OSV-2021-1763 Stack-buffer-overflow in pdfi_oc_is_ocg_visible

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42908 Crash type: Stack-buffer-overflow WRITE Crash state: pdfiocisocgvisible pdfiopBDC pdfiinterpretstreamoperator...

OSV-2021-1762 Heap-buffer-overflow in TTF::be_u16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42934 Crash type: Heap-buffer-overflow READ 1 Crash state: TTF::beu16 TTF::Cmap::subtable TTF::Font::tryloadfromoffset...

OSV-2021-1760 Heap-buffer-overflow in grk::GrkImage::sycc420_to_rgb

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42931 Crash type: Heap-buffer-overflow WRITE 4 Crash state: grk::GrkImage::sycc420torgb grk::GrkImage::colorsycctorgb grk::GrkImage::colorConvert...

OSV-2021-1759 Heap-use-after-free in zend_hash_reverse_apply

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42894 Crash type: Heap-use-after-free READ 4 Crash state: zendhashreverseapply shutdowndestructors zendcalldestructors...

OSV-2021-1758 Heap-buffer-overflow in seturl

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42892 Crash type: Heap-buffer-overflow READ Crash state: seturl parseurl curlurlset...

OSV-2021-1756 Heap-buffer-overflow in Curl_sasl_decode_mech

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42901 Crash type: Heap-buffer-overflow READ 10 Crash state: Curlsasldecodemech Curlsaslparseurlauthoption pop3parseurloptions...

OSV-2021-1755 Heap-buffer-overflow in ndlz4_decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42924 Crash type: Heap-buffer-overflow READ 4 Crash state: ndlz4decompress ndlzdecompress bloscd...

OSV-2021-1754 UNKNOWN READ in insert_free_size

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42917 Crash type: UNKNOWN READ Crash state: insertfreesize chunkfreeobject pdfipscriptstackfinit...

OSV-2021-1753 UNKNOWN READ in names_string_ref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42907 Crash type: UNKNOWN READ Crash state: namesstringref zfontglyphname pdfifapigetglyphnameorcid...

OSV-2021-1752 Heap-buffer-overflow in s_hex_process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42896 Crash type: Heap-buffer-overflow READ 1 Crash state: shexprocess sexDprocess sreadbuf...

OSV-2021-1748 Heap-buffer-overflow in jxl::N_AVX2::FloatToRGBA8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42839 Crash type: Heap-buffer-overflow WRITE 1 Crash state: jxl::NAVX2::FloatToRGBA8 jxl::FinalizeImageRect jxl::ThreadPool::RunCallStatejxl::FinalizeFrameDecoding...

OSV-2021-1747 Heap-buffer-overflow in seturl

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42808 Crash type: Heap-buffer-overflow READ 16 Crash state: seturl parseurl curlurlset...

OSV-2021-1745 Heap-buffer-overflow in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42862 Crash type: Heap-buffer-overflow READ 1 Crash state: std::1::basicstring, std::1::allocator...

OSV-2021-1743 Stack-buffer-overflow in strncat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42736 Crash type: Stack-buffer-overflow WRITE Crash state: strncat pdfcmapopenfile pdfireadcmap...

OSV-2021-1741 Stack-buffer-overflow in line_join_points

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42796 Crash type: Stack-buffer-overflow WRITE 4 Crash state: linejoinpoints strokeaddcompat gxstrokepathonly...

OSV-2021-1740 Stack-buffer-overflow in pdfi_annot_draw_LE_one

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42783 Crash type: Stack-buffer-overflow WRITE Crash state: pdfiannotdrawLEone pdfiannotdrawLE pdfiannotdrawLine...

OSV-2021-1737 Heap-buffer-overflow in Curl_sasl_decode_mech

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42727 Crash type: Heap-buffer-overflow READ 10 Crash state: Curlsasldecodemech Curlsaslparseurlauthoption pop3parseurloptions...

OSV-2021-1736 Segv on unknown address in symhash

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42741 Crash type: Segv on unknown address Crash state: symhash hashtabsearch mlssemanticlevelexpand...

OSV-2021-1733 UNKNOWN READ in mls_semantic_level_expand

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42729 Crash type: UNKNOWN READ Crash state: mlssemanticlevelexpand policydbusercache hashtabmap...

OSV-2021-1731 Memcpy-param-overlap in gs_fapi_do_char

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42656 Crash type: Memcpy-param-overlap Crash state: gsfapidochar pdfifapibuildchar showproceed...

OSV-2021-1730 Heap-buffer-overflow in seturl

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42708 Crash type: Heap-buffer-overflow READ Crash state: seturl parseurl curlurlset...

OSV-2021-1728 UNKNOWN READ in pdfi_dict_get

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42687 Crash type: UNKNOWN READ Crash state: pdfidictget pdfidictgetint pdfireadbareobject...

OSV-2021-1727 UNKNOWN WRITE in void uWS::WebSocketProtocol<true, Impl>::UnrolledXor<4>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42672 Crash type: UNKNOWN WRITE Crash state: void uWS::WebSocketProtocol::UnrolledXor void uWS::WebSocketProtocol::UnrolledXor void uWS::WebSocketProtocol::UnrolledXor...

OSV-2021-1726 UNKNOWN READ in pdfi_dereference

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42616 Crash type: UNKNOWN READ Crash state: pdfidereference pdfiderefloopdetect pdfidictget...

OSV-2021-1724 Segv on unknown address in chunk_obj_alloc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42633 Crash type: Segv on unknown address Crash state: chunkobjalloc chunkallocbytes pdfipscriptinterpret...

OSV-2021-1723 Global-buffer-overflow in ps_font_def_func

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42613 Crash type: Global-buffer-overflow READ Crash state: psfontdeffunc pdfipscriptinterpret pdfireadpsfont...

OSV-2021-1719 Heap-buffer-overflow in insert_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42560 Crash type: Heap-buffer-overflow WRITE 8 Crash state: insertfree chunkobjalloc chunkallocbytes...

OSV-2021-1717 UNKNOWN READ in pdfi_read_cff_font

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42559 Crash type: UNKNOWN READ Crash state: pdfireadcfffont pdfiloadfont pdfiloaddictfont...

OSV-2021-1715 Segv on unknown address in sreadbuf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42489 Crash type: Segv on unknown address Crash state: sreadbuf spgetcc sgets...

OSV-2021-1712 Heap-buffer-overflow in ndlz8_decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42537 Crash type: Heap-buffer-overflow WRITE Crash state: ndlz8decompress bloscd dojob...

OSV-2021-1711 Heap-buffer-overflow in cmap_endcodespacerange_func

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42541 Crash type: Heap-buffer-overflow WRITE Crash state: cmapendcodespacerangefunc pdfipscriptinterpret pdfireadcmap...

OSV-2021-1710 Heap-buffer-overflow in ndlz4_decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42472 Crash type: Heap-buffer-overflow WRITE Crash state: ndlz4decompress ndlzdecompress bloscd...

OSV-2021-1709 Stack-buffer-overflow in pdfi_do_image

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42454 Crash type: Stack-buffer-overflow WRITE Crash state: pdfidoimage pdfidoimageorform pdfiDo...

OSV-2021-1708 UNKNOWN READ in chunk_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42491 Crash type: UNKNOWN READ Crash state: chunkfreeobject pdficlosefile pdfidereference...

OSV-2021-1707 Negative-size-param in general_endcidrange_func

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42479 Crash type: Negative-size-param Crash state: generalendcidrangefunc cmapendcidrangefunc pdfipscriptinterpret...

OSV-2021-1706 Segv on unknown address in gx_adjust_color_Pattern

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42453 Crash type: Segv on unknown address Crash state: gxadjustcolorPattern gssetcolor pdfisetfillcolor...

OSV-2021-1704 Stack-buffer-overflow in pdfi_create_iccbased

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42460 Crash type: Stack-buffer-overflow WRITE 4 Crash state: pdficreateiccbased pdficreatecolorspacebyarray pdfisetcolorspace...

OSV-2021-1703 UNKNOWN in pdfi_fapi_get_gsubr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42485 Crash type: UNKNOWN Crash state: pdfifapigetgsubr gsfapiserializetype2font gsfapiftgetscaledfont...

OSV-2021-1698 Heap-buffer-overflow in chunk_obj_alloc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42356 Crash type: Heap-buffer-overflow READ 8 Crash state: chunkobjalloc chunkallocbytes pdfiobjectalloc...

OSV-2021-1697 Heap-use-after-free in stell

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42280 Crash type: Heap-use-after-free READ 1 Crash state: stell pdfiunreadtell pdfidereference...

OSV-2021-1695 Heap-buffer-overflow in flexbuffers::Verifier::VerifyRef

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42373 Crash type: Heap-buffer-overflow READ 4 Crash state: flexbuffers::Verifier::VerifyRef flexbuffers::Verifier::VerifyVector flexbuffers::Verifier::VerifyRef...

OSV-2021-1694 Stack-buffer-overflow in pdfi_read_cff_dict

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42298 Crash type: Stack-buffer-overflow WRITE 4 Crash state: pdfireadcffdict pdfireadcffdict pdfireadcffdict...

OSV-2021-1693 Global-buffer-overflow in pdfi_fapi_get_glyph

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42310 Crash type: Global-buffer-overflow READ Crash state: pdfifapigetglyph getfapiglyphdata cffslotload...

OSV-2021-1692 Heap-use-after-free in chunk_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42324 Crash type: Heap-use-after-free READ 8 Crash state: chunkfreeobject pdfiopenmemorystreamfromfilteredstream pdfibuildmeshshading...

OSV-2021-1690 Global-buffer-overflow in search_table_1

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42266 Crash type: Global-buffer-overflow READ 1 Crash state: searchtable1 splitbogusoperator pdfiinterpretstreamoperator...

OSV-2021-1691 UNKNOWN READ in kh_resize_ucl_hash_node

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42323 Crash type: UNKNOWN READ Crash state: khresizeuclhashnode khputuclhashnode uclhashinsert...

OSV-2021-1689 Stack-buffer-underflow in read_xref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42294 Crash type: Stack-buffer-underflow WRITE 1 Crash state: readxref pdfireadxref pdfisetinputstream...

OSV-2021-1688 Stack-buffer-overflow in pdfi_annot_draw

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42329 Crash type: Stack-buffer-overflow WRITE Crash state: pdfiannotdraw pdfidoannotations pdfipagerender...

OSV-2021-1687 Segv on unknown address in cs_adjust_counts_icc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42290 Crash type: Segv on unknown address Crash state: csadjustcountsicc gstateclonecore gsgsave...

OSV-2021-1686 Segv on unknown address in chunk_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42312 Crash type: Segv on unknown address Crash state: chunkfreeobject fileclosefile sclose...