OSV-2022-308 Null-dereference READ in ubsan_GetStackTrace

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46341 Crash type: Null-dereference READ Crash state: ubsanGetStackTrace...

OSV-2022-306 Heap-buffer-overflow in Imf_3_1::memstream_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46309 Crash type: Heap-buffer-overflow READ Crash state: Imf31::memstreamread dispatchread extractchunkleader...

OSV-2022-305 Heap-buffer-overflow in jxl::N_AVX2::BlendingStage::ProcessPaddingRow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46304 Crash type: Heap-buffer-overflow READ Crash state: jxl::NAVX2::BlendingStage::ProcessPaddingRow jxl::LowMemoryRenderPipeline::RenderPadding jxl::LowMemoryRenderPipeline::ProcessBuffers...

OSV-2022-304 Heap-use-after-free in decode_mcu

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46335 Crash type: Heap-use-after-free WRITE 4 Crash state: decodemcu consumedata jpegstartdecompress...

OSV-2022-303 Heap-use-after-free in start_pass_phuff_decoder

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46338 Crash type: Heap-use-after-free WRITE 4 Crash state: startpassphuffdecoder startinputpass jinitmasterdecompress...

OSV-2022-302 Heap-use-after-free in read_markers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46334 Crash type: Heap-use-after-free READ 4 Crash state: readmarkers consumemarkers jpegconsumeinput...

OSV-2022-301 Heap-buffer-overflow in template_compose_group

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46307 Crash type: Heap-buffer-overflow READ 1 Crash state: templatecomposegroup composegroupnonknockoutnoblendgeneral pdf14composegroup...

OSV-2022-299 Heap-use-after-free in read_data_compressed

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46279 Crash type: Heap-use-after-free READ 4 Crash state: readdatacompressed archivereadformatrarreaddata archivereaddatablock...

OSV-2022-296 Negative-size-param in jxl::N_SSE4::BlendingStage::ProcessPaddingRow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46243 Crash type: Negative-size-param Crash state: jxl::NSSE4::BlendingStage::ProcessPaddingRow jxl::LowMemoryRenderPipeline::RenderPadding jxl::LowMemoryRenderPipeline::ProcessBuffers...

OSV-2022-295 Use-of-uninitialized-value in unsigned long grk::N_SSE4::vscheduler<grk::N_SSE4::DecompressDcShiftIrrev>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46241 Crash type: Use-of-uninitialized-value Crash state: unsigned long grk::NSSE4::vscheduler std::1::function::funcunsigned long grk::NSSE4::vschedulergrk::NSSE4:: tf::Executor::invoke...

OSV-2022-289 Heap-buffer-overflow in add_compile_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46086 Crash type: Heap-buffer-overflow READ 4 Crash state: addcompilestring compiletree compiletree...

OSV-2022-288 Segv on unknown address in flb_ra_translate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46082 Crash type: Segv on unknown address Crash state: flbratranslate recordacfuzzer.c...

OSV-2022-284 Heap-double-free in read_config

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46019 Crash type: Heap-double-free Crash state: readconfig readglob readconfig...

OSV-2022-283 Heap-buffer-overflow in epassNUMBER_hook_path

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46006 Crash type: Heap-buffer-overflow READ 1 Crash state: epassNUMBERhookpath epassNUMBERhookfile epassNUMBERcreatefile...

OSV-2022-282 Heap-buffer-overflow in cosm_new_file

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46002 Crash type: Heap-buffer-overflow WRITE 1 Crash state: cosmnewfile epassNUMBERpkcs15generatekey scpkcs15initgeneratekey...

OSV-2022-281 Heap-use-after-free in jsmn_parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45984 Crash type: Heap-use-after-free WRITE 4 Crash state: jsmnparse flbjsontokenise flbpackjsonstate...

OSV-2022-280 Heap-buffer-overflow in Exiv2::getULong

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45993 Crash type: Heap-buffer-overflow READ 1 Crash state: Exiv2::getULong Exiv2::Internal::isValidBoxFileType Exiv2::Jp2Image::readMetadata...

OSV-2022-279 Heap-double-free in flb_pack_state_reset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45978 Crash type: Heap-double-free Crash state: flbpackstatereset inlibcollect flbinputcollectorfd...

OSV-2022-278 UNKNOWN READ in s_RLE_process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45992 Crash type: UNKNOWN READ Crash state: sRLEprocess cmdputbits clistcopymono...

OSV-2022-276 Segv on unknown address in sc_file_clear_acl_entries

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45969 Crash type: Segv on unknown address Crash state: scfileclearaclentries scfilefree scprofilefree...

OSV-2022-271 UNKNOWN READ in pdf14_buf_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45892 Crash type: UNKNOWN READ Crash state: pdf14buffree rcpdf14maskbuffree pdf14endtransparencymask...

OSV-2022-270 Stack-buffer-overflow in fn_ElIn_evaluate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45886 Crash type: Stack-buffer-overflow WRITE 4 Crash state: fnElInevaluate pdfisettransfer GSTR...

OSV-2022-268 Stack-use-after-return in template_sanity_check

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45880 Crash type: Stack-use-after-return READ 1 Crash state: templatesanitycheck processtmpl processblock...

OSV-2022-267 Segv on unknown address in flb_sds_copy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45879 Crash type: Segv on unknown address Crash state: flbsdscopy flbparserdecoderdo flbparserlogfmtdo...

OSV-2022-265 Heap-buffer-overflow in jxl::WriteToPixelCallbackStage::ProcessRow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45833 Crash type: Heap-buffer-overflow READ 4 Crash state: jxl::WriteToPixelCallbackStage::ProcessRow jxl::LowMemoryRenderPipeline::RenderRect jxl::LowMemoryRenderPipeline::ProcessBuffers...

OSV-2022-264 Heap-buffer-overflow in jxl::N_AVX2::BlendingStage::ProcessRow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45822 Crash type: Heap-buffer-overflow READ 4 Crash state: jxl::NAVX2::BlendingStage::ProcessRow jxl::LowMemoryRenderPipeline::RenderRect jxl::LowMemoryRenderPipeline::ProcessBuffers...

OSV-2022-262 Heap-double-free in flb_pack_state_reset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45810 Crash type: Heap-double-free Crash state: flbpackstatereset inlibcollect flbinputcollectorfd...

OSV-2022-261 Segv on unknown address in flb_ra_create

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45659 Crash type: Segv on unknown address Crash state: flbracreate recordacfuzzer.c...

OSV-2022-260 Heap-double-free in read_config

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45687 Crash type: Heap-double-free Crash state: readconfig flbcffluentbitcreate flbcfcreatefromfile...

OSV-2022-259 Heap-double-free in read_config

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45671 Crash type: Heap-double-free Crash state: readconfig readglob readconfig...

OSV-2022-258 Heap-double-free in Imf_3_1::RgbaInputFile::~RgbaInputFile

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45718 Crash type: Heap-double-free Crash state: Imf31::RgbaInputFile::RgbaInputFile Imf31::checkOpenEXRFile openexrexrcheckfuzzer.cc...

OSV-2022-257 Segv on unknown address in flb_config_map_properties_check

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45670 Crash type: Segv on unknown address Crash state: flbconfigmappropertiescheck configmapfuzzer.c...

OSV-2022-255 Heap-double-free in flb_pack_state_reset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45667 Crash type: Heap-double-free Crash state: flbpackstatereset packjsonstatefuzzer.c flbpackstateinit...

OSV-2022-254 Heap-use-after-free in jsmn_parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45651 Crash type: Heap-use-after-free WRITE 4 Crash state: jsmnparse flbjsontokenise flbpackjsonstate...

OSV-2022-252 Heap-buffer-overflow in grk::PacketLengthMarkers::readPLM

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45622 Crash type: Heap-buffer-overflow READ 1 Crash state: grk::PacketLengthMarkers::readPLM grk::CodeStreamDecompress::processmarker grk::CodeStreamDecompress::readHeaderProcedureImpl...

OSV-2022-250 Heap-buffer-overflow in __covrec_1D46B478ANUMBER

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45603 Crash type: Heap-buffer-overflow READ 1 Crash state: covrec1D46B478ANUMBER covrecF49D057CNUMBER covrec5D82FD3F85773DBDu...

OSV-2022-249 Heap-buffer-overflow in llvm::DataLayout::getIndexedOffsetInType

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45591 Crash type: Heap-buffer-overflow READ 4 Crash state: llvm::DataLayout::getIndexedOffsetInType InterpreterStackFrame::ResolveConstantValue InterpreterStackFrame::EvaluateValue...

OSV-2022-248 Uncaught exception in java.base/java.nio.Bits.reserveMemory

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45563 Crash type: Uncaught exception Crash state: java.base/java.nio.Bits.reserveMemory java.base/java.nio.DirectByteBuffer. java.base/java.nio.ByteBuffer.allocateDirect...

OSV-2022-245 Heap-buffer-overflow in grk::PacketIter::genPrecinctInfo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45548 Crash type: Heap-buffer-overflow READ 4 Crash state: grk::PacketIter::genPrecinctInfo grk::PacketManager::PacketManager grk::T2Decompress::decompressPackets...

OSV-2022-244 Heap-buffer-overflow in process_ef

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45552 Crash type: Heap-buffer-overflow WRITE 8 Crash state: processef processblock processdf...

OSV-2022-243 Heap-buffer-overflow in grk::PacketIter::next_pcrl

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45537 Crash type: Heap-buffer-overflow READ 1 Crash state: grk::PacketIter::nextpcrl grk::T2Decompress::decompressPackets grk::TileProcessor::decompressT2...

OSV-2022-241 UNKNOWN READ in write_cond_nodes_to_conf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45523 Crash type: UNKNOWN READ Crash state: writecondnodestoconf sepolkernelpolicydbtoconf binpolicy-fuzzer.c...

OSV-2022-238 Segv on unknown address in i_zval_ptr_dtor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45429 Crash type: Segv on unknown address Crash state: izvalptrdtor zendleavehelperSPEC zenddispatchtrycatchfinallyhelperSPEC...

OSV-2022-237 Stack-buffer-overflow in sc_format_oid

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45459 Crash type: Stack-buffer-overflow READ Crash state: scformatoid dostoredataobject fuzzpkcs15init.c...

OSV-2022-235 Heap-buffer-overflow in zend_gc_collect_cycles

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45369 Crash type: Heap-buffer-overflow READ 1 Crash state: zendgccollectcycles fuzzerrequestshutdown fuzzerdorequestfrombuffer...

OSV-2022-231 Heap-buffer-overflow in do_fileid

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45430 Crash type: Heap-buffer-overflow WRITE 2 Crash state: dofileid processcommand processblock...

OSV-2022-232 UNKNOWN READ in pdfi_fapi_get_glyph

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45439 Crash type: UNKNOWN READ Crash state: pdfifapigetglyph getfapiglyphdata cffslotload...

OSV-2022-229 UNKNOWN READ in spgetcc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45347 Crash type: UNKNOWN READ Crash state: spgetcc pdfireadbyte pdfireadtoken...

OSV-2022-226 Heap-buffer-overflow in vips_rect_intersectrect

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45353 Crash type: Heap-buffer-overflow READ 4 Crash state: vipsrectintersectrect vipsforeignloadpdfgenerate vipsregionpreparetogenerate...

OSV-2022-223 Container-overflow in Exiv2::Photoshop::locateIrb

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45302 Crash type: Container-overflow READ 4 Crash state: Exiv2::Photoshop::locateIrb Exiv2::Photoshop::setIptcIrb Exiv2::JpegBase::doWriteMetadata...