RawSpeed 缓冲区错误漏洞

RawSpeed is a full-line solution for Internet users to upload and download large files. A buffer overflow vulnerability exists in RawSpeed, which stems from an out-of-bounds read/write operation occurring due to a failure to validate memory boundaries during a call to the TableLookUp::setTable...

OSV-2017-116 Use-after-poison in rawspeed::OrfDecoder::decodeCompressed

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3012 Crash type: Use-after-poison WRITE 2 Crash state: rawspeed::OrfDecoder::decodeCompressed rawspeed::OrfDecoder::decodeRawInternal rawspeed::RawDecoder::decodeRaw...

OSV-2017-97 Use-after-poison in rawspeed::unroll_loop_t<void rawspeed::LJpegDecompressor::decodeN<4>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4451 Crash type: Use-after-poison WRITE 2 Crash state: rawspeed::unrollloopt void rawspeed::LJpegDecompressor::decodeN rawspeed::AbstractLJpegDecompressor::decode...

OSV-2018-231 Use-of-uninitialized-value in rawspeed::RawImageData::checkMemIsInitialized

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5843 Crash type: Use-of-uninitialized-value Crash state: rawspeed::RawImageData::checkMemIsInitialized rawspeed::RawDecoder::decodeRaw rawspeed::alignedMalloc...

OSV-2018-227 Heap-buffer-overflow in rawspeed::TableLookUp::setTable

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5256 Crash type: Heap-buffer-overflow WRITE 2 Crash state: rawspeed::TableLookUp::setTable rawspeed::RawImageData::setTable rawspeed::DngDecoder::handleMetadata...

OSV-2018-175 Heap-buffer-overflow in rawspeed::VC5Decompressor::Wavelet::HighPassBand::decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11429 Crash type: Heap-buffer-overflow WRITE 2 Crash state: rawspeed::VC5Decompressor::Wavelet::HighPassBand::decode rawspeed::VC5Decompressor::decode VC5Decompressor.cpp...

OSV-2018-19 Use-of-uninitialized-value in rawspeed::RawImageData::checkMemIsInitialized

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6796 Crash type: Use-of-uninitialized-value Crash state: rawspeed::RawImageData::checkMemIsInitialized rawspeed::RawDecoder::decodeRaw rawspeed::alignedMalloc...

OSV-2020-290 Use-of-uninitialized-value in rawspeed::RawImageData::checkMemIsInitialized

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18877 Crash type: Use-of-uninitialized-value Crash state: rawspeed::RawImageData::checkMemIsInitialized PhaseOneDecompressor.cpp posixmemalign...

librawspeed/TiffDecoderFuzzer-ArwDecoder: Use-of-uninitialized-value in rawspeed::TiffEntry::TiffEntry

Project: https://github.com/darktable-org/rawspeed.git Detailed report: https://oss-fuzz.com/testcase?key=6192213462614016 Project: librawspeed Fuzzer: libFuzzerlibrawspeedTiffDecoderFuzzer-ArwDecoder Fuzz target binary: TiffDecoderFuzzer-ArwDecoder Job Type: libfuzzermsanlibrawspeed Platform Id:...

librawspeed/Cr2DecompressorFuzzer: Use-after-poison in void rawspeed::Cr2Decompressor::decodeN_X_Y<4, 1, 1>

Project: https://github.com/darktable-org/rawspeed.git Detailed report: https://oss-fuzz.com/testcase?key=5657069119078400 Project: librawspeed Fuzzer: afllibrawspeedCr2DecompressorFuzzer Fuzz target binary: Cr2DecompressorFuzzer Job Type: aflasanlibrawspeed Platform Id: linux Crash Type:...

librawspeed/LJpegDecompressorFuzzer: Use-after-poison in rawspeed::unroll_loop_t<void rawspeed::LJpegDecompressor::decodeN<4>

Project: https://github.com/darktable-org/rawspeed.git Detailed report: https://oss-fuzz.com/testcase?key=5071283126534144 Project: librawspeed Fuzzer: libFuzzerlibrawspeedLJpegDecompressorFuzzer Fuzz target binary: LJpegDecompressorFuzzer Job Type: libfuzzerasanlibrawspeed Platform Id: linux Cra...

librawspeed/LJpegDecompressorFuzzer: Use-after-poison in void rawspeed::LJpegDecompressor::decodeN<4>

Project: https://github.com/darktable-org/rawspeed.git Detailed report: https://oss-fuzz.com/testcase?key=6742329370083328 Project: librawspeed Fuzzer: libFuzzerlibrawspeedLJpegDecompressorFuzzer Fuzz target binary: LJpegDecompressorFuzzer Job Type: libfuzzerasanlibrawspeed Platform Id: linux Cra...

librawspeed/LJpegDecompressorFuzzer: Use-after-poison in rawspeed::unroll_loop_t<void rawspeed::LJpegDecompressor::decodeN<4>

Project: https://github.com/darktable-org/rawspeed.git Detailed report: https://oss-fuzz.com/testcase?key=6127728576167936 Project: librawspeed Fuzzer: afllibrawspeedLJpegDecompressorFuzzer Fuzz target binary: LJpegDecompressorFuzzer Job Type: aflasanlibrawspeed Platform Id: linux Crash Type:...

librawspeed: Use-after-poison in rawspeed::NefDecoder::DecodeNikonSNef

Project: https://github.com/darktable-org/rawspeed.git Detailed report: https://oss-fuzz.com/testcase?key=6315707312635904 Project: librawspeed Fuzzer: afllibrawspeedTiffDecoderFuzzer-NefDecoder Fuzz target binary: TiffDecoderFuzzer-NefDecoder Job Type: aflasanlibrawspeed Platform Id: linux Crash...

librawspeed: Bad-cast to rawspeed::RawDecoder from invalid vptr;rawspeed::RawDecoderDecodeThread;rawspeed::RawDecoder::startTasks

Project: https://github.com/darktable-org/rawspeed.git Detailed report: https://oss-fuzz.com/testcase?key=4612305675354112 Project: librawspeed Fuzzer: libFuzzerlibrawspeedX3fParserFuzzer-GetDecoder-Decode Fuzz target binary: X3fParserFuzzer-GetDecoder-Decode Job Type: libfuzzerubsanlibrawspeed...

librawspeed: Bad-cast to rawspeed::RawDecoder from invalid vptr;rawspeed::X3fDecoder::decompressSigma;rawspeed::X3fDecoder::decodeRawInternal

Project: https://github.com/darktable-org/rawspeed.git Detailed report: https://oss-fuzz.com/testcase?key=4512203543674880 Project: librawspeed Fuzzer: libFuzzerlibrawspeedX3fParserFuzzer-GetDecoder-Decode Fuzz target binary: X3fParserFuzzer-GetDecoder-Decode Job Type: libfuzzerubsanlibrawspeed...