OSV-2018-159 Use-of-uninitialized-value in AAT::LookupFormat8<OT::IntType<unsigned short, 2u> >::get_value

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10953 Crash type: Use-of-uninitialized-value Crash state: AAT::LookupFormat8 ::getvalue AAT::Lookup ::getvalue AAT::StateTable::getclass...

OSV-2018-160 Heap-buffer-overflow in do_uncompress_block

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11011 Crash type: Heap-buffer-overflow WRITE 1 Crash state: douncompressblock processblock douncompressfile...

OSV-2018-156 Heap-buffer-overflow in dotnet_parse_us

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11945 Crash type: Heap-buffer-overflow READ 1 Crash state: dotnetparseus dotnetparsecom dotnetload...

OSV-2018-155 Stack-buffer-overflow in cff_parser_run

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9865 Crash type: Stack-buffer-overflow READ 8 Crash state: cffparserrun cffsubfontload cfffontload...

OSV-2018-154 Heap-use-after-free in XRefEntry::setFlag

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11244 Crash type: Heap-use-after-free READ 4 Crash state: XRefEntry::setFlag Parser::makeStream Parser::getObj...

OSV-2018-153 Heap-buffer-overflow in asn1_ex_i2c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7696 Crash type: Heap-buffer-overflow READ 4 Crash state: asn1exi2c asn1i2dexprimitive ASN1itemexi2d...

OSV-2018-152 Heap-buffer-overflow in dhcp6_option_parse_status

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10746 Crash type: Heap-buffer-overflow READ 2 Crash state: dhcp6optionparsestatus dhcp6optionparsepdprefix dhcp6optionparseia...

OSV-2018-149 Heap-buffer-overflow in BEInt<unsigned int, 4>::operator unsigned int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11033 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned int AAT::KerxSubTableFormat2::sanitize hbsanitizecontextt::returnt AAT::KerxTable::dispatch...

OSV-2018-145 Heap-buffer-overflow in cras_rclient_message_from_client

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9242 Crash type: Heap-buffer-overflow READ 4 Crash state: crasrclientmessagefromclient crasrclientbufferfromclient rclientmessage.cc...

OSV-2018-146 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11526 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short OT::KernSubTable::getsize void hbsanitizecontextt::setobjectOT::KernSubTableOT::KernOTSubTableHeader...

OSV-2018-142 UNKNOWN READ in cff_decoder_parse_charstrings

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11157 Crash type: UNKNOWN READ Crash state: cffdecoderparsecharstrings cffslotload FTLoadGlyph...

OSV-2018-143 Global-buffer-overflow in CFF::BlendArg::set_blends

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11714 Crash type: Global-buffer-overflow READ 8 Crash state: CFF::BlendArg::setblends CFF::CFF2CSOpSetCFF2CSOpSetSubrSubset, CFF::SubrSubsetParam, CFF::PathProcsNul CFF2CSOpSetSubrSubset::processop...

OSV-2018-140 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11074 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short AAT::LookupFormat10 ::sanitize AAT::Lookup ::sanitize...

OSV-2018-138 Heap-buffer-overflow in parse_odp_key_mask_attr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11160 Crash type: Heap-buffer-overflow READ 1 Crash state: parseodpkeymaskattr odpflowfromstring parsekeys...

OSV-2018-134 Heap-buffer-overflow in bloaty::DisassembleFindReferences

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5873 Crash type: Heap-buffer-overflow READ 4 Crash state: bloaty::DisassembleFindReferences bloaty::ReadELFSymbols bloaty::ReadELFSymbols...

OSV-2018-137 Heap-buffer-overflow in set_char_prefix

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10159 Crash type: Heap-buffer-overflow WRITE 1 Crash state: setcharprefix parseincludeddirectories setlongoption...

OSV-2018-130 Stack-buffer-overflow in parse_tables

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12466 Crash type: Stack-buffer-overflow WRITE 7 Crash state: parsetables processblock douncompressfile...

OSV-2018-131 Use-of-uninitialized-value in json_string_unescape

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11473 Crash type: Use-of-uninitialized-value Crash state: jsonstringunescape ofputiltablefromstring parseofpstr...

OSV-2018-129 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11657 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int CFF::Charset12 ::getglyph...

OSV-2018-128 Use-of-uninitialized-value in iclip

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11392 Crash type: Use-of-uninitialized-value Crash state: iclip avgc dav1dreconbinter16bpc...