OSV-2022-627 Heap-buffer-overflow in cmsMLUgetASCII

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49475 Crash type: Heap-buffer-overflow READ 2 Crash state: cmsMLUgetASCII WriteCountAndString TypeCrdInfoWrite...

OSV-2022-626 Heap-buffer-overflow in Write16bitTables

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49461 Crash type: Heap-buffer-overflow READ 2 Crash state: Write16bitTables TypeLUT16Write SaveTags...

OSV-2022-625 Heap-buffer-overflow in WriteSeqID

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49441 Crash type: Heap-buffer-overflow READ 8 Crash state: WriteSeqID WritePositionTable TypeProfileSequenceIdWrite...

OSV-2022-624 Heap-buffer-overflow in Assimp::MD5::MD5Parser::ParseHeader

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49422 Crash type: Heap-buffer-overflow READ 1 Crash state: Assimp::MD5::MD5Parser::ParseHeader Assimp::MD5::MD5Parser::MD5Parser Assimp::MD5Importer::LoadMD5MeshFile...

OSV-2022-622 Segv on unknown address in urshift

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49429 Crash type: Segv on unknown address Crash state: urshift mpzdiv2exp mrbbintrshift...

OSV-2022-621 Segv on unknown address in mpz_add

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49427 Crash type: Segv on unknown address Crash state: mpzadd mrbbintadd intadd...

OSV-2022-619 Heap-buffer-overflow in udiv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49425 Crash type: Heap-buffer-overflow READ 4 Crash state: udiv mrbbintmod intmod...

OSV-2022-618 Heap-buffer-overflow in Type_MLU_Write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49433 Crash type: Heap-buffer-overflow READ 4 Crash state: TypeMLUWrite SaveTags cmsSaveProfileToIOhandler...

OSV-2022-616 Timeout in JsonFuzzer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49401 Crash type: Timeout Crash state: JsonFuzzer...

OSV-2022-615 Heap-buffer-overflow in TetrahedralInterp16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49386 Crash type: Heap-buffer-overflow READ 2 Crash state: TetrahedralInterp16 cmsPipelineEval16 FixWhiteMisalignment...

OSV-2022-614 UNKNOWN READ in std::__1::basic_filebuf<char, std::__1::char_traits<char> >::underflow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49381 Crash type: UNKNOWN READ Crash state: std::1::basicfilebuf ::underflow std::1::basicstreambuf ::uflow std::1::basicstreambuf ::xsgetn...

OSV-2022-613 UNKNOWN READ in OT::avar::map_coords

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49407 Crash type: UNKNOWN READ Crash state: OT::avar::mapcoords hbotvarnormalizevariations test-ot-face.c...

OSV-2022-612 Heap-buffer-overflow in fxGetNextEntity

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49357 Crash type: Heap-buffer-overflow WRITE 1 Crash state: fxGetNextEntity fxGetNextTokenJSXChild fxJSXElement...

OSV-2022-611 Heap-use-after-free in cras_iodev_list_disable_dev

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49368 Crash type: Heap-use-after-free READ 4 Crash state: crasiodevlistdisabledev crasiodevlistrmoutput a2dppcmiodevdestroy...

OSV-2022-608 Heap-use-after-free in jxl::WriteToPixelCallbackStage::ProcessRow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49277 Crash type: Heap-use-after-free READ 4 Crash state: jxl::WriteToPixelCallbackStage::ProcessRow jxl::LowMemoryRenderPipeline::RenderRect jxl::LowMemoryRenderPipeline::ProcessBuffers...

OSV-2022-607 Heap-buffer-overflow in ucl_object_dtor_unref_single

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49289 Crash type: Heap-buffer-overflow READ 8 Crash state: uclobjectdtorunrefsingle uclobjectdtorunref uclhashdestroy...

OSV-2022-606 Heap-buffer-overflow in mrb_bint_add

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49282 Crash type: Heap-buffer-overflow READ 8 Crash state: mrbbintadd mrbintadd intadd...

OSV-2022-605 Heap-buffer-overflow in mrb_bint_cmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49291 Crash type: Heap-buffer-overflow READ 8 Crash state: mrbbintcmp cmpnum numgt...

OSV-2022-604 Stack-buffer-overflow in sc_asn1_read_tag

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49248 Crash type: Stack-buffer-overflow READ 1 Crash state: scasn1readtag scasn1findtag cardoslistfiles...

OSV-2022-603 Heap-buffer-overflow in mrb_vm_exec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49259 Crash type: Heap-buffer-overflow WRITE 8 Crash state: mrbvmexec mrbvmrun mrbtoprun...

OSV-2022-601 Heap-buffer-overflow in mrb_bint_xor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49255 Crash type: Heap-buffer-overflow READ 8 Crash state: mrbbintxor intxor mrbvmexec...

OSV-2022-600 Segv on unknown address in mrb_bint_to_s

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49269 Crash type: Segv on unknown address Crash state: mrbbinttos mrbintegertostr inttos...

OSV-2022-599 Use-of-uninitialized-value in mrb_bint_as_int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49268 Crash type: Use-of-uninitialized-value Crash state: mrbbintasint mrbensureinttype mrbgetargs...

OSV-2022-598 Heap-buffer-overflow in get_symbols_64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49209 Crash type: Heap-buffer-overflow READ 8 Crash state: getsymbols64 getmain64 binsym...

OSV-2022-597 Heap-use-after-free in .tmpgt0oOx

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49167 Crash type: Heap-use-after-free READ 8 Crash state: .tmpgt0oOx .tmpgt0oOx wasmtimesetjmp...

OSV-2022-595 Stack-buffer-overflow in Lookup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49227 Crash type: Stack-buffer-overflow WRITE Crash state: Lookup LookupLetter TranslateLetter...

OSV-2022-594 Container-overflow in STOFFStarMathToMMLConverterInternal::Parser::convert

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49164 Crash type: Container-overflow READ 1 Crash state: STOFFStarMathToMMLConverterInternal::Parser::convert STOFFStarMathToMMLConverterInternal::Parser::parse STOFFStarMathToMMLConverter::convertStarMath...

OSV-2022-590 Heap-use-after-free in .tmpoLlNv4

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49166 Crash type: Heap-use-after-free READ 8 Crash state: .tmpoLlNv4 .tmpoLlNv4 wasmtimesetjmp...

OSV-2022-588 Heap-use-after-free in wasmtime_runtime::externref::gc::hcbc8e23ae41614fa

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49171 Crash type: Heap-use-after-free WRITE 8 Crash state: wasmtimeruntime::externref::gc::hcbc8e23ae41614fa wasmtimefuzzing::oracles::tableops::$u7b$$u7b$closure$u7d$$u7d$::hd207e5ffb69...

OSV-2022-586 Heap-use-after-free in op_pci_write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49107 Crash type: Heap-use-after-free READ 4 Crash state: oppciwrite genericfuzz fuzz.c...

OSV-2022-585 Memcpy-param-overlap in repeat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49103 Crash type: Memcpy-param-overlap Crash state: repeat pere pere...

OSV-2022-581 Heap-buffer-overflow in megasas_map_sgl

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49086 Crash type: Heap-buffer-overflow READ 4 Crash state: megasasmapsgl megasasmmiowrite megasasportwrite...

OSV-2022-580 Heap-buffer-overflow in jxl::N_AVX2::BlendingStage::ProcessPaddingRow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49049 Crash type: Heap-buffer-overflow WRITE Crash state: jxl::NAVX2::BlendingStage::ProcessPaddingRow jxl::LowMemoryRenderPipeline::RenderPadding jxl::LowMemoryRenderPipeline::ProcessBuffers...

OSV-2022-578 Heap-buffer-overflow in mrb_bint_to_s

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49045 Crash type: Heap-buffer-overflow WRITE 1 Crash state: mrbbinttos inttos mrbvmexec...

OSV-2022-577 Heap-use-after-free in jsmn_parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49033 Crash type: Heap-use-after-free WRITE 4 Crash state: jsmnparse flbjsontokenise flbpackjsonstate...

OSV-2022-576 UNKNOWN WRITE in SkMaskBlurFilter::blur

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49061 Crash type: UNKNOWN WRITE Crash state: SkMaskBlurFilter::blur SkBlurMask::BoxBlur SkBlurMaskFilterImpl::filterMask...

OSV-2022-573 Heap-buffer-overflow in zim_ReflectionEnumBackedCase_getBackingValue

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49068 Crash type: Heap-buffer-overflow READ 4 Crash state: zimReflectionEnumBackedCasegetBackingValue executeinternal fuzzerexecuteinternal...

OSV-2022-572 Heap-buffer-overflow in dhcp_reply

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49002 Crash type: Heap-buffer-overflow READ 1 Crash state: dhcpreply dhcppacket FuzzDhcp...

OSV-2022-571 Use-of-uninitialized-value in LZ4_compress_fast_extState_fastReset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48993 Crash type: Use-of-uninitialized-value Crash state: LZ4compressfastextStatefastReset LZ4FcompressBlock LZ4FcompressUpdateImpl...

OSV-2022-564 Heap-buffer-overflow in sc_pkcs15_allocate_object_content

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48940 Crash type: Heap-buffer-overflow READ 4 Crash state: scpkcs15allocateobjectcontent scpkcs15pincacheadd scpkcs15verifypinwithsessionpin...

OSV-2022-563 Use-of-uninitialized-value in LZ4HC_compress_generic_noDictCtx

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48910 Crash type: Use-of-uninitialized-value Crash state: LZ4HCcompressgenericnoDictCtx LZ4compressHCextStateHCfastReset LZ4FcompressBlockHC...

OSV-2022-562 UNKNOWN WRITE in udiv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48904 Crash type: UNKNOWN WRITE Crash state: udiv mrbbintmod intmod...

OSV-2022-558 Segv on unknown address in onig_free_body

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48895 Crash type: Segv on unknown address Crash state: onigfreebody onignew flbregexcreate...

OSV-2022-557 Heap-buffer-overflow in emit_goto

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48924 Crash type: Heap-buffer-overflow READ 4 Crash state: emitgoto jsparseforinof jsparsestatementordecl...

OSV-2022-556 UNKNOWN READ in mrb_bint_cmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48877 Crash type: UNKNOWN READ Crash state: mrbbintcmp cmpnum numgt...

OSV-2022-551 Heap-buffer-overflow in fixup_pcap_pkthdr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48863 Crash type: Heap-buffer-overflow READ 1 Crash state: fixuppcappkthdr pcapnextpacket pcapofflineread...

OSV-2022-550 Heap-use-after-free in mrb_bint_new_str

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48873 Crash type: Heap-use-after-free READ 1 Crash state: mrbbintnewstr mrbvmexec mrbvmrun...

OSV-2022-549 Invalid-free in round_trip_fuzzer.c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48884 Crash type: Invalid-free Crash state: roundtripfuzzer.c...

OSV-2022-543 Index-out-of-bounds in decode_coefs

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48816 Crash type: Index-out-of-bounds Crash state: decodecoefs vp9decodeblocktokens decodeblock...

OSV-2022-538 Memcpy-param-overlap in FT_Stream_TryRead

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48749 Crash type: Memcpy-param-overlap Crash state: FTStreamTryRead bdfloadfont BDFFaceInit...