OSV-2023-889 Heap-double-free in regcomp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62529 Crash type: Heap-double-free Crash state: regcomp fileregcomp load1...

OSV-2023-869 Heap-buffer-overflow in Assimp::MD5::MD5MeshParser::MD5MeshParser

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62441 Crash type: Heap-buffer-overflow READ 1 Crash state: Assimp::MD5::MD5MeshParser::MD5MeshParser Assimp::MD5Importer::LoadMD5MeshFile Assimp::MD5Importer::InternReadFile...

OSV-2023-800 Heap-buffer-overflow in XCFImageFormat::loadTileRLE

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62098 Crash type: Heap-buffer-overflow WRITE 1 Crash state: XCFImageFormat::loadTileRLE XCFImageFormat::loadLevel XCFImageFormat::loadHierarchy...

OSV-2023-693 Security exception in org.json.JSONArray.writeTo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61399 Crash type: Security exception Crash state: org.json.JSONArray.writeTo org.json.JSONStringer.value org.json.JSONStringer.peek...

OSV-2023-580 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60640 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr java.base/java.lang.Exception. java.base/java.lang.RuntimeException...

OSV-2023-567 Stack-buffer-overflow in initialize_encryption_key

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60563 Crash type: Stack-buffer-overflow READ Crash state: initializeencryptionkey cliole2extract cliscanole2...

OSV-2023-508 Heap-buffer-overflow in AffixMgr::compound_check

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60034 Crash type: Heap-buffer-overflow READ 1 Crash state: AffixMgr::compoundcheck AffixMgr::compoundcheck AffixMgr::compoundcheck...

OSV-2023-504 Heap-buffer-overflow in ndpi_search_line

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60003 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpisearchline checkndpidetectionfunc ndpicheckflowfunc...

OSV-2023-436 Heap-buffer-overflow in ndpi_check_punycode_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59393 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpicheckpunycodestring ndpimatchhostsubprotocol checkcontenttypeandchangeprotocol...

OSV-2023-409 Heap-use-after-free in zval_call_destructor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59072 Crash type: Heap-use-after-free READ 4 Crash state: zvalcalldestructor zendhashreverseapply shutdowndestructors...

OSV-2023-356 Heap-buffer-overflow in pdf_nextobject

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58475 Crash type: Heap-buffer-overflow READ 1 Crash state: pdfnextobject findlength pdfextractobj...

OSV-2023-243 UNKNOWN WRITE in processCertificateElements

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57448 Crash type: UNKNOWN WRITE Crash state: processCertificateElements fuzztlscertificate.c...

OSV-2023-225 Heap-buffer-overflow in std::__1::enable_if<true, void>::type APFSBtreeNodeIterator<APFSBtreeNode<apfs_o

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57364 Crash type: Heap-buffer-overflow READ 2 Crash state: std::1::enableif::type APFSBtreeNodeIterator ::APFSBtree APFSBtreeNodeIterator APFSBtreeN...

OSV-2023-174 Global-buffer-overflow in htmlCurrentChar

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56964 Crash type: Global-buffer-overflow READ 1 Crash state: htmlCurrentChar htmlParseNameComplex htmlParseName...

OSV-2023-96 Heap-buffer-overflow in load_buffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56208 Crash type: Heap-buffer-overflow READ 8 Crash state: loadbuffer rbinobjectnew rbinfilenewfrombuffer...

OSV-2022-1248 Object-size in wabt::BinaryReaderIR::OnCodeMetadataCount

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54092 Crash type: Object-size Crash state: wabt::BinaryReaderIR::OnCodeMetadataCount wabt::BinaryReader::ReadCodeMetadataSection wabt::BinaryReader::ReadCustomSection...

OSV-2022-1188 Stack-buffer-overflow in authentic_get_tagged_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53536 Crash type: Stack-buffer-overflow READ 1 Crash state: authenticgettaggeddata authenticparsecredentialdata authenticpingetpolicy...

OSV-2022-1180 Heap-buffer-overflow in json_common_entity_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53468 Crash type: Heap-buffer-overflow READ 8 Crash state: jsoncommonentitydata jsonobjectswrite dwgwritejson...

OSV-2022-1159 Heap-buffer-overflow in LibRaw_buffer_datastream::read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53158 Crash type: Heap-buffer-overflow WRITE Crash state: LibRawbufferdatastream::read LibRaw::uncompressedfpdngloadraw LibRaw::unpack...

OSV-2022-1134 Heap-buffer-overflow in ndlz8_decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52967 Crash type: Heap-buffer-overflow READ 1 Crash state: ndlz8decompress bloscd dojob...

OSV-2022-1133 Security exception in org.codehaus.janino.Parser.parseAssignmentExpression

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52971 Crash type: Security exception Crash state: org.codehaus.janino.Parser.parseAssignmentExpression java.base/sun.nio.cs.CESU8$Encoder.encodeLoop java.base/java.nio.charset.CharsetEncoder.encode...

OSV-2022-1131 Heap-use-after-free in gs_font_finalize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52986 Crash type: Heap-use-after-free READ 8 Crash state: gsfontfinalize gsgcreclaim ireclaim...

OSV-2022-1108 Use-after-poison in /mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_ruby_e5a0a396033f4deba21

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52788 Crash type: Use-after-poison READ 1 Crash state: /mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-buildsrubye5a0a396033f4deba21 /mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-buildsrubye5a0a396033f4deba21...

OSV-2022-1061 Heap-buffer-overflow in AffixMgr::compound_check

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52486 Crash type: Heap-buffer-overflow READ 1 Crash state: AffixMgr::compoundcheck HunspellImpl::checkword HunspellImpl::spellinternal...

OSV-2022-996 Use-of-uninitialized-value in GrTriangulator::sanitizeContours

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51921 Crash type: Use-of-uninitialized-value Crash state: GrTriangulator::sanitizeContours GrTriangulator::contoursToPolys GrTriangulator::pathToPolys...

OSV-2022-994 Heap-buffer-overflow in onig_node_str_cat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51920 Crash type: Heap-buffer-overflow READ 4 Crash state: onignodestrcat parseexp parsebranch...

OSV-2022-962 Security exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51840 Crash type: Security exception Crash state: com.ctc.wstx.dtd.FullDTDReader.readContentSpec java.base/sun.nio.cs.CESU8.updatePositions java.base/sun.nio.cs.CESU8$Encoder.encodeArrayLoop...

OSV-2022-943 UNKNOWN WRITE in perfetto::trace_processor::TrackEventParser::ParseTrackDescriptor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51695 Crash type: UNKNOWN WRITE Crash state: perfetto::traceprocessor::TrackEventParser::ParseTrackDescriptor perfetto::traceprocessor::TrackEventModule::ParsePacket...

OSV-2022-915 Security exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51552 Crash type: Security exception Crash state: com.ctc.wstx.dtd.FullDTDReader.readContentSpec java.base/java.io.StringReader.read com.ctc.wstx.io.MergedReader.read...

OSV-2022-902 Invalid-free in function signature specialization <Arg

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51434 Crash type: Invalid-free Crash state: function signature specialization Arg NIOHTTP1.HTTPDecoder.didFinishHead protocol witness for NIOHTTP1...

OSV-2022-872 Stack-buffer-overflow in PfxEntry::test_condition

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51134 Crash type: Stack-buffer-overflow READ 1 Crash state: PfxEntry::testcondition PfxEntry::checkword AffixMgr::prefixcheck...

OSV-2022-847 Heap-use-after-free in ndlz4_decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50991 Crash type: Heap-use-after-free READ 4 Crash state: ndlz4decompress bloscd dojob...

OSV-2022-842 Stack-buffer-overflow in wc_Shake256_Final

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50946 Crash type: Stack-buffer-overflow WRITE Crash state: wcShake256Final wced448signmsgex wced448signmsg...

OSV-2022-799 Incorrect-function-pointer-type in grk::BufferedStream::read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50661 Crash type: Incorrect-function-pointer-type Crash state: grk::BufferedStream::read grk::FileFormatDecompress::readboxhdr grk::FileFormatDecompress::readHeaderProcedureImpl...

OSV-2022-797 Heap-buffer-overflow in Ins_NPUSHB

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50656 Crash type: Heap-buffer-overflow READ 1 Crash state: InsNPUSHB RunIns InstanceReset...

OSV-2022-729 Security exception in org.apache.commons.jxpath.ri.compiler.CoreOperationMultiply.computeValue

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50372 Crash type: Security exception Crash state: org.apache.commons.jxpath.ri.compiler.CoreOperationMultiply.computeValue org.apache.commons.jxpath.ri.compiler.CoreOperationMultiply.computeValue...

OSV-2022-724 Stack-buffer-underflow in gs_type2_interpret

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50306 Crash type: Stack-buffer-underflow READ 4 Crash state: gstype2interpret copiedtype1glyphoutline gsdefaultglyphinfo...

OSV-2022-695 Segv on unknown address in ndpi_free_flow_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49906 Crash type: Segv on unknown address Crash state: ndpifreeflowdata ndpiflowfree processndpicollectedinfo...

OSV-2022-648 Use-of-uninitialized-value in _LUTeval16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49549 Crash type: Use-of-uninitialized-value Crash state: LUTeval16 cmsCreateExtendedTransform cmsCreateTransform...

OSV-2022-635 UNKNOWN READ in EvalSegmentedFn

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49490 Crash type: UNKNOWN READ Crash state: EvalSegmentedFn cmsEvalToneCurveFloat TypevcgtWrite...

OSV-2022-628 Segv on unknown address in mpz_add

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49453 Crash type: Segv on unknown address Crash state: mpzadd mpzsub mrbbintsub...

OSV-2022-562 UNKNOWN WRITE in udiv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48904 Crash type: UNKNOWN WRITE Crash state: udiv mrbbintmod intmod...

OSV-2022-533 Check failed in CheckUnwind

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48629 Crash type: Check failed Crash state: CheckUnwind vp9loopfilterdealloc vp9decoderremove...

OSV-2022-531 Heap-buffer-overflow in perfetto::trace_processor::TrackEventParser::ParseTrackDescriptor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48684 Crash type: Heap-buffer-overflow WRITE 4 Crash state: perfetto::traceprocessor::TrackEventParser::ParseTrackDescriptor perfetto::traceprocessor::TrackEventModule::ParsePacket...

OSV-2022-525 Heap-buffer-overflow in spvtools::CFA<spvtools::val::BasicBlock>::CalculateDominators

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48553 Crash type: Heap-buffer-overflow READ 8 Crash state: spvtools::CFA::CalculateDominators spvtools::val::PerformCfgChecks spvtools::val::ValidateBinaryUsingContextAndValidationState...

OSV-2022-511 UNKNOWN READ in zfp_getcell

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48372 Crash type: UNKNOWN READ Crash state: zfpgetcell bloscd bloscgetitem...

OSV-2022-507 Heap-use-after-free in psi_device_ref_finalize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48305 Crash type: Heap-use-after-free READ 8 Crash state: psidevicereffinalize gsgcreclaim ireclaim...

OSV-2022-483 Heap-buffer-overflow in ndpi_search_dns

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48034 Crash type: Heap-buffer-overflow READ 4 Crash state: ndpisearchdns checkndpidetectionfunc ndpicheckflowfunc...

OSV-2022-476 Stack-buffer-overflow in simple_str_to_doublestr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47986 Crash type: Stack-buffer-overflow WRITE 1 Crash state: simplestrtodoublestr icalvaluenewfromstring icalparseraddline...

OSV-2022-457 Heap-buffer-overflow in CFF::Charset::collect_glyph_to_sid_map

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47790 Crash type: Heap-buffer-overflow READ 2 Crash state: CFF::Charset::collectglyphtosidmap cffsubsetplan::plansubsetcharset cffsubsetplan::create...