OSV-2018-216 Heap-buffer-overflow in token_stream_prepare

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9806 Crash type: Heap-buffer-overflow READ 1 Crash state: tokenstreamprepare tokenstreampeekstring tokenstreamconsume...

OSV-2018-212 Heap-buffer-overflow in token_stream_prepare

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9805 Crash type: Heap-buffer-overflow READ 1 Crash state: tokenstreamprepare parse typedeclparse...

OSV-2018-213 Use-of-uninitialized-value in gvs_tuple_is_normal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9840 Crash type: Use-of-uninitialized-value Crash state: gvstupleisnormal gvariantserialisedisnormal gvsvariantisnormal...

OSV-2018-210 Heap-use-after-free in UA_SecureChannel_deleteMembersCleanup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5499 Crash type: Heap-use-after-free READ 8 Crash state: UASecureChanneldeleteMembersCleanup removeSecureChannelCallback UAServerrunshutdown...

OSV-2018-209 Heap-buffer-overflow in loop

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5251 Crash type: Heap-buffer-overflow READ 1 Crash state: loop loop ftpplinsertfinfo...

OSV-2018-206 Heap-buffer-overflow in parse_sigalgs_list

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9808 Crash type: Heap-buffer-overflow READ 1 Crash state: parsesigalgslist SSLCTXset1sigalgslist std::1::functionvoid...

OSV-2017-22 Heap-buffer-overflow in opj_tcd_mct_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3331 Crash type: Heap-buffer-overflow READ 4 Crash state: opjtcdmctdecode opjtcddecodetile opjj2kdecodetile...

OSV-2018-208 Global-buffer-overflow in bloaty::wasm::Section::Read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9540 Crash type: Global-buffer-overflow READ 8 Crash state: bloaty::wasm::Section::Read bloaty::wasm::ParseSections bloaty::wasm::WebAssemblyObjectFile::ProcessFile...

OSV-2018-204 UNKNOWN WRITE in __msan_memcpy.part.51

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9845 Crash type: UNKNOWN WRITE Crash state: msanmemcpy.part.51 QuickOpen::ReadRaw QuickOpen::ReadNext...

OSV-2018-201 Heap-buffer-overflow in r_str_utf16_to_utf8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10487 Crash type: Heap-buffer-overflow READ 1 Crash state: rstrutf16toutf8 sections rbinobjectsetitems...

OSV-2018-202 Heap-buffer-overflow in parse_mode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11167 Crash type: Heap-buffer-overflow READ 1 Crash state: parsemode gittreeparseraw gitobjectfromraw...

OSV-2018-200 Heap-buffer-overflow in SplashPath::lineTo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10148 Crash type: Heap-buffer-overflow READ 1 Crash state: SplashPath::lineTo Splash::makeDashedPath Splash::stroke...

OSV-2018-196 Use-of-uninitialized-value in _pkcs12_decode_safe_contents

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10216 Crash type: Use-of-uninitialized-value Crash state: pkcs12decodesafecontents parsesafecontents gnutlspkcs12getbag...

OSV-2018-195 Heap-buffer-overflow in gmp_emsa_pkcs1_signature_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10671 Crash type: Heap-buffer-overflow WRITE 1 Crash state: gmpemsapkcs1signaturedata verifyemsapkcs1signature verify...

OSV-2018-199 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10986 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short AAT::LookupSegmentSingle ::cmp AAT::LookupSegmentSingle const OT::VarSizedBi...

OSV-2018-198 Heap-buffer-overflow in r_read_le32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11308 Crash type: Heap-buffer-overflow READ 1 Crash state: rreadle32 rreadle64 rbinfilegetstrings...

OSV-2018-194 Heap-use-after-free in r_core_task_decref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11359 Crash type: Heap-use-after-free READ 8 Crash state: rcoretaskdecref rlistdelete rlistpurge...

OSV-2018-191 Heap-buffer-overflow in network_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11302 Crash type: Heap-buffer-overflow READ 8 Crash state: networkfree managerfree fuzz-network-parser.c...

OSV-2018-192 Stack-buffer-overflow in highbd_dr_prediction_z1_64xN_avx2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11517 Crash type: Stack-buffer-overflow READ 16 Crash state: highbddrpredictionz164xNavx2 av1highbddrpredictionz1avx2 av1predictintrablock...

OSV-2018-188 Use-of-uninitialized-value in _decode_pkcs12_auth_safe

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10138 Crash type: Use-of-uninitialized-value Crash state: decodepkcs12authsafe gnutlspkcs12getbag gnutlspkcs12simpleparse...

OSV-2018-190 Heap-buffer-overflow in OT::Coverage::intersects

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10084 Crash type: Heap-buffer-overflow READ 8 Crash state: OT::Coverage::intersects OT::ContextFormat2::closure hbvoidt const OT::hbclosurecontextt::dispatch...

OSV-2018-186 Use-of-uninitialized-value in decode_complex_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10137 Crash type: Use-of-uninitialized-value Crash state: decodecomplexstring gnutlsx509dntostring appendelements...

OSV-2018-185 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11001 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short OT::IndexSubtable::getextents OT::IndexSubtableRecord::getextents...

OSV-2018-182 Stack-buffer-overflow in cdma2k_message_HANDOFF_DIR

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11633 Crash type: Stack-buffer-overflow READ 2 Crash state: cdma2kmessageHANDOFFDIR cdma2kmessagedecode dissectcdma2k...

OSV-2018-179 Heap-buffer-overflow in OT::post::accelerator_t::cmp_gids

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11290 Crash type: Heap-buffer-overflow READ 5 Crash state: OT::post::acceleratort::cmpgids sortrcmpswap sortrsimple...

OSV-2018-180 UNKNOWN READ in [stack]

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10445 Crash type: UNKNOWN READ Crash state: stack...

OSV-2018-177 Heap-buffer-overflow in prefixcmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11007 Crash type: Heap-buffer-overflow READ 1 Crash state: prefixcmp gitprefixcmp gitcommitparseraw...

OSV-2018-176 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10899 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short AAT::LookupSegmentSingle ::cmp AAT::LookupSegmentSingle const OT::VarSizedBi...

OSV-2018-175 Heap-buffer-overflow in rawspeed::VC5Decompressor::Wavelet::HighPassBand::decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11429 Crash type: Heap-buffer-overflow WRITE 2 Crash state: rawspeed::VC5Decompressor::Wavelet::HighPassBand::decode rawspeed::VC5Decompressor::decode VC5Decompressor.cpp...

OSV-2018-172 UNKNOWN READ in _hb_ot_shape_fallback_kern

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10762 Crash type: UNKNOWN READ Crash state: hbotshapefallbackkern hbotposition hbotshapeinternal...

OSV-2018-174 Heap-buffer-overflow in BEInt<unsigned char, 1>::operator unsigned char

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11245 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned char OT::KernSubTableFormat3::getkerning hbkernmachinet::kern...

OSV-2018-173 Stack-buffer-overflow in nullable_memcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10865 Crash type: Stack-buffer-overflow READ Crash state: nullablememcpy nshkeytoattr parseodppushnshaction...

OSV-2018-167 Heap-buffer-overflow in cff_parser_run

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9967 Crash type: Heap-buffer-overflow WRITE 1 Crash state: cffparserrun cffsubfontload cfffontload...

OSV-2018-170 Heap-use-after-free in yr_re_ast_split_at_chaining_point

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11752 Crash type: Heap-use-after-free READ 4 Crash state: yrreastsplitatchainingpoint yrparserreducestringdeclaration yarayyparse...

OSV-2018-165 Use-of-uninitialized-value in imax

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11537 Crash type: Use-of-uninitialized-value Crash state: imax selfguidedfilter selfguidedc...

OSV-2018-158 Heap-buffer-overflow in ofpbuf_insert

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11253 Crash type: Heap-buffer-overflow WRITE Crash state: ofpbufinsert nxputraw nxputmatch...

OSV-2018-162 Heap-buffer-overflow in BEInt<unsigned int, 4>::operator unsigned int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10948 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned int OT::OffsetTo , OT::IntTypeunsigned i AAT::KerxSubTableFormat1::drivercontextt::drivercontextt...

OSV-2018-157 Heap-double-free in minimatch_destroy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11408 Crash type: Heap-double-free Crash state: minimatchdestroy ofctlparseflow ofctlparsetarget.c...

OSV-2018-156 Heap-buffer-overflow in dotnet_parse_us

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11945 Crash type: Heap-buffer-overflow READ 1 Crash state: dotnetparseus dotnetparsecom dotnetload...

OSV-2018-160 Heap-buffer-overflow in do_uncompress_block

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11011 Crash type: Heap-buffer-overflow WRITE 1 Crash state: douncompressblock processblock douncompressfile...

OSV-2018-159 Use-of-uninitialized-value in AAT::LookupFormat8<OT::IntType<unsigned short, 2u> >::get_value

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10953 Crash type: Use-of-uninitialized-value Crash state: AAT::LookupFormat8 ::getvalue AAT::Lookup ::getvalue AAT::StateTable::getclass...

OSV-2018-161 Heap-buffer-overflow in BEInt<unsigned short, 2>::set

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11081 Crash type: Heap-buffer-overflow WRITE 1 Crash state: BEInt::set OT::Script::subset void OT::OffsetTo, true::serialize...

OSV-2018-155 Stack-buffer-overflow in cff_parser_run

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9865 Crash type: Stack-buffer-overflow READ 8 Crash state: cffparserrun cffsubfontload cfffontload...

OSV-2018-154 Heap-use-after-free in XRefEntry::setFlag

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11244 Crash type: Heap-use-after-free READ 4 Crash state: XRefEntry::setFlag Parser::makeStream Parser::getObj...

OSV-2018-153 Heap-buffer-overflow in asn1_ex_i2c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7696 Crash type: Heap-buffer-overflow READ 4 Crash state: asn1exi2c asn1i2dexprimitive ASN1itemexi2d...

OSV-2018-152 Heap-buffer-overflow in dhcp6_option_parse_status

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10746 Crash type: Heap-buffer-overflow READ 2 Crash state: dhcp6optionparsestatus dhcp6optionparsepdprefix dhcp6optionparseia...

OSV-2018-148 Heap-buffer-overflow in r_bin_filter_sections

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11272 Crash type: Heap-buffer-overflow WRITE 3 Crash state: rbinfiltersections rbinobjectsetitems rbinobjectnew...

OSV-2018-150 Global-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11010 Crash type: Global-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short AAT::ContextualSubtable::drivercontextt::transition void AAT::StateTableDriver::driveAAT::Conte...

OSV-2018-149 Heap-buffer-overflow in BEInt<unsigned int, 4>::operator unsigned int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11033 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned int AAT::KerxSubTableFormat2::sanitize hbsanitizecontextt::returnt AAT::KerxTable::dispatch...

OSV-2018-146 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11526 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short OT::KernSubTable::getsize void hbsanitizecontextt::setobjectOT::KernSubTableOT::KernOTSubTableHeader...