OSV-2018-145 Heap-buffer-overflow in cras_rclient_message_from_client

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9242 Crash type: Heap-buffer-overflow READ 4 Crash state: crasrclientmessagefromclient crasrclientbufferfromclient rclientmessage.cc...

OSV-2018-143 Global-buffer-overflow in CFF::BlendArg::set_blends

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11714 Crash type: Global-buffer-overflow READ 8 Crash state: CFF::BlendArg::setblends CFF::CFF2CSOpSetCFF2CSOpSetSubrSubset, CFF::SubrSubsetParam, CFF::PathProcsNul CFF2CSOpSetSubrSubset::processop...

OSV-2018-142 UNKNOWN READ in cff_decoder_parse_charstrings

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11157 Crash type: UNKNOWN READ Crash state: cffdecoderparsecharstrings cffslotload FTLoadGlyph...

OSV-2018-140 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11074 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short AAT::LookupFormat10 ::sanitize AAT::Lookup ::sanitize...

OSV-2018-138 Heap-buffer-overflow in parse_odp_key_mask_attr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11160 Crash type: Heap-buffer-overflow READ 1 Crash state: parseodpkeymaskattr odpflowfromstring parsekeys...

OSV-2018-134 Heap-buffer-overflow in bloaty::DisassembleFindReferences

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5873 Crash type: Heap-buffer-overflow READ 4 Crash state: bloaty::DisassembleFindReferences bloaty::ReadELFSymbols bloaty::ReadELFSymbols...

OSV-2018-136 Heap-buffer-overflow in fast_validate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10319 Crash type: Heap-buffer-overflow READ 1 Crash state: fastvalidate gutf8validate gvariantserialiserisstring...

OSV-2018-137 Heap-buffer-overflow in set_char_prefix

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10159 Crash type: Heap-buffer-overflow WRITE 1 Crash state: setcharprefix parseincludeddirectories setlongoption...

OSV-2018-131 Use-of-uninitialized-value in json_string_unescape

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11473 Crash type: Use-of-uninitialized-value Crash state: jsonstringunescape ofputiltablefromstring parseofpstr...

OSV-2018-130 Stack-buffer-overflow in parse_tables

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12466 Crash type: Stack-buffer-overflow WRITE 7 Crash state: parsetables processblock douncompressfile...

OSV-2018-129 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11657 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int CFF::Charset12 ::getglyph...

OSV-2018-128 Use-of-uninitialized-value in iclip

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11392 Crash type: Use-of-uninitialized-value Crash state: iclip avgc dav1dreconbinter16bpc...

OSV-2018-126 UNKNOWN READ in BEInt<int, 4>::operator int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10900 Crash type: UNKNOWN READ Crash state: BEInt::operator int AAT::KerxSubTableFormat6::getkerning hbkernmachinet::kern...

OSV-2018-124 UNKNOWN READ in netdev_get

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11314 Crash type: UNKNOWN READ Crash state: netdevget configparsenetdev nextassignment...

OSV-2018-125 Heap-buffer-overflow in read_bits_16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11196 Crash type: Heap-buffer-overflow READ 1 Crash state: readbits16 decodenumber douncompressblock...

OSV-2018-127 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10341 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short OT::Offset, true::isnull OT::OffsetToOT::ArrayOfM1OT::ResourceTypeRecord, OT::IntTypeunsigned short, 2...

OSV-2018-123 Use-of-uninitialized-value in iclip

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11532 Crash type: Use-of-uninitialized-value Crash state: iclip wienerc lrstripe...

OSV-2018-121 Use-of-uninitialized-value in _gnutls_x509_read_pkalgo_params

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10135 Crash type: Use-of-uninitialized-value Crash state: gnutlsx509readpkalgoparams printcrtpubkey printcert...

OSV-2018-122 Use-of-uninitialized-value in gnutls_pkcs12_get_bag

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10136 Crash type: Use-of-uninitialized-value Crash state: gnutlspkcs12getbag gnutlspkcs12simpleparse gnutlspkcs12keyparserfuzzer.c...

OSV-2018-119 UNKNOWN READ in AAT::KerxSubTableFormat1<AAT::KerxSubTableHeader>::driver_context_t::transition

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11367 Crash type: UNKNOWN READ Crash state: AAT::KerxSubTableFormat1::drivercontextt::transition void AAT::StateTableDriver::EntryDat AAT::KerxSubTableFormat1::apply...

OSV-2018-117 Heap-buffer-overflow in Envoy::StringUtil::itoa

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10038 Crash type: Heap-buffer-overflow WRITE 1 Crash state: Envoy::StringUtil::itoa Envoy::Http::HeaderString::setInteger Envoy::TestOneProtoInput...

OSV-2018-115 Global-buffer-overflow in CFF::BlendArg::set_blends

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11691 Crash type: Global-buffer-overflow READ 8 Crash state: CFF::BlendArg::setblends CFF::CFF2CSOpSet::proc CFF::CSInterpreter::int...

OSV-2018-116 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11060 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short AAT::LookupFormat10 ::sanitize AAT::Lookup ::sanitize...

OSV-2018-114 Heap-buffer-overflow in BEInt<unsigned int, 4>::operator unsigned int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10933 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned int OT::OffsetTo , OT::IntTypeunsigned i AAT::KerxSubTableFormat2::getkerning...

OSV-2018-113 Use-of-uninitialized-value in iclip

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11466 Crash type: Use-of-uninitialized-value Crash state: iclip applytorowuv dav1dapplygrain8bpc...

OSV-2018-112 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10356 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short OT::BinSearchHeader::operator unsigned int OT::OffsetTable::findtableindex...

OSV-2018-111 Heap-buffer-overflow in format_generic_odp_key

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10850 Crash type: Heap-buffer-overflow READ 1 Crash state: formatgenericodpkey checkattrlen formatodpkeyattr...

OSV-2018-109 Heap-use-after-free in ssl_get_prev_session

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8241 Crash type: Heap-use-after-free READ 4 Crash state: sslgetprevsession tlsearlypostprocessclienthello tlspostprocessclienthello...

OSV-2018-108 UNKNOWN READ in BEInt<int, 4>::operator int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10898 Crash type: UNKNOWN READ Crash state: BEInt::operator int hbkernmachinet::kern AAT::KerxSubTableFormat6::apply...

OSV-2018-106 Stack-use-after-return in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10082 Crash type: Stack-use-after-return READ 1 Crash state: BEInt::operator unsigned short OT::CoverageFormat2::Iter::more OT::SingleSubstFormat2::closure...

OSV-2018-105 UNKNOWN READ in dotnet_parse_tilde_2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11300 Crash type: UNKNOWN READ Crash state: dotnetparsetilde2 dotnetparsetilde dotnetparsecom...

OSV-2018-104 Heap-buffer-overflow in git__strntol64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11382 Crash type: Heap-buffer-overflow READ 1 Crash state: gitstrntol64 gitstrntol32 parsemode...

OSV-2018-102 Heap-buffer-overflow in r_read_le32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11303 Crash type: Heap-buffer-overflow READ 1 Crash state: rreadle32 rbinfilegetstrings rbinobjectsetitems...

OSV-2018-101 Heap-buffer-overflow in r_bin_mdmp_init_pe_bins

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11361 Crash type: Heap-buffer-overflow READ 8 Crash state: rbinmdmpinitpebins rbinmdmpinit rbinmdmpnewbuf...

OSV-2018-100 Heap-buffer-overflow in cff_parser_run

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10869 Crash type: Heap-buffer-overflow WRITE 1 Crash state: cffparserrun cffsubfontload cfffontload...

OSV-2018-99 Heap-buffer-overflow in git__strntol64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11173 Crash type: Heap-buffer-overflow READ 1 Crash state: gitstrntol64 gitsignatureparse gitcommitparseraw...

OSV-2018-97 Heap-buffer-overflow in CFF::CFF2VariationStore::serialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11713 Crash type: Heap-buffer-overflow READ Crash state: CFF::CFF2VariationStore::serialize writecff2 hbsubsetcff2...

OSV-2018-95 Heap-use-after-free in Envoy::FakeConnectionBase::close

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8783 Crash type: Heap-use-after-free READ 1 Crash state: Envoy::FakeConnectionBase::close Envoy::Event::DispatcherImpl::runPostCallbacks eventprocessactivesinglequeue...

OSV-2018-92 Use-of-uninitialized-value in _gnutls_x509_get_time

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10125 Crash type: Use-of-uninitialized-value Crash state: gnutlsx509gettime gnutlsx509crtgetexpirationtime gnutlscheckcertsanity...

OSV-2018-91 Heap-buffer-overflow in BEInt<unsigned int, 4>::operator unsigned int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10881 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned int OT::kern::hasdata hbotlayouthaskerning...

OSV-2018-89 Heap-use-after-free in TunnelIPv6Interface::remove_address

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10864 Crash type: Heap-use-after-free READ 4 Crash state: TunnelIPv6Interface::removeaddress nl::wpantund::NCPInstanceBase::unicastaddresswasremoved nl::wpantund::NCPInstanceBase::onmeshprefixwasremoved...

OSV-2018-90 Heap-buffer-overflow in wireguard_done

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11279 Crash type: Heap-buffer-overflow READ 8 Crash state: wireguarddone netdevfree netdevunref...

OSV-2018-83 Heap-buffer-overflow in encode_LEARN

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12328 Crash type: Heap-buffer-overflow READ Crash state: encodeLEARN ofpactsputopenflowactions ofputilencodeflowmod...

OSV-2018-85 Heap-buffer-overflow in put_8tap_scaled_c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11378 Crash type: Heap-buffer-overflow READ 2 Crash state: put8tapscaledc put8tapsharpscaledc mc...

OSV-2018-82 Heap-buffer-overflow in OT::LigatureSubstFormat1::closure

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10081 Crash type: Heap-buffer-overflow READ 8 Crash state: OT::LigatureSubstFormat1::closure hbvoidt const OT::hbclosurecontextt::dispatch OT::hbclosurecontextt::returnt OT::LigatureSubst::dispatchOT::hbclosureco...

OSV-2018-79 Use-of-uninitialized-value in g_dbus_message_new_from_blob

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9825 Crash type: Use-of-uninitialized-value Crash state: gdbusmessagenewfromblob fuzzdbusmessage.c gdbusmessagenewfromblob...

OSV-2018-75 Heap-buffer-overflow in ref_oneandzero_unpad

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10628 Crash type: Heap-buffer-overflow READ 1 Crash state: refoneandzerounpad fuzz fuzzers.h...

OSV-2018-74 Heap-use-after-free in yr_re_ast_extract_literal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11753 Crash type: Heap-use-after-free READ 4 Crash state: yrreastextractliteral yrparserwritestring yrparserreducestringdeclaration...

OSV-2018-73 Stack-buffer-overflow in hb_array_t<char const>::cmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11908 Crash type: Stack-buffer-overflow READ 4 Crash state: hbarrayt::cmp OT::post::acceleratort::cmpkey hbbsearchr...

OSV-2018-72 Use-of-uninitialized-value in read_pbkdf2_params

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10143 Crash type: Use-of-uninitialized-value Crash state: readpbkdf2params gnutlsreadpkcsschemaparams pkcs8keydecrypt...