libyang: heap-buffer-overflow in lyd_lyb_data_length

With the following auto-generated fuzz target: include "/src/libyang/src/treedata.h" include include int LLVMFuzzerTestOneInputconst uint8t data, sizet size if !size return 0; const char dataptr = const char data; // Ensure the data is null-terminated. char nullterminateddata = mallocsize + 1; if...

libucl:ucl_add_string_fuzzer: Crash in ucl_hash_func

Project: https://github.com/vstakhov/libucl.git Detailed Report: https://oss-fuzz.com/testcase?key=4794779500609536 Project: libucl Fuzzing Engine: libFuzzer Fuzz Target: ucladdstringfuzzer Job Type: libfuzzerubsanlibucl Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xfffffffffffffff...

capstone:fuzz_disasmnext: Heap-buffer-overflow in readBytes48

Detailed Report: https://oss-fuzz.com/testcase?key=4815842800369664 Project: capstone Fuzzing Engine: libFuzzer Fuzz Target: fuzzdisasmnext Job Type: libfuzzerasancapstone Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x5020000000b6 Crash State: readBytes48...

openexr:openexr_exrcorecheck_fuzzer: Crash in internal_exr_validate_shared_attrs

Project: https://github.com/AcademySoftwareFoundation/openexr.git Detailed Report: https://oss-fuzz.com/testcase?key=5169495038033920 Project: openexr Fuzzing Engine: libFuzzer Fuzz Target: openexrexrcorecheckfuzzer Job Type: libfuzzerubsanopenexr Platform Id: linux Crash Type: UNKNOWN READ Crash...

libheif:file_fuzzer: Heap-buffer-overflow in Op_RGB_to_YCbCr<unsigned char>::convert_colorspace

Project: https://github.com/strukturag/libheif.git Detailed Report: https://oss-fuzz.com/testcase?key=5087089471848448 Project: libheif Fuzzing Engine: afl Fuzz Target: filefuzzer Job Type: aflasanlibheif Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x52500000c10f Cra...

libjpeg-turbo:decompress_yuv_fuzzer_dev: Use-of-uninitialized-value in decompress_yuv.cc

Detailed Report: https://oss-fuzz.com/testcase?key=6185125941936128 Project: libjpeg-turbo Fuzzing Engine: libFuzzer Fuzz Target: decompressyuvfuzzerdev Job Type: libfuzzermsanlibjpeg-turbo Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: decompressyuv.cc...

edk2:TestFileName: Heap-buffer-overflow in StrLen

Detailed Report: https://oss-fuzz.com/testcase?key=5251909353537536 Project: edk2 Fuzzing Engine: libFuzzer Fuzz Target: TestFileName Job Type: libfuzzerasanedk2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x521000006100 Crash State: StrLen MangleFileName...

envoy:ext_authz_grpc_fuzz_test: Segv on unknown address in Envoy::Extensions::HttpFilters::ExtAuthz::Filter::updateLoggingInfo

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=5836362295607296 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: extauthzgrpcfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash...

sound-open-firmware:sof-ipc3: Crash in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5904359311867904 Project: sound-open-firmware Fuzzing Engine: libFuzzer Fuzz Target: sof-ipc3 Job Type: libfuzzerasani386sound-open-firmware Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00002fe6 Crash State: pthreadcreate...

poco:jwt_decode_fuzzer: Use-of-uninitialized-value in Poco::Dynamic::Var::~Var

Project: https://github.com/pocoproject/poco.git Detailed Report: https://oss-fuzz.com/testcase?key=5129032620900352 Project: poco Fuzzing Engine: libFuzzer Fuzz Target: jwtdecodefuzzer Job Type: libfuzzermsanpoco Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash Stat...

ffmpeg:ffmpeg_dem_QCP_fuzzer: Use-of-uninitialized-value in qcp_read_header

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4647386712965120 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegdemQCPfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

ffmpeg:ffmpeg_AV_CODEC_ID_EATGQ_fuzzer: Use-of-uninitialized-value in tgq_decode_frame

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5607656650244096 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDEATGQfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

binutils:fuzz_windres: Null-dereference READ in ubsan_GetStackTrace

Detailed Report: https://oss-fuzz.com/testcase?key=5323261395664896 Project: binutils Fuzzing Engine: libFuzzer Fuzz Target: fuzzwindres Job Type: libfuzzerubsanbinutils Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: ubsanGetStackTrace Sanitizer:...

sleuthkit:sleuthkit_fls_apfs_fuzzer: Segv on unknown address in tsk_img_free

Project: https://github.com/sleuthkit/sleuthkit.git Detailed Report: https://oss-fuzz.com/testcase?key=4797449401597952 Project: sleuthkit Fuzzing Engine: honggfuzz Fuzz Target: sleuthkitflsapfsfuzzer Job Type: honggfuzzasansleuthkit Platform Id: linux Crash Type: Segv on unknown address Crash...

openjpeg:opj_decompress_fuzzer_JP2: Heap-buffer-overflow in opj_j2k_read_tile_header

Project: https://github.com/uclouvain/openjpeg.git https://github.com/uclouvain/openjpeg-data.git Detailed Report: https://oss-fuzz.com/testcase?key=5963662542569472 Project: openjpeg Fuzzing Engine: afl Fuzz Target: opjdecompressfuzzerJP2 Job Type: aflasanopenjpeg Platform Id: linux Crash Type:...

edk2:TestFileName: Heap-buffer-overflow in StrLen

Project: https://github.com/tianocore/edk2.git Detailed Report: https://oss-fuzz.com/testcase?key=6304711178256384 Project: edk2 Fuzzing Engine: libFuzzer Fuzz Target: TestFileName Job Type: libfuzzerasanedk2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x521000006100...

icu:message_formatter_fuzzer: Heap-use-after-free in icu_76::message2::MessageFormatter::~MessageFormatter

Detailed Report: https://oss-fuzz.com/testcase?key=5004888403148800 Project: icu Fuzzing Engine: afl Fuzz Target: messageformatterfuzzer Job Type: aflasanicu Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x504000000920 Crash State:...

graphicsmagick:coder_AVIF_fuzzer: Use-of-uninitialized-value in HeifContext::has_alpha

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=4820668783329280 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderAVIFfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type: Use-of-uninitialized-value...

libreoffice:docxfuzzer: Container-overflow in SvMemoryStream::GetData

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=4788719863791616 Project: libreoffice Fuzzing Engine: libFuzzer Fuzz Target: docxfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Container-overflow WRITE Crash...

mpv:fuzzer_loadfile_mkv: Heap-buffer-overflow in guess_mv

Project: https://github.com/mpv-player/mpv.git Detailed Report: https://oss-fuzz.com/testcase?key=6708624888496128 Project: mpv Fuzzing Engine: libFuzzer Fuzz Target: fuzzerloadfilemkv Job Type: libfuzzerasanmpv Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

wireshark:fuzzshark_ip_proto-udp: Index-out-of-bounds in DOFObjectID_Create_Unmarshal

Project: https://code.wireshark.org/review/wireshark https://gitlab.com/wireshark/wireshark.git Detailed Report: https://oss-fuzz.com/testcase?key=6277172019396608 Project: wireshark Fuzzing Engine: libFuzzer Fuzz Target: fuzzsharkipproto-udp Job Type: libfuzzerubsanwireshark Platform Id: linux...

kimageformats:kimgio_heif_fuzzer: Heap-buffer-overflow in Op_YCbCr_to_RGB<unsigned short>::convert_colorspace

Project: git://anongit.kde.org/kimageformats Detailed Report: https://oss-fuzz.com/testcase?key=6210752350846976 Project: kimageformats Fuzzing Engine: honggfuzz Fuzz Target: kimgioheiffuzzer Job Type: honggfuzzasankimageformats Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash...

imagemagick:encoder_heic_fuzzer: Use-of-uninitialized-value in HeifContext::has_alpha

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=6198545529503744 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderheicfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value...

flac:fuzzer_tool_flac: Heap-use-after-free in FLAC__metadata_object_delete_data

Detailed Report: https://oss-fuzz.com/testcase?key=5957218564898816 Project: flac Fuzzing Engine: afl Fuzz Target: fuzzertoolflac Job Type: aflasanflac Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x50f000007930 Crash State: FLACmetadataobjectdeletedata...

log4j2:log4j-layout-template-json-fuzz-test-JsonTemplateLayoutCodecFuzzer: Security exception in org.apache.logging.log4j.layout.template.json.util.JsonReader.readToken

Detailed Report: https://oss-fuzz.com/testcase?key=5866173562945536 Project: log4j2 Fuzzing Engine: libFuzzer Fuzz Target: log4j-layout-template-json-fuzz-test-JsonTemplateLayoutCodecFuzzer Job Type: libfuzzerasanlog4j2 Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

jstl-api:ParserFuzzer: Security exception in ParserFuzzer

Detailed Report: https://oss-fuzz.com/testcase?key=5817500162392064 Project: jstl-api Fuzzing Engine: libFuzzer Fuzz Target: ParserFuzzer Job Type: libfuzzerasanjstl-api Platform Id: linux Crash Type: Security exception Crash Address: Crash State: ParserFuzzer Sanitizer: address ASAN Recommended...

imagemagick:encoder_tiff64_fuzzer: Use-of-uninitialized-value in PixarLogDecode

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5749361525456896 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encodertiff64fuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value...

libjpeg-turbo:decompress_yuv_fuzzer_dev: Use-of-uninitialized-value in decompress_yuv.cc

Detailed Report: https://oss-fuzz.com/testcase?key=5483929245646848 Project: libjpeg-turbo Fuzzing Engine: libFuzzer Fuzz Target: decompressyuvfuzzerdev Job Type: libfuzzermsanlibjpeg-turbo Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: decompressyuv.cc...

ffmpeg:ffmpeg_dem_MXF_fuzzer: Use-of-uninitialized-value in mxf_read_packet

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5448597561212928 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegdemMXFfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

libjpeg-turbo:transform_fuzzer_2_1_x: Heap-buffer-overflow in write_marker_byte

Detailed Report: https://oss-fuzz.com/testcase?key=5194053023498240 Project: libjpeg-turbo Fuzzing Engine: afl Fuzz Target: transformfuzzer21x Job Type: aflasanlibjpeg-turbo Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x52d000fef000 Crash State: writemarkerbyte...

poppler:annot_fuzzer: Crash in std::__1::recursive_mutex::lock

Project: https://anongit.freedesktop.org/git/poppler/poppler.git https://gitlab.freedesktop.org/poppler/poppler.git https://gitlab.freedesktop.org/ceyhunalp/poppler.git Detailed Report: https://oss-fuzz.com/testcase?key=5184111583494144 Project: poppler Fuzzing Engine: libFuzzer Fuzz Target:...

lucene:QueryParserFuzzer: Security exception in org.apache.lucene.util.ArrayUtil.copyOfSubArray

Detailed Report: https://oss-fuzz.com/testcase?key=5156969554444288 Project: lucene Fuzzing Engine: libFuzzer Fuzz Target: QueryParserFuzzer Job Type: libfuzzerasanlucene Platform Id: linux Crash Type: Security exception Crash Address: Crash State: org.apache.lucene.util.ArrayUtil.copyOfSubArray...

gpac:fuzz_probe_analyze: Crash in gf_m3u8_to_mpd

Detailed Report: https://oss-fuzz.com/testcase?key=5150445264240640 Project: gpac Fuzzing Engine: afl Fuzz Target: fuzzprobeanalyze Job Type: aflasangpac Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x50510001b6af Crash State: gfm3u8tompd gfdashopen dashdmxconfigurepid Sanitizer:...

gdal:gdal_fuzzer: Heap-use-after-free in Page::getAnnots

Project: https://github.com/OSGeo/gdal.git Detailed Report: https://oss-fuzz.com/testcase?key=5116903314489344 Project: gdal Fuzzing Engine: libFuzzer Fuzz Target: gdalfuzzer Job Type: libfuzzerasani386gdal Platform Id: linux Crash Type: Heap-use-after-free WRITE 4 Crash Address: 0xf3601d44 Crash...

tarantool:luaL_loadbuffer_fuzzer: Crash in parse_chunk

Project: https://github.com/tarantool/tarantool.git Detailed Report: https://oss-fuzz.com/testcase?key=5091141278564352 Project: tarantool Fuzzing Engine: libFuzzer Fuzz Target: luaLloadbufferfuzzer Job Type: libfuzzerasantarantool Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

ghostscript:gs_device_tiffsep1_fuzzer: Crash in chunk_free_object

Detailed Report: https://oss-fuzz.com/testcase?key=5084782411710464 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gsdevicetiffsep1fuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00000045e03e Crash State: chunkfreeobject...

mruby:mruby_fuzzer: Segv on unknown address in mrb_bint_reduce

Project: https://github.com/mruby/mruby.git Detailed Report: https://oss-fuzz.com/testcase?key=5084180629749760 Project: mruby Fuzzing Engine: libFuzzer Fuzz Target: mrubyfuzzer Job Type: libfuzzerasanmruby Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State:...

libzmq:test_bind_fuzzer: Segv on unknown address in test_bind_fuzzer

Detailed Report: https://oss-fuzz.com/testcase?key=5083360966279168 Project: libzmq Fuzzing Engine: libFuzzer Fuzz Target: testbindfuzzer Job Type: libfuzzerasanlibzmq Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: testbindfuzzer Sanitizer: address ASAN Crash...

apache-poi:POIVisioFuzzer: Security exception in org.apache.poi.hdgf.streams.CompressedStreamStore.decompress

Detailed Report: https://oss-fuzz.com/testcase?key=5080115023773696 Project: apache-poi Fuzzing Engine: libFuzzer Fuzz Target: POIVisioFuzzer Job Type: libfuzzerasanapache-poi Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

libheif:file_fuzzer: Heap-buffer-overflow in HeifPixelImage::fill_RGB_16bit

Project: https://github.com/strukturag/libheif.git Detailed Report: https://oss-fuzz.com/testcase?key=5031427882680320 Project: libheif Fuzzing Engine: afl Fuzz Target: filefuzzer Job Type: aflasanlibheif Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash Address: 0x52900155828f Cras...

poppler:qt_textbox_fuzzer: Heap-use-after-free in Page::loadStandaloneFields

Project: https://anongit.freedesktop.org/git/poppler/poppler.git https://gitlab.freedesktop.org/poppler/poppler.git https://gitlab.freedesktop.org/ceyhunalp/poppler.git Detailed Report: https://oss-fuzz.com/testcase?key=4887369122119680 Project: poppler Fuzzing Engine: honggfuzz Fuzz Target:...

php:php-fuzz-execute: Crash in i_zval_ptr_dtor

Detailed Report: https://oss-fuzz.com/testcase?key=4860195954556928 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-execute Job Type: libfuzzerubsanphp Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x569798ffa010 Crash State: izvalptrdtor zhoitdtor zendobjectsstoredel...

libreoffice:fodtfuzzer: Bad-cast to SwDrawFrameFormat from SwFlyFrameFormat in SwContact::GetFormat

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=4853648008478720 Project: libreoffice Fuzzing Engine: libFuzzer Fuzz Target: fodtfuzzer Job Type: libfuzzerubsanlibreoffice Platform Id: linux Crash Type: Bad-cast Crash Address:...

binutils:fuzz_addr2line: Crash in bfd_elf_get_str_section

Detailed Report: https://oss-fuzz.com/testcase?key=4829344768262144 Project: binutils Fuzzing Engine: libFuzzer Fuzz Target: fuzzaddr2line Job Type: libfuzzerasanbinutils Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7d3445d16bff Crash State: bfdelfgetstrsection...

libultrahdr:ultrahdr_dec_fuzzer: Heap-buffer-overflow in ultrahdr::getYuv444Pixel

Project: https://github.com/google/libultrahdr.git Detailed Report: https://oss-fuzz.com/testcase?key=4812956699787264 Project: libultrahdr Fuzzing Engine: afl Fuzz Target: ultrahdrdecfuzzer Job Type: aflasanlibultrahdr Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

assimp:assimp_fuzzer: Bad-cast to Assimp::LogStream from invalid vptr in CallbackToLogRedirector

Project: https://github.com/assimp/assimp.git Detailed Report: https://oss-fuzz.com/testcase?key=4550823252656128 Project: assimp Fuzzing Engine: libFuzzer Fuzz Target: assimpfuzzer Job Type: libfuzzerubsanassimp Platform Id: linux Crash Type: Bad-cast Crash Address: 0x5ad54fb106e0 Crash State:...

llamacpp:fuzz_inference: Heap-buffer-overflow in gguf_get_tensor_offset

Detailed Report: https://oss-fuzz.com/testcase?key=4527906179579904 Project: llamacpp Fuzzing Engine: libFuzzer Fuzz Target: fuzzinference Job Type: libfuzzerasanllamacpp Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x518000000de8 Crash State: ggufgettensoroffset...

openbabel: heap-use-after-free in OpenBabel::FreeBondExpr

With the following new fuzz target: include "/src/openbabel/include/openbabel/rotor.h" include "/src/openbabel/include/openbabel/phmodel.h" include include extern "C" int LLVMFuzzerTestOneInputconst uint8t Data, sizet Size FuzzedDataProvider fuzzeddataproviderData, Size; std::string buffer =...

libucl: Heap-buffer-overflow in ucl_maybe_parse_number

With the following harness: include include include include "ucl.h" int uclmaybeparsenumber uclobjectt obj, const char start, const char end, const char pos, bool allowdouble, bool numberbytes, bool allowtime; int LLVMFuzzerTestOneInputconst uint8t data, sizet size if size == 0 return 0; uclobjec...

pjsip: Heap-buffer-overflow in pjmedia_rtcp_fb_parse_rpsi

With the new following fuzz target: include "/src/pjsip/pjmedia/include/pjmedia/rtcpfb.h" include include int LLVMFuzzerTestOneInputconst uint8t data, sizet size if size & /src/llvm-project/compiler-r...