfuzzasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Addres...

arrow:parquet-arrow-fuzz: Negative-size-param in CopyUncompressedBlockToOutput

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=4914963406389248 Project: arrow Fuzzing Engine: honggfuzz Fuzz Target: parquet-arrow-fuzz Job Type: honggfuzzasanarrow Platform Id: linux Crash Type: Negative-size-param Crash Address: Crash State:...

libxml2:xml: Heap-use-after-free in xmlStaticCopyNode

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed Report: https://oss-fuzz.com/testcase?key=6039216293937152 Project: libxml2 Fuzzing Engine: honggfuzz Fuzz Target: xml Job Type: honggfuzzasanlibxml2 Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x60c00000220...

opensc:fuzz_pkcs15_reader: Heap-buffer-overflow in sc_oberthur_parse_publicinfo

Project: https://github.com/OpenSC/OpenSC.git Detailed Report: https://oss-fuzz.com/testcase?key=5146664376205312 Project: opensc Fuzzing Engine: honggfuzz Fuzz Target: fuzzpkcs15reader Job Type: honggfuzzasanopensc Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

opensc:fuzz_pkcs15_reader: Heap-buffer-overflow in hextoint

Project: https://github.com/OpenSC/OpenSC.git Detailed Report: https://oss-fuzz.com/testcase?key=5116660103774208 Project: opensc Fuzzing Engine: honggfuzz Fuzz Target: fuzzpkcs15reader Job Type: honggfuzzasanopensc Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

libreoffice:ww8fuzzer: Heap-use-after-free in SfxItemSet::Count

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=5666529566523392 Project: libreoffice Fuzzing Engine: honggfuzz Fuzz Target: ww8fuzzer Job Type: honggfuzzasanlibreoffice Platform Id: linux Crash Type: Heap-use-after-free READ 2 Crash...

opensc:fuzz_pkcs15_reader: Heap-buffer-overflow in hextoint

Project: https://github.com/OpenSC/OpenSC.git Detailed Report: https://oss-fuzz.com/testcase?key=5318841276825600 Project: opensc Fuzzing Engine: honggfuzz Fuzz Target: fuzzpkcs15reader Job Type: honggfuzzasanopensc Platform Id: linux Crash Type: Heap-buffer-overflow READ 7 Crash Address:...

libfmt:fuzzer_named_arg: Stack-buffer-overflow in fmt::v7::detail::buffer<char>::push_back

Detailed Report: https://oss-fuzz.com/testcase?key=5201197777289216 Project: libfmt Fuzzing Engine: honggfuzz Fuzz Target: fuzzernamedarg Job Type: honggfuzzasanlibfmt Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash Address: 0x7fff5c6570b8 Crash State:...

grok:grk_decompress_fuzzer: Heap-use-after-free in grk::TileProcessor::~TileProcessor

Detailed Report: https://oss-fuzz.com/testcase?key=5742937236045824 Project: grok Fuzzing Engine: honggfuzz Fuzz Target: grkdecompressfuzzer Job Type: honggfuzzasangrok Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x60d000000d50 Crash State:...

gdal:gtiff_fuzzer: Heap-buffer-overflow in Fax4Decode

Project: https://github.com/OSGeo/gdal.git Detailed Report: https://oss-fuzz.com/testcase?key=6308121394544640 Project: gdal Fuzzing Engine: honggfuzz Fuzz Target: gtifffuzzer Job Type: honggfuzzasangdal Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0x615000000c80 Cra...

gdal:mrf_fuzzer: Heap-buffer-overflow in Lerc1NS::blockread

Project: https://github.com/OSGeo/gdal.git Detailed Report: https://oss-fuzz.com/testcase?key=5094848431128576 Project: gdal Fuzzing Engine: honggfuzz Fuzz Target: mrffuzzer Job Type: honggfuzzasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x6160000014f8 Crash...