OSV-2022-278 UNKNOWN READ in s_RLE_process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45992 Crash type: UNKNOWN READ Crash state: sRLEprocess cmdputbits clistcopymono...

OSV-2022-276 Segv on unknown address in sc_file_clear_acl_entries

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45969 Crash type: Segv on unknown address Crash state: scfileclearaclentries scfilefree scprofilefree...

OSV-2022-271 UNKNOWN READ in pdf14_buf_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45892 Crash type: UNKNOWN READ Crash state: pdf14buffree rcpdf14maskbuffree pdf14endtransparencymask...

OSV-2022-268 Stack-use-after-return in template_sanity_check

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45880 Crash type: Stack-use-after-return READ 1 Crash state: templatesanitycheck processtmpl processblock...

OSV-2022-265 Heap-buffer-overflow in jxl::WriteToPixelCallbackStage::ProcessRow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45833 Crash type: Heap-buffer-overflow READ 4 Crash state: jxl::WriteToPixelCallbackStage::ProcessRow jxl::LowMemoryRenderPipeline::RenderRect jxl::LowMemoryRenderPipeline::ProcessBuffers...

OSV-2022-264 Heap-buffer-overflow in jxl::N_AVX2::BlendingStage::ProcessRow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45822 Crash type: Heap-buffer-overflow READ 4 Crash state: jxl::NAVX2::BlendingStage::ProcessRow jxl::LowMemoryRenderPipeline::RenderRect jxl::LowMemoryRenderPipeline::ProcessBuffers...

OSV-2022-262 Heap-double-free in flb_pack_state_reset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45810 Crash type: Heap-double-free Crash state: flbpackstatereset inlibcollect flbinputcollectorfd...

OSV-2022-260 Heap-double-free in read_config

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45687 Crash type: Heap-double-free Crash state: readconfig flbcffluentbitcreate flbcfcreatefromfile...

OSV-2022-259 Heap-double-free in read_config

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45671 Crash type: Heap-double-free Crash state: readconfig readglob readconfig...

OSV-2022-257 Segv on unknown address in flb_config_map_properties_check

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45670 Crash type: Segv on unknown address Crash state: flbconfigmappropertiescheck configmapfuzzer.c...

OSV-2022-255 Heap-double-free in flb_pack_state_reset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45667 Crash type: Heap-double-free Crash state: flbpackstatereset packjsonstatefuzzer.c flbpackstateinit...

OSV-2022-254 Heap-use-after-free in jsmn_parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45651 Crash type: Heap-use-after-free WRITE 4 Crash state: jsmnparse flbjsontokenise flbpackjsonstate...

OSV-2022-252 Heap-buffer-overflow in grk::PacketLengthMarkers::readPLM

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45622 Crash type: Heap-buffer-overflow READ 1 Crash state: grk::PacketLengthMarkers::readPLM grk::CodeStreamDecompress::processmarker grk::CodeStreamDecompress::readHeaderProcedureImpl...

OSV-2022-250 Heap-buffer-overflow in __covrec_1D46B478ANUMBER

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45603 Crash type: Heap-buffer-overflow READ 1 Crash state: covrec1D46B478ANUMBER covrecF49D057CNUMBER covrec5D82FD3F85773DBDu...

OSV-2022-249 Heap-buffer-overflow in llvm::DataLayout::getIndexedOffsetInType

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45591 Crash type: Heap-buffer-overflow READ 4 Crash state: llvm::DataLayout::getIndexedOffsetInType InterpreterStackFrame::ResolveConstantValue InterpreterStackFrame::EvaluateValue...

OSV-2022-248 Uncaught exception in java.base/java.nio.Bits.reserveMemory

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45563 Crash type: Uncaught exception Crash state: java.base/java.nio.Bits.reserveMemory java.base/java.nio.DirectByteBuffer. java.base/java.nio.ByteBuffer.allocateDirect...

OSV-2022-241 UNKNOWN READ in write_cond_nodes_to_conf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45523 Crash type: UNKNOWN READ Crash state: writecondnodestoconf sepolkernelpolicydbtoconf binpolicy-fuzzer.c...

OSV-2022-238 Segv on unknown address in i_zval_ptr_dtor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45429 Crash type: Segv on unknown address Crash state: izvalptrdtor zendleavehelperSPEC zenddispatchtrycatchfinallyhelperSPEC...

OSV-2022-237 Stack-buffer-overflow in sc_format_oid

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45459 Crash type: Stack-buffer-overflow READ Crash state: scformatoid dostoredataobject fuzzpkcs15init.c...

OSV-2022-235 Heap-buffer-overflow in zend_gc_collect_cycles

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45369 Crash type: Heap-buffer-overflow READ 1 Crash state: zendgccollectcycles fuzzerrequestshutdown fuzzerdorequestfrombuffer...