OSV-2018-185 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11001 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short OT::IndexSubtable::getextents OT::IndexSubtableRecord::getextents...

OSV-2018-176 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10899 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short AAT::LookupSegmentSingle ::cmp AAT::LookupSegmentSingle const OT::VarSizedBi...

OSV-2018-159 Use-of-uninitialized-value in AAT::LookupFormat8<OT::IntType<unsigned short, 2u> >::get_value

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10953 Crash type: Use-of-uninitialized-value Crash state: AAT::LookupFormat8 ::getvalue AAT::Lookup ::getvalue AAT::StateTable::getclass...

OSV-2018-150 Global-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11010 Crash type: Global-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short AAT::ContextualSubtable::drivercontextt::transition void AAT::StateTableDriver::driveAAT::Conte...

OSV-2018-146 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11526 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short OT::KernSubTable::getsize void hbsanitizecontextt::setobjectOT::KernSubTableOT::KernOTSubTableHeader...

OSV-2018-140 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11074 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short AAT::LookupFormat10 ::sanitize AAT::Lookup ::sanitize...

OSV-2018-129 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11657 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int CFF::Charset12 ::getglyph...

OSV-2018-127 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10341 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short OT::Offset, true::isnull OT::OffsetToOT::ArrayOfM1OT::ResourceTypeRecord, OT::IntTypeunsigned short, 2...

OSV-2018-116 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11060 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short AAT::LookupFormat10 ::sanitize AAT::Lookup ::sanitize...

OSV-2018-112 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10356 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short OT::BinSearchHeader::operator unsigned int OT::OffsetTable::findtableindex...

OSV-2018-106 Stack-use-after-return in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10082 Crash type: Stack-use-after-return READ 1 Crash state: BEInt::operator unsigned short OT::CoverageFormat2::Iter::more OT::SingleSubstFormat2::closure...

OSV-2018-1 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10897 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short AAT::StateTable ::sanitize AAT::KerxSubTableFormat1::sanitize...

OSV-2020-1325 Global-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21769 Crash type: Global-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int CFF::Charset0::getglyph...

OSV-2020-1246 Stack-buffer-overflow in void apply_sao_internal<unsigned short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13643 Crash type: Stack-buffer-overflow READ 4 Crash state: void applysaointernal void applysao threadtasksao::work...

OSV-2020-1138 Heap-buffer-overflow in void apply_sao_internal<unsigned short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14184 Crash type: Heap-buffer-overflow READ 1 Crash state: void applysaointernal void applysao threadtasksao::work...

OSV-2020-708 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14919 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int hbmapiterthbmapiterthbarraytOT::OffsetToOT::AxisValue, OT::IntTypeu...

OSV-2020-698 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18515 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::ArrayOf, OT::IntType ::...

OSV-2020-548 Heap-buffer-overflow in acommon::DecodeDirect<unsigned short>::decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16531 Crash type: Heap-buffer-overflow READ 2 Crash state: acommon::DecodeDirect::decode acommon::Convert::convert aspellspellersuggest...

OSV-2020-412 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18503 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int decltype...

OSV-2020-347 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14825 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::AxisValue::sanitize...