OSV-2018-198 Heap-buffer-overflow in r_read_le32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11308 Crash type: Heap-buffer-overflow READ 1 Crash state: rreadle32 rreadle64 rbinfilegetstrings...

OSV-2018-192 Stack-buffer-overflow in highbd_dr_prediction_z1_64xN_avx2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11517 Crash type: Stack-buffer-overflow READ 16 Crash state: highbddrpredictionz164xNavx2 av1highbddrpredictionz1avx2 av1predictintrablock...

OSV-2018-194 Heap-use-after-free in r_core_task_decref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11359 Crash type: Heap-use-after-free READ 8 Crash state: rcoretaskdecref rlistdelete rlistpurge...

OSV-2018-190 Heap-buffer-overflow in OT::Coverage::intersects

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10084 Crash type: Heap-buffer-overflow READ 8 Crash state: OT::Coverage::intersects OT::ContextFormat2::closure hbvoidt const OT::hbclosurecontextt::dispatch...

OSV-2018-186 Use-of-uninitialized-value in decode_complex_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10137 Crash type: Use-of-uninitialized-value Crash state: decodecomplexstring gnutlsx509dntostring appendelements...

OSV-2018-182 Stack-buffer-overflow in cdma2k_message_HANDOFF_DIR

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11633 Crash type: Stack-buffer-overflow READ 2 Crash state: cdma2kmessageHANDOFFDIR cdma2kmessagedecode dissectcdma2k...

OSV-2018-179 Heap-buffer-overflow in OT::post::accelerator_t::cmp_gids

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11290 Crash type: Heap-buffer-overflow READ 5 Crash state: OT::post::acceleratort::cmpgids sortrcmpswap sortrsimple...

OSV-2018-180 UNKNOWN READ in [stack]

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10445 Crash type: UNKNOWN READ Crash state: stack...

OSV-2018-176 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10899 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short AAT::LookupSegmentSingle ::cmp AAT::LookupSegmentSingle const OT::VarSizedBi...

OSV-2018-177 Heap-buffer-overflow in prefixcmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11007 Crash type: Heap-buffer-overflow READ 1 Crash state: prefixcmp gitprefixcmp gitcommitparseraw...

OSV-2018-172 UNKNOWN READ in _hb_ot_shape_fallback_kern

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10762 Crash type: UNKNOWN READ Crash state: hbotshapefallbackkern hbotposition hbotshapeinternal...

OSV-2018-175 Heap-buffer-overflow in rawspeed::VC5Decompressor::Wavelet::HighPassBand::decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11429 Crash type: Heap-buffer-overflow WRITE 2 Crash state: rawspeed::VC5Decompressor::Wavelet::HighPassBand::decode rawspeed::VC5Decompressor::decode VC5Decompressor.cpp...

OSV-2018-173 Stack-buffer-overflow in nullable_memcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10865 Crash type: Stack-buffer-overflow READ Crash state: nullablememcpy nshkeytoattr parseodppushnshaction...

OSV-2018-174 Heap-buffer-overflow in BEInt<unsigned char, 1>::operator unsigned char

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11245 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned char OT::KernSubTableFormat3::getkerning hbkernmachinet::kern...

OSV-2018-167 Heap-buffer-overflow in cff_parser_run

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9967 Crash type: Heap-buffer-overflow WRITE 1 Crash state: cffparserrun cffsubfontload cfffontload...

OSV-2018-170 Heap-use-after-free in yr_re_ast_split_at_chaining_point

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11752 Crash type: Heap-use-after-free READ 4 Crash state: yrreastsplitatchainingpoint yrparserreducestringdeclaration yarayyparse...

OSV-2018-158 Heap-buffer-overflow in ofpbuf_insert

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11253 Crash type: Heap-buffer-overflow WRITE Crash state: ofpbufinsert nxputraw nxputmatch...

OSV-2018-161 Heap-buffer-overflow in BEInt<unsigned short, 2>::set

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11081 Crash type: Heap-buffer-overflow WRITE 1 Crash state: BEInt::set OT::Script::subset void OT::OffsetTo, true::serialize...

OSV-2018-157 Heap-double-free in minimatch_destroy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11408 Crash type: Heap-double-free Crash state: minimatchdestroy ofctlparseflow ofctlparsetarget.c...

OSV-2018-159 Use-of-uninitialized-value in AAT::LookupFormat8<OT::IntType<unsigned short, 2u> >::get_value

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10953 Crash type: Use-of-uninitialized-value Crash state: AAT::LookupFormat8 ::getvalue AAT::Lookup ::getvalue AAT::StateTable::getclass...