OSV-2022-1223 Heap-use-after-free in mbedtls_pkcs7_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53798 Crash type: Heap-use-after-free READ 8 Crash state: mbedtlspkcs7free mbedtlspkcs7parseder fuzzpkcs7.c...

OSV-2022-1212 Heap-buffer-overflow in OT::hb_ot_apply_context_t::skipping_iterator_t::next

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53722 Crash type: Heap-buffer-overflow READ 4 Crash state: OT::hbotapplycontextt::skippingiteratort::next bool OT::matchinput bool OT::contextapplylookup...

OSV-2022-1194 Heap-buffer-overflow in sputs

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53619 Crash type: Heap-buffer-overflow READ Crash state: sputs gxserializeIndexed pdfcolorspacenamed...

OSV-2022-1164 Heap-buffer-overflow in virtio_net_queue_enable

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53186 Crash type: Heap-buffer-overflow READ 8 Crash state: virtionetqueueenable virtioqueueenable virtiopcicommonwrite...

OSV-2022-1151 Heap-buffer-overflow in mg_mqtt_parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53038 Crash type: Heap-buffer-overflow READ 1 Crash state: mgmqttparse fuzz.c...

OSV-2022-1136 Heap-buffer-overflow in rx_ip

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53029 Crash type: Heap-buffer-overflow READ 2 Crash state: rxip miprx fuzz.c...

OSV-2022-1094 Security exception in com.google.common.hash.Hashing$ConcatenatedHashFunction.makeHash

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52693 Crash type: Security exception Crash state: com.google.common.hash.Hashing$ConcatenatedHashFunction.makeHash com.google.common.hash.AbstractCompositeHashFunction$1.hash HashingFuzzer.testHash...

OSV-2022-1093 Heap-buffer-overflow in LibRaw::kodak_rgb_load_raw

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52672 Crash type: Heap-buffer-overflow WRITE 2 Crash state: LibRaw::kodakrgbloadraw LibRaw::kodakthumbloader LibRaw::unpackthumb...

OSV-2022-1063 Heap-use-after-free in xps_image_enum_finalize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52492 Crash type: Heap-use-after-free READ 8 Crash state: xpsimageenumfinalize allocrestorestepin dorestore...

OSV-2022-1053 Heap-buffer-overflow in flb_parser_create

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52414 Crash type: Heap-buffer-overflow READ 1 Crash state: flbparsercreate flbparserconffile configrandomfuzzer.c...

OSV-2022-1052 UNKNOWN READ in loadSymbol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52410 Crash type: UNKNOWN READ Crash state: loadSymbol loadMapInternal msLoadMap...

OSV-2022-1032 Stack-buffer-overflow in check_content_type_and_change_protocol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52229 Crash type: Stack-buffer-overflow READ Crash state: checkcontenttypeandchangeprotocol checkcontenttypeandchangeprotocol ndpisearchhttptcp...

OSV-2022-1031 Memcpy-param-overlap in tsk_fs_load_file_action

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52212 Crash type: Memcpy-param-overlap Crash state: tskfsloadfileaction tskfsattrwalknonres tskfsattrwalk...

OSV-2022-1029 Heap-buffer-overflow in dprint

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52204 Crash type: Heap-buffer-overflow READ 13 Crash state: dprint gethdrfield parseheaders...

OSV-2022-952 UNKNOWN WRITE in regcomp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51778 Crash type: UNKNOWN WRITE Crash state: regcomp fileregcomp load1...

OSV-2022-923 Heap-buffer-overflow in file_magwarn

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51603 Crash type: Heap-buffer-overflow READ Crash state: filemagwarn parsestrength load1...

OSV-2022-899 Heap-buffer-overflow in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51390 Crash type: Heap-buffer-overflow READ 7 Crash state: std::1::basicstring, std::1::allocatorch PfxEntry::add AffixMgr::expandrootword...

OSV-2022-868 Heap-buffer-overflow in AffixMgr::redundant_condition

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51124 Crash type: Heap-buffer-overflow READ 1 Crash state: AffixMgr::redundantcondition AffixMgr::parseaffix AffixMgr::parsefile...

OSV-2022-828 UNKNOWN READ in stream_finalize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50898 Crash type: UNKNOWN READ Crash state: streamfinalize ifreeobject coswritestreamalloc...

OSV-2022-797 Heap-buffer-overflow in Ins_NPUSHB

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50656 Crash type: Heap-buffer-overflow READ 1 Crash state: InsNPUSHB RunIns InstanceReset...

OSV-2022-786 Heap-double-free in read_config

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50645 Crash type: Heap-double-free Crash state: readconfig readglob readconfig...

OSV-2022-780 Index-out-of-bounds in is_same_net6

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50599 Crash type: Index-out-of-bounds Crash state: issamenet6 dhcp6mayberelay dhcp6mayberelay...

OSV-2022-672 Heap-buffer-overflow in udiv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49763 Crash type: Heap-buffer-overflow WRITE 4 Crash state: udiv mpzmdiv mrbbintdiv...

OSV-2022-618 Heap-buffer-overflow in Type_MLU_Write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49433 Crash type: Heap-buffer-overflow READ 4 Crash state: TypeMLUWrite SaveTags cmsSaveProfileToIOhandler...

OSV-2022-616 Timeout in JsonFuzzer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49401 Crash type: Timeout Crash state: JsonFuzzer...

OSV-2022-613 UNKNOWN READ in OT::avar::map_coords

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49407 Crash type: UNKNOWN READ Crash state: OT::avar::mapcoords hbotvarnormalizevariations test-ot-face.c...

OSV-2022-607 Heap-buffer-overflow in ucl_object_dtor_unref_single

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49289 Crash type: Heap-buffer-overflow READ 8 Crash state: uclobjectdtorunrefsingle uclobjectdtorunref uclhashdestroy...

OSV-2022-594 Container-overflow in STOFFStarMathToMMLConverterInternal::Parser::convert

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49164 Crash type: Container-overflow READ 1 Crash state: STOFFStarMathToMMLConverterInternal::Parser::convert STOFFStarMathToMMLConverterInternal::Parser::parse STOFFStarMathToMMLConverter::convertStarMath...

OSV-2022-543 Index-out-of-bounds in decode_coefs

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48816 Crash type: Index-out-of-bounds Crash state: decodecoefs vp9decodeblocktokens decodeblock...

OSV-2022-489 Heap-buffer-overflow in fr_size_from_str

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48069 Crash type: Heap-buffer-overflow READ 1 Crash state: frsizefromstr frvalueboxfromsubstr frvalueboxfromstr...

OSV-2022-481 UNKNOWN READ in ndpi_strdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48020 Crash type: UNKNOWN READ Crash state: ndpistrdup processndpicollectedinfo ndpiworkflowprocesspacket...

OSV-2022-475 Heap-double-free in nft_set_context_free_many

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47973 Crash type: Heap-double-free Crash state: nftsetcontextfreemany networkunref networkloadone...

OSV-2022-473 Stack-buffer-overflow in input_osc_52

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47964 Crash type: Stack-buffer-overflow READ 9 Crash state: inputosc52 inputexitosc inputparse...

OSV-2022-452 Stack-buffer-overflow in parse_regex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47780 Crash type: Stack-buffer-overflow READ 1 Crash state: parseregex cliregex2suffix regexlistaddpattern...

OSV-2022-427 Stack-use-after-scope in RefCopyBytes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47560 Crash type: Stack-use-after-scope READ Crash state: RefCopyBytes DoCopyBytes dngstream::Put...

OSV-2022-389 Global-buffer-overflow in _dwarf_pathjoinl

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47150 Crash type: Global-buffer-overflow READ 1 Crash state: dwarfpathjoinl dwarfconstructlinkedtopath dwarfgnudebuglink...

OSV-2022-346 Heap-buffer-overflow in cli_sigopts_handler

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46680 Crash type: Heap-buffer-overflow READ 1 Crash state: clisigoptshandler readdbparseldbsubsignature loadoneldb...

OSV-2022-344 Heap-use-after-free in init_tdb

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46685 Crash type: Heap-use-after-free READ 4 Crash state: inittdb loadoneldb cliloadldb...

OSV-2022-340 Heap-buffer-overflow in cli_ac_addsig

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46646 Crash type: Heap-buffer-overflow READ 2 Crash state: cliacaddsig cliaddcontentmatchpattern readdbparseldbsubsignature...

OSV-2022-305 Heap-buffer-overflow in jxl::N_AVX2::BlendingStage::ProcessPaddingRow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46304 Crash type: Heap-buffer-overflow READ Crash state: jxl::NAVX2::BlendingStage::ProcessPaddingRow jxl::LowMemoryRenderPipeline::RenderPadding jxl::LowMemoryRenderPipeline::ProcessBuffers...

OSV-2022-299 Heap-use-after-free in read_data_compressed

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46279 Crash type: Heap-use-after-free READ 4 Crash state: readdatacompressed archivereadformatrarreaddata archivereaddatablock...

OSV-2022-226 Heap-buffer-overflow in vips_rect_intersectrect

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45353 Crash type: Heap-buffer-overflow READ 4 Crash state: vipsrectintersectrect vipsforeignloadpdfgenerate vipsregionpreparetogenerate...

OSV-2022-202 Heap-buffer-overflow in ndpi_workflow_process_packet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45036 Crash type: Heap-buffer-overflow READ 4 Crash state: ndpiworkflowprocesspacket fuzzndpireader.c...

OSV-2022-179 Heap-buffer-overflow in row_mt_worker_hook

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44856 Crash type: Heap-buffer-overflow WRITE 4 Crash state: rowmtworkerhook execute av1decodetgtilesandwrapup...

OSV-2022-169 Heap-buffer-overflow in ucasemap_internalUTF8ToTitle_70

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44779 Crash type: Heap-buffer-overflow READ 1 Crash state: ucasemapinternalUTF8ToTitle70 ucasemapmapUTF8 ucasemaputf8ToTitle70...

OSV-2022-151 Heap-buffer-overflow in extensionObjectOrder

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44623 Crash type: Heap-buffer-overflow READ 4 Crash state: extensionObjectOrder extensionObjectOrder extensionObjectOrder...

OSV-2022-146 Stack-use-after-scope in tag_cfa_pattern::Put

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44590 Crash type: Stack-use-after-scope READ 1 Crash state: tagcfapattern::Put dngtiffdirectory::Put dngimagewriter::WriteTIFFWithProfile...

OSV-2021-1706 Segv on unknown address in gx_adjust_color_Pattern

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42453 Crash type: Segv on unknown address Crash state: gxadjustcolorPattern gssetcolor pdfisetfillcolor...

OSV-2021-1585 Heap-buffer-overflow in _parse_to

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41073 Crash type: Heap-buffer-overflow READ 1 Crash state: parseto parseto gethdrfield...

OSV-2021-1546 Heap-buffer-overflow in pn_buffer_append

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40748 Crash type: Heap-buffer-overflow READ Crash state: pnbufferappend pnidatainternnode pnidecoderdecodevalue...