Activity for Frederic Cambus
-
Frederic Cambus posted a comment on ticket #10
This issue has been assigned CVE-2019-19787.
-
This issue has been assigned CVE-2019-19786.
-
This issue has been assigned CVE-2019-19785.
-
This issue has been assigned CVE-2019-19797.
-
Out-of-bounds write in the read_colordef() function
-
Stack-based buffer overflow in the get_signed_expression() function
-
Stack-based buffer overflow in the parse_expr() function
-
Stack-based buffer overflow in the to_comma() function
-
Indeed, on Linux the bug is only triggered when sanitizers are enabled. On OpenBSD however, it crashes with a normal build: $ fig2dev -Lbox test02 Bus error (core dumped) I can confirm that your patch fixes the issue with this test file, thanks!
-
This issue got assigned CVE-2019-19555.
-
Stack-based buffer overflow in the read_textobject() function
-
This issue has been assigned CVE-2019-16396.
-
This issue has been assigned CVE-2019-16395.
-
Use-after-free (heap) in the end_scope_of_program_name() function
-
Stack-based buffer overflow in the cb_name() function
-
This issue has been assigned CVE-2019-14665.
-
This issue has been assigned CVE-2019-14662.
-
This issue has been assigned CVE-2019-14663.
-
Heap-based buffer overflow in the define_array() function
-
Stack-based buffer overflow in the fileio_openout() function
-
Stack-based buffer overflow in the fileio_openin() function
-
This issue has been assigned CVE-2019-14541.
-
Stack-based buffer overflow in the cb_encode_program_id() function
-
This issue has been assigned CVE-2019-14528.
-
Heap-based buffer overflow in the read_literal() function
-
For all issues I reported, the fuzzer ran against latest trunk version, and I verified the issues are also triggered in 2.2. The CVE reports mention 2.2 as it's the latest released version.
-
This issue got assigned CVE-2019-14486.
-
Global buffer overflow in the cb_evaluate_expr() function
-
This issue got assigned CVE-2019-14468.
-
Global buffer overflow in the cb_push_op() function
-
This issue got assigned CVE-2019-14275.
-
The first issue (L2514) got assigned CVE-2019-14274.
-
The first issue (L2514) got assigned CVE-2019-14274.
-
Stack-based Buffer Overflow in the calc_arrow() function
-
So, ASan calls both issues overflows, but only the first issue (L2514) is technically an actual buffer-overflow, the second issue (L2466) is actually an out-of-bounds read.
-
Multiple Heap-based Buffer Overflow in the do_msg() function
-
Heap-based Buffer Overflow in the parse_line() function
-
Attached the wrong file, here is the reproducer.
-
Heap-based Buffer Overflow in the get_line() function
-
Allow building on OpenBSD
-
Fixing compilation errors on NetBSD
1
