OSV-2022-914 Security exception in com.github.javaparser.ast.validator.TreeVisitorValidator.accept

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51492 Crash type: Security exception Crash state: com.github.javaparser.ast.validator.TreeVisitorValidator.accept com.github.javaparser.metamodel.BaseNodeMetaModel.getDeclaredPropertyMetaModels...

OSV-2022-908 Heap-buffer-overflow in element_end

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51480 Crash type: Heap-buffer-overflow READ 4 Crash state: elementend emitendelement gmarkupparsecontextparse...

OSV-2022-904 Heap-use-after-free in std::__1::pair<std::__1::__tree_iterator<std::__1::__value_type<geos::geom::Coor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51406 Crash type: Heap-use-after-free READ 8 Crash state: std::1::pairstd::1::treeiteratorstd::1::valuetypegeos::geom::Coor geos::geomgraph::NodeMap::addNode geos::geomgraph::GeometryGraph::addSelfIntersectionNode...

OSV-2022-903 Heap-buffer-overflow in AffixMgr::compound_check

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51437 Crash type: Heap-buffer-overflow READ 1 Crash state: AffixMgr::compoundcheck SuggestMgr::checkword SuggestMgr::testsug...

OSV-2022-902 Invalid-free in function signature specialization <Arg

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51434 Crash type: Invalid-free Crash state: function signature specialization Arg NIOHTTP1.HTTPDecoder.didFinishHead protocol witness for NIOHTTP1...

OSV-2022-901 Heap-double-free in HashMgr::~HashMgr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51432 Crash type: Heap-double-free Crash state: HashMgr::HashMgr HunspellImpl::HunspellImpl Hunspell::Hunspell...

OSV-2022-899 Heap-buffer-overflow in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51390 Crash type: Heap-buffer-overflow READ 7 Crash state: std::1::basicstring, std::1::allocatorch PfxEntry::add AffixMgr::expandrootword...

OSV-2022-896 Segv on unknown address in Sass::unifyComplex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51316 Crash type: Segv on unknown address Crash state: Sass::unifyComplex Sass::Extender::extendCompound Sass::Extender::extendComplex...

OSV-2022-893 UNKNOWN READ in AffixMgr::suffix_check

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51294 Crash type: UNKNOWN READ Crash state: AffixMgr::suffixcheck PfxEntry::checkword AffixMgr::prefixcheck...

OSV-2022-892 Segv on unknown address in ddsi_config_init

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51292 Crash type: Segv on unknown address Crash state: ddsiconfiginit fuzzconfiginit.c...

OSV-2022-891 Stack-buffer-overflow in flb_env_var_translate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51278 Crash type: Stack-buffer-overflow WRITE Crash state: flbenvvartranslate flbparserconffile configrandomfuzzer.c...

OSV-2022-889 Heap-use-after-free in AffixMgr::prefix_check

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51277 Crash type: Heap-use-after-free READ 2 Crash state: AffixMgr::prefixcheck AffixMgr::affixcheck HunspellImpl::checkword...

OSV-2022-888 Stack-buffer-overflow in gs_type2_interpret

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51275 Crash type: Stack-buffer-overflow READ 4 Crash state: gstype2interpret copiedtype1glyphoutline gsdefaultglyphinfo...

OSV-2022-886 Heap-buffer-overflow in SfxEntry::add

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51242 Crash type: Heap-buffer-overflow READ 1 Crash state: SfxEntry::add AffixMgr::expandrootword SuggestMgr::ngsuggest...

OSV-2022-883 Segv on unknown address in HashMgr::add_word

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51187 Crash type: Segv on unknown address Crash state: HashMgr::addword HashMgr::loadtables HashMgr::HashMgr...

OSV-2022-882 Use-of-uninitialized-value in SfxEntry::test_condition

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51218 Crash type: Use-of-uninitialized-value Crash state: SfxEntry::testcondition SfxEntry::add AffixMgr::expandrootword...

OSV-2022-881 Heap-use-after-free in AcquireCodePageWithCapacity

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51182 Crash type: Heap-use-after-free READ 8 Crash state: AcquireCodePageWithCapacity CompileElseBlock CompileIf...

OSV-2022-880 Global-buffer-overflow in _getBaseCellNeighbor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51208 Crash type: Global-buffer-overflow READ 4 Crash state: getBaseCellNeighbor localIjkToCell localIjToCell...

OSV-2022-878 Heap-double-free in flb_sds_destroy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51132 Crash type: Heap-double-free Crash state: flbsdsdestroy flbparserconffile configrandomfuzzer.c...

OSV-2022-874 UNKNOWN WRITE in from8to16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51128 Crash type: UNKNOWN WRITE Crash state: from8to16 cmsHandleExtraChannels CachedXFORM...

OSV-2022-872 Stack-buffer-overflow in PfxEntry::test_condition

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51134 Crash type: Stack-buffer-overflow READ 1 Crash state: PfxEntry::testcondition PfxEntry::checkword AffixMgr::prefixcheck...

OSV-2022-871 Security exception in java.base/java.util.Collections$UnmodifiableCollection.forEach

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51154 Crash type: Security exception Crash state: java.base/java.util.Collections$UnmodifiableCollection.forEach org.apache.commons.configuration2.tree.NodeTreeWalker.dfs...

OSV-2022-868 Heap-buffer-overflow in AffixMgr::redundant_condition

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51124 Crash type: Heap-buffer-overflow READ 1 Crash state: AffixMgr::redundantcondition AffixMgr::parseaffix AffixMgr::parsefile...

OSV-2022-867 Heap-buffer-overflow in get_utf_8_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51090 Crash type: Heap-buffer-overflow READ 1 Crash state: getutf8string dissectformurlencoded calldissectorwork...

OSV-2022-865 Security exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51101 Crash type: Security exception Crash state: com.ctc.wstx.dtd.FullDTDReader.readContentSpec java.base/java.lang.StringUTF16.newString java.base/java.lang.String.substring...

OSV-2022-866 Stack-buffer-underflow in gs_type2_interpret

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51089 Crash type: Stack-buffer-underflow READ 4 Crash state: gstype2interpret copiedtype1glyphoutline gsdefaultglyphinfo...

OSV-2022-864 Heap-buffer-overflow in SuggestMgr::badcharkey_utf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51102 Crash type: Heap-buffer-overflow READ 2 Crash state: SuggestMgr::badcharkeyutf SuggestMgr::suggest HunspellImpl::suggestinternal...

OSV-2022-863 Heap-use-after-free in user_wrapper_opendir

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51047 Crash type: Heap-use-after-free READ 10 Crash state: userwrapperopendir phpstreamopendir phpdoopendir...

OSV-2022-861 Heap-use-after-free in std::__1::pair<std::__1::__tree_iterator<std::__1::__value_type<geos::geom::Coor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51083 Crash type: Heap-use-after-free READ 8 Crash state: std::1::pairstd::1::treeiteratorstd::1::valuetypegeos::geom::Coor geos::geomgraph::NodeMap::addNode geos::operation::overlay::OverlayOp::copyPoints...

OSV-2022-859 UNKNOWN READ in write_key

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51081 Crash type: UNKNOWN READ Crash state: writekey textfileput fuzztextfile.c...

OSV-2022-857 Heap-double-free in fuzz_textfile.c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51072 Crash type: Heap-double-free Crash state: fuzztextfile.c fuzztextfile.c...

OSV-2022-855 UNKNOWN WRITE in Ins_ISECT

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51045 Crash type: UNKNOWN WRITE Crash state: InsISECT RunIns InstanceReset...

OSV-2022-854 Heap-buffer-overflow in perfetto::trace_processor::TrackEventParser::ParseTrackDescriptor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51022 Crash type: Heap-buffer-overflow WRITE 4 Crash state: perfetto::traceprocessor::TrackEventParser::ParseTrackDescriptor perfetto::traceprocessor::TrackEventModule::ParsePacket...

OSV-2022-852 Security exception in java.base/java.nio.Bits.reserveMemory

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51044 Crash type: Security exception Crash state: java.base/java.nio.Bits.reserveMemory java.base/java.nio.DirectByteBuffer. java.base/java.nio.ByteBuffer.allocateDirect...

OSV-2022-848 Heap-buffer-overflow in pcpp::HttpRequestFirstLine::parseVersion

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51006 Crash type: Heap-buffer-overflow READ 1 Crash state: pcpp::HttpRequestFirstLine::parseVersion pcpp::HttpRequestFirstLine::HttpRequestFirstLine pcpp::HttpRequestLayer::HttpRequestLayer...

OSV-2022-847 Heap-use-after-free in ndlz4_decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50991 Crash type: Heap-use-after-free READ 4 Crash state: ndlz4decompress bloscd dojob...

OSV-2022-843 Heap-buffer-overflow in _cmsMAT3per

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50956 Crash type: Heap-buffer-overflow READ 8 Crash state: cmsMAT3per OptimizeMatrixShaper cmsOptimizePipeline...

OSV-2022-842 Stack-buffer-overflow in wc_Shake256_Final

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50946 Crash type: Stack-buffer-overflow WRITE Crash state: wcShake256Final wced448signmsgex wced448signmsg...

OSV-2022-840 Negative-size-param in wc_Sha3_256_Final

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50953 Crash type: Negative-size-param Crash state: wcSha3256Final wcHash wcRsaPadex...

OSV-2022-837 Heap-buffer-overflow in DetectGetLastSMFromMpmLists

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50929 Crash type: Heap-buffer-overflow READ 8 Crash state: DetectGetLastSMFromMpmLists DetectFastPatternSetup SigParse...

OSV-2022-836 Heap-buffer-overflow in jxl::N_AVX2::BlendingStage::ProcessPaddingRow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50915 Crash type: Heap-buffer-overflow READ Crash state: jxl::NAVX2::BlendingStage::ProcessPaddingRow jxl::LowMemoryRenderPipeline::RenderPadding jxl::LowMemoryRenderPipeline::ProcessBuffers...

OSV-2022-835 Use-of-uninitialized-value in json_buildv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50949 Crash type: Use-of-uninitialized-value Crash state: jsonbuildv jsonbuild showbootentries...

OSV-2022-834 Heap-use-after-free in mk_event_timeout_destroy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50924 Crash type: Heap-use-after-free WRITE 8 Crash state: mkeventtimeoutdestroy flbscheddestroy flbconfigexit...

OSV-2022-830 Heap-buffer-overflow in Exiv2::MemIo::read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50901 Crash type: Heap-buffer-overflow WRITE 8 Crash state: Exiv2::MemIo::read Exiv2::BasicIo::readOrThrow Exiv2::QuickTimeVideo::tagDecoder...

OSV-2022-829 Heap-use-after-free in xps_tifsSeekProc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50893 Crash type: Heap-use-after-free READ 8 Crash state: xpstifsSeekProc TIFFRewriteDirectory TIFFFlush...

OSV-2022-828 UNKNOWN READ in stream_finalize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50898 Crash type: UNKNOWN READ Crash state: streamfinalize ifreeobject coswritestreamalloc...

OSV-2022-821 Heap-buffer-overflow in ttfOutliner__BuildGlyphOutlineAux

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50847 Crash type: Heap-buffer-overflow READ 4 Crash state: ttfOutlinerBuildGlyphOutlineAux ttfOutlinerOutline gxttfoutline...

OSV-2022-819 Use-of-uninitialized-value in init_main_qtable

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50835 Crash type: Use-of-uninitialized-value Crash state: initmainqtable LibRaw::fujidecodestrip LibRaw::fujidecodeloop...

OSV-2022-818 Heap-buffer-overflow in Ins_NPUSHW

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50834 Crash type: Heap-buffer-overflow READ 1 Crash state: InsNPUSHW RunIns InstanceReset...

OSV-2022-815 Negative-size-param in PackChunkyBytes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50832 Crash type: Negative-size-param Crash state: PackChunkyBytes PrecalculatedXFORM cmsDoTransform...