OSV-2023-508 Heap-buffer-overflow in AffixMgr::compound_check

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60034 Crash type: Heap-buffer-overflow READ 1 Crash state: AffixMgr::compoundcheck AffixMgr::compoundcheck AffixMgr::compoundcheck...

OSV-2023-504 Heap-buffer-overflow in ndpi_search_line

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60003 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpisearchline checkndpidetectionfunc ndpicheckflowfunc...

OSV-2023-436 Heap-buffer-overflow in ndpi_check_punycode_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59393 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpicheckpunycodestring ndpimatchhostsubprotocol checkcontenttypeandchangeprotocol...

OSV-2023-409 Heap-use-after-free in zval_call_destructor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=59072 Crash type: Heap-use-after-free READ 4 Crash state: zvalcalldestructor zendhashreverseapply shutdowndestructors...

OSV-2023-356 Heap-buffer-overflow in pdf_nextobject

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58475 Crash type: Heap-buffer-overflow READ 1 Crash state: pdfnextobject findlength pdfextractobj...

OSV-2023-243 UNKNOWN WRITE in processCertificateElements

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57448 Crash type: UNKNOWN WRITE Crash state: processCertificateElements fuzztlscertificate.c...

OSV-2023-225 Heap-buffer-overflow in std::__1::enable_if<true, void>::type APFSBtreeNodeIterator<APFSBtreeNode<apfs_o

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57364 Crash type: Heap-buffer-overflow READ 2 Crash state: std::1::enableif::type APFSBtreeNodeIterator ::APFSBtree APFSBtreeNodeIterator APFSBtreeN...

OSV-2023-174 Global-buffer-overflow in htmlCurrentChar

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56964 Crash type: Global-buffer-overflow READ 1 Crash state: htmlCurrentChar htmlParseNameComplex htmlParseName...

OSV-2023-79 Heap-buffer-overflow in H5O__fsinfo_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56076 Crash type: Heap-buffer-overflow READ 1 Crash state: H5Ofsinfodecode H5Omsgiteratereal H5Omsgremovereal...

OSV-2023-76 Heap-buffer-overflow in H5SM_delete

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56033 Crash type: Heap-buffer-overflow READ 4 Crash state: H5SMdelete H5Omsgwritereal H5Omsgwrite...

OSV-2023-69 Heap-use-after-free in zend_ast_evaluate_inner

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56021 Crash type: Heap-use-after-free READ 4 Crash state: zendastevaluateinner zendastevaluateex zvalupdateconstantwithctx...

OSV-2023-61 Heap-buffer-overflow in xmlParseTryOrFinish

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=55980 Crash type: Heap-buffer-overflow READ 1 Crash state: xmlParseTryOrFinish xmlParseChunk xml.c...

OSV-2022-1248 Object-size in wabt::BinaryReaderIR::OnCodeMetadataCount

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54092 Crash type: Object-size Crash state: wabt::BinaryReaderIR::OnCodeMetadataCount wabt::BinaryReader::ReadCodeMetadataSection wabt::BinaryReader::ReadCustomSection...

OSV-2022-1188 Stack-buffer-overflow in authentic_get_tagged_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53536 Crash type: Stack-buffer-overflow READ 1 Crash state: authenticgettaggeddata authenticparsecredentialdata authenticpingetpolicy...

OSV-2022-1180 Heap-buffer-overflow in json_common_entity_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53468 Crash type: Heap-buffer-overflow READ 8 Crash state: jsoncommonentitydata jsonobjectswrite dwgwritejson...

OSV-2022-1159 Heap-buffer-overflow in LibRaw_buffer_datastream::read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53158 Crash type: Heap-buffer-overflow WRITE Crash state: LibRawbufferdatastream::read LibRaw::uncompressedfpdngloadraw LibRaw::unpack...

OSV-2022-1133 Security exception in org.codehaus.janino.Parser.parseAssignmentExpression

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52971 Crash type: Security exception Crash state: org.codehaus.janino.Parser.parseAssignmentExpression java.base/sun.nio.cs.CESU8$Encoder.encodeLoop java.base/java.nio.charset.CharsetEncoder.encode...

OSV-2022-1131 Heap-use-after-free in gs_font_finalize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52986 Crash type: Heap-use-after-free READ 8 Crash state: gsfontfinalize gsgcreclaim ireclaim...

OSV-2022-1061 Heap-buffer-overflow in AffixMgr::compound_check

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52486 Crash type: Heap-buffer-overflow READ 1 Crash state: AffixMgr::compoundcheck HunspellImpl::checkword HunspellImpl::spellinternal...

OSV-2022-996 Use-of-uninitialized-value in GrTriangulator::sanitizeContours

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51921 Crash type: Use-of-uninitialized-value Crash state: GrTriangulator::sanitizeContours GrTriangulator::contoursToPolys GrTriangulator::pathToPolys...

OSV-2022-994 Heap-buffer-overflow in onig_node_str_cat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51920 Crash type: Heap-buffer-overflow READ 4 Crash state: onignodestrcat parseexp parsebranch...

OSV-2022-962 Security exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51840 Crash type: Security exception Crash state: com.ctc.wstx.dtd.FullDTDReader.readContentSpec java.base/sun.nio.cs.CESU8.updatePositions java.base/sun.nio.cs.CESU8$Encoder.encodeArrayLoop...

OSV-2022-949 Heap-use-after-free in s_file_write_flush

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51745 Crash type: Heap-use-after-free READ 8 Crash state: sfilewriteflush sclose streamfinalize...

OSV-2022-902 Invalid-free in function signature specialization <Arg

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51434 Crash type: Invalid-free Crash state: function signature specialization Arg NIOHTTP1.HTTPDecoder.didFinishHead protocol witness for NIOHTTP1...

OSV-2022-886 Heap-buffer-overflow in SfxEntry::add

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51242 Crash type: Heap-buffer-overflow READ 1 Crash state: SfxEntry::add AffixMgr::expandrootword SuggestMgr::ngsuggest...

OSV-2022-872 Stack-buffer-overflow in PfxEntry::test_condition

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51134 Crash type: Stack-buffer-overflow READ 1 Crash state: PfxEntry::testcondition PfxEntry::checkword AffixMgr::prefixcheck...

OSV-2022-847 Heap-use-after-free in ndlz4_decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50991 Crash type: Heap-use-after-free READ 4 Crash state: ndlz4decompress bloscd dojob...

OSV-2022-842 Stack-buffer-overflow in wc_Shake256_Final

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50946 Crash type: Stack-buffer-overflow WRITE Crash state: wcShake256Final wced448signmsgex wced448signmsg...

OSV-2022-797 Heap-buffer-overflow in Ins_NPUSHB

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50656 Crash type: Heap-buffer-overflow READ 1 Crash state: InsNPUSHB RunIns InstanceReset...

OSV-2022-724 Stack-buffer-underflow in gs_type2_interpret

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50306 Crash type: Stack-buffer-underflow READ 4 Crash state: gstype2interpret copiedtype1glyphoutline gsdefaultglyphinfo...

OSV-2022-648 Use-of-uninitialized-value in _LUTeval16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49549 Crash type: Use-of-uninitialized-value Crash state: LUTeval16 cmsCreateExtendedTransform cmsCreateTransform...

OSV-2022-635 UNKNOWN READ in EvalSegmentedFn

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49490 Crash type: UNKNOWN READ Crash state: EvalSegmentedFn cmsEvalToneCurveFloat TypevcgtWrite...

OSV-2022-628 Segv on unknown address in mpz_add

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49453 Crash type: Segv on unknown address Crash state: mpzadd mpzsub mrbbintsub...

OSV-2022-562 UNKNOWN WRITE in udiv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48904 Crash type: UNKNOWN WRITE Crash state: udiv mrbbintmod intmod...

OSV-2022-533 Check failed in CheckUnwind

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48629 Crash type: Check failed Crash state: CheckUnwind vp9loopfilterdealloc vp9decoderremove...

OSV-2022-531 Heap-buffer-overflow in perfetto::trace_processor::TrackEventParser::ParseTrackDescriptor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48684 Crash type: Heap-buffer-overflow WRITE 4 Crash state: perfetto::traceprocessor::TrackEventParser::ParseTrackDescriptor perfetto::traceprocessor::TrackEventModule::ParsePacket...

OSV-2022-511 UNKNOWN READ in zfp_getcell

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48372 Crash type: UNKNOWN READ Crash state: zfpgetcell bloscd bloscgetitem...

OSV-2022-507 Heap-use-after-free in psi_device_ref_finalize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48305 Crash type: Heap-use-after-free READ 8 Crash state: psidevicereffinalize gsgcreclaim ireclaim...

OSV-2022-476 Stack-buffer-overflow in simple_str_to_doublestr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47986 Crash type: Stack-buffer-overflow WRITE 1 Crash state: simplestrtodoublestr icalvaluenewfromstring icalparseraddline...

OSV-2022-457 Heap-buffer-overflow in CFF::Charset::collect_glyph_to_sid_map

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47790 Crash type: Heap-buffer-overflow READ 2 Crash state: CFF::Charset::collectglyphtosidmap cffsubsetplan::plansubsetcharset cffsubsetplan::create...

OSV-2022-422 UNKNOWN WRITE in alloc_restore_step_in

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47513 Crash type: UNKNOWN WRITE Crash state: allocrestorestepin allocrestoreall gsmainfinit...

OSV-2022-419 Heap-buffer-overflow in uncompress_b44_impl

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47503 Crash type: Heap-buffer-overflow READ 2 Crash state: uncompressb44impl defaultdecompresschunk exrdecodingrun...

OSV-2022-409 Heap-buffer-overflow in std::__1::__tree_node_base<void*>*& std::__1::__tree<std::__1::__value_type<std:

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47391 Crash type: Heap-buffer-overflow READ 1 Crash state: std::1::treenodebase& std::1::treestd::1::valuetypestd: std::1::pairstd::1::treeiteratorstd::1::valuetypestd::1::basic...

OSV-2022-339 Heap-use-after-free in gc_trace

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46672 Crash type: Heap-use-after-free READ 2 Crash state: gctrace gsgcreclaim ireclaim...

OSV-2022-268 Stack-use-after-return in template_sanity_check

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45880 Crash type: Stack-use-after-return READ 1 Crash state: templatesanitycheck processtmpl processblock...

OSV-2022-262 Heap-double-free in flb_pack_state_reset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45810 Crash type: Heap-double-free Crash state: flbpackstatereset inlibcollect flbinputcollectorfd...

OSV-2022-229 UNKNOWN READ in spgetcc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45347 Crash type: UNKNOWN READ Crash state: spgetcc pdfireadbyte pdfireadtoken...

OSV-2022-158 Heap-buffer-overflow in parse_primitive

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44695 Crash type: Heap-buffer-overflow READ 1 Crash state: parseprimitive plistfromjson jplistfuzzer.cc...

OSV-2022-73 Heap-use-after-free in pdfi_cspace_free_callback

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43904 Crash type: Heap-use-after-free READ 8 Crash state: pdficspacefreecallback gscspacefinal allocrestorestepin...

OSV-2022-32 Heap-buffer-overflow in _estrdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43484 Crash type: Heap-buffer-overflow READ 11 Crash state: estrdup exifprocessusercomment exifprocessIFDTAGimpl...