OSV-2022-1022 Stack-buffer-overflow in check_content_type_and_change_protocol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52160 Crash type: Stack-buffer-overflow READ Crash state: checkcontenttypeandchangeprotocol ndpisearchhttptcp checkndpidetectionfunc...

OSV-2022-1021 Stack-buffer-underflow in gs_type2_interpret

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52145 Crash type: Stack-buffer-underflow READ 4 Crash state: gstype2interpret gstype1glyphinfo pdficffglyphinfo...

OSV-2022-1018 Index-out-of-bounds in LibRaw::kodak_radc_load_raw

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52139 Crash type: Index-out-of-bounds Crash state: LibRaw::kodakradcloadraw LibRaw::unpack LoadRAW...

OSV-2022-1017 Null-dereference READ in AlertJson

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52128 Crash type: Null-dereference READ Crash state: AlertJson JsonAlertLogger OutputPacketLog...

OSV-2022-1015 Heap-use-after-free in msFreeMap

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52102 Crash type: Heap-use-after-free READ 8 Crash state: msFreeMap msLoadMap mapfuzzer.c...

OSV-2022-1013 Heap-buffer-overflow in msyylex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52066 Crash type: Heap-buffer-overflow WRITE 1 Crash state: msyylex loadMapInternal msLoadMap...

OSV-2022-1011 Heap-buffer-overflow in Exiv2::MemIo::read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52053 Crash type: Heap-buffer-overflow WRITE Crash state: Exiv2::MemIo::read Exiv2::BasicIo::readOrThrow Exiv2::QuickTimeVideo::userDataDecoder...

OSV-2022-1009 Heap-buffer-overflow in parse_line

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52049 Crash type: Heap-buffer-overflow READ 1 Crash state: parseline readcfgfile fuzzcfgparser.c...

OSV-2022-1008 Heap-buffer-overflow in cli_js_parse_done

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52038 Crash type: Heap-buffer-overflow READ 4 Crash state: clijsparsedone clihtmlnormalise htmlnormalisemap...

OSV-2022-1004 Heap-buffer-overflow in AffixMgr::cpdcase_check

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51988 Crash type: Heap-buffer-overflow READ 1 Crash state: AffixMgr::cpdcasecheck AffixMgr::compoundcheck HunspellImpl::checkword...

OSV-2022-1003 Index-out-of-bounds in LibRaw::ahd_interpolate_r_and_b_in_rgb_and_convert_to_cielab

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51965 Crash type: Index-out-of-bounds Crash state: LibRaw::ahdinterpolaterandbinrgbandconverttocielab LibRaw::ahdinterpolate LibRaw::dcrawprocess...

OSV-2022-1002 Segv on unknown address in upb_MiniTable_SetSubEnum

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51950 Crash type: Segv on unknown address Crash state: upbMiniTableSetSubEnum upbMessageDefLinkMiniTable upbFileDefCreate...

OSV-2022-1001 Heap-buffer-overflow in SkRect::setBoundsCheck

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51933 Crash type: Heap-buffer-overflow READ 8 Crash state: SkRect::setBoundsCheck SkEdgeClipper::clipCubic SkEdgeClipper::ClipPath...

OSV-2022-999 Heap-buffer-overflow in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51972 Crash type: Heap-buffer-overflow READ Crash state: std::1::basicstring, std::1::allocatorch Exiv2::QuickTimeVideo::userDataDecoder Exiv2::QuickTimeVideo::tagDecoder...

OSV-2022-996 Use-of-uninitialized-value in GrTriangulator::sanitizeContours

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51921 Crash type: Use-of-uninitialized-value Crash state: GrTriangulator::sanitizeContours GrTriangulator::contoursToPolys GrTriangulator::pathToPolys...

OSV-2022-994 Heap-buffer-overflow in onig_node_str_cat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51920 Crash type: Heap-buffer-overflow READ 4 Crash state: onignodestrcat parseexp parsebranch...

OSV-2022-993 Stack-use-after-return in check_buffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51910 Crash type: Stack-use-after-return READ 1 Crash state: checkbuffer rbingetbinpluginbybuffer rbinfilenewfrombuffer...

OSV-2022-989 Use-of-uninitialized-value in SkPathStroker::CheckCubicLinear

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51942 Crash type: Use-of-uninitialized-value Crash state: SkPathStroker::CheckCubicLinear SkPathStroker::cubicTo SkStroke::strokePath...

OSV-2022-988 Heap-buffer-overflow in onig_vsnprintf_with_pattern

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51934 Crash type: Heap-buffer-overflow READ 1 Crash state: onigvsnprintfwithpattern onigsyntaxwarn fetchtoken...

OSV-2022-987 Security exception in com.code_intelligence.jazzer.sanitizers.RegexInjection.hookInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51941 Crash type: Security exception Crash state: com.codeintelligence.jazzer.sanitizers.RegexInjection.hookInternal com.codeintelligence.jazzer.sanitizers.RegexInjection.stringHook...

OSV-2022-986 Heap-buffer-overflow in SkEdgeClipper::ClipPath

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51917 Crash type: Heap-buffer-overflow READ 8 Crash state: SkEdgeClipper::ClipPath SkPathPriv::PerspectiveClip SkPath::transform...

OSV-2022-983 Heap-buffer-overflow in SkPathPriv::IsRectContour

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51909 Crash type: Heap-buffer-overflow READ 4 Crash state: SkPathPriv::IsRectContour SkPath::isRect SkCanvas::clipPath...

OSV-2022-981 Heap-buffer-overflow in SkPath::Iter::next

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51915 Crash type: Heap-buffer-overflow READ 8 Crash state: SkPath::Iter::next SkStroke::strokePath SkStrokeRec::applyToPath...

OSV-2022-978 Heap-buffer-overflow in SkPath::Iter::next

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51926 Crash type: Heap-buffer-overflow READ 8 Crash state: SkPath::Iter::next SkPath1DPathEffectImpl::next Sk1DPathEffect::onFilterPath...

OSV-2022-976 Heap-buffer-overflow in SkPath::Iter::next

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51925 Crash type: Heap-buffer-overflow READ 8 Crash state: SkPath::Iter::next SkParsePath::ToSVGString SkSVGDevice::drawPath...

OSV-2022-972 Use-of-uninitialized-value in SkFindQuadMaxCurvature

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51876 Crash type: Use-of-uninitialized-value Crash state: SkFindQuadMaxCurvature AAHairlineOp::onPrepareDraws GrMeshDrawOp::onPrepare...

OSV-2022-970 Heap-buffer-overflow in SkPath::reverseAddPath

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51868 Crash type: Heap-buffer-overflow READ 4 Crash state: SkPath::reverseAddPath FuzzNicePath FuzzRegionSetPath...

OSV-2022-969 Heap-buffer-overflow in SkPath::Iter::next

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51875 Crash type: Heap-buffer-overflow READ 8 Crash state: SkPath::Iter::next SkRegion::setPath SkRasterClip::SkRasterClip...

OSV-2022-968 Heap-buffer-overflow in SkMatrix::Persp_pts

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51873 Crash type: Heap-buffer-overflow READ 4 Crash state: SkMatrix::Persppts SkPath::addPath FuzzNicePath...

OSV-2022-964 Use-of-uninitialized-value in cmsMLUgetASCII

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51841 Crash type: Use-of-uninitialized-value Crash state: cmsMLUgetASCII TypeTextDescriptionWrite SaveTags...

OSV-2022-963 Security exception in org.codehaus.janino.Parser.parseConditionalExpression

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51821 Crash type: Security exception Crash state: org.codehaus.janino.Parser.parseConditionalExpression java.base/sun.nio.cs.CESU8$Encoder.encodeLoop java.base/java.nio.charset.CharsetEncoder.encode...

OSV-2022-962 Security exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51840 Crash type: Security exception Crash state: com.ctc.wstx.dtd.FullDTDReader.readContentSpec java.base/sun.nio.cs.CESU8.updatePositions java.base/sun.nio.cs.CESU8$Encoder.encodeArrayLoop...

OSV-2022-961 Heap-double-free in sc_pkcs15_encode_df

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51837 Crash type: Heap-double-free Crash state: scpkcs15encodedf scpkcs15initupdateanydf scpkcs15initaddobject...

OSV-2022-955 Use-of-uninitialized-value in FileWrite

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51808 Crash type: Use-of-uninitialized-value Crash state: FileWrite cmsWriteUInt16Number TypeMLUWrite...

OSV-2022-953 Dynamic-stack-buffer-overflow in rx_icmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51757 Crash type: Dynamic-stack-buffer-overflow WRITE Crash state: rxicmp rxip miprx...

OSV-2022-952 UNKNOWN WRITE in regcomp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51778 Crash type: UNKNOWN WRITE Crash state: regcomp fileregcomp load1...

OSV-2022-949 Heap-use-after-free in s_file_write_flush

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51745 Crash type: Heap-use-after-free READ 8 Crash state: sfilewriteflush sclose streamfinalize...

OSV-2022-945 Heap-buffer-overflow in Exiv2::MemIo::read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51707 Crash type: Heap-buffer-overflow WRITE Crash state: Exiv2::MemIo::read Exiv2::BasicIo::readOrThrow Exiv2::QuickTimeVideo::userDataDecoder...

OSV-2022-944 Stack-use-after-scope in RefCopyBytes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51689 Crash type: Stack-use-after-scope READ Crash state: RefCopyBytes dngstream::Put tagdataptr::Put...

OSV-2022-943 UNKNOWN WRITE in perfetto::trace_processor::TrackEventParser::ParseTrackDescriptor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51695 Crash type: UNKNOWN WRITE Crash state: perfetto::traceprocessor::TrackEventParser::ParseTrackDescriptor perfetto::traceprocessor::TrackEventModule::ParsePacket...

OSV-2022-942 Security exception in com.github.javaparser.ast.expr.FieldAccessExpr.accept

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51694 Crash type: Security exception Crash state: com.github.javaparser.ast.expr.FieldAccessExpr.accept com.github.javaparser.ast.visitor.VoidVisitorAdapter.visit java.base/java.lang.StringCoding.encode...

OSV-2022-937 Use-after-poison in rx_ip

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51687 Crash type: Use-after-poison READ 1 Crash state: rxip miprx fuzz.c...

OSV-2022-934 Index-out-of-bounds in LibRaw::parse_tiff_ifd

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51657 Crash type: Index-out-of-bounds Crash state: LibRaw::parsetiffifd LibRaw::parsetiff LibRaw::identify...

OSV-2022-932 Stack-buffer-overflow in ntlm_phase_3

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51653 Crash type: Stack-buffer-overflow WRITE 1 Crash state: ntlmphase3 establishhttpproxypassthru fuzzproxy.c...

OSV-2022-931 Heap-buffer-overflow in file_magwarn

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51674 Crash type: Heap-buffer-overflow READ Crash state: filemagwarn load1 apprenticeload...

OSV-2022-926 Heap-buffer-overflow in Ins_PUSHW

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51618 Crash type: Heap-buffer-overflow READ 1 Crash state: InsPUSHW RunIns InstanceReset...

OSV-2022-924 Heap-buffer-overflow in file_zmagic

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51608 Crash type: Heap-buffer-overflow READ 1 Crash state: filezmagic filebuffer magicbuffer...

OSV-2022-923 Heap-buffer-overflow in file_magwarn

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51603 Crash type: Heap-buffer-overflow READ Crash state: filemagwarn parsestrength load1...

OSV-2022-916 Container-overflow in wabt::interp::BinaryReaderInterp::BeginFunctionBody

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51565 Crash type: Container-overflow WRITE 4 Crash state: wabt::interp::BinaryReaderInterp::BeginFunctionBody wabt::ReadBinary wabt::interp::ReadBinaryInterp...

OSV-2022-915 Security exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51552 Crash type: Security exception Crash state: com.ctc.wstx.dtd.FullDTDReader.readContentSpec java.base/java.io.StringReader.read com.ctc.wstx.io.MergedReader.read...