Nils Bars

Null pointer is dereference if 'noautoscale' option is used on an empty plot

You are right, this is already fixed in commit e9be99fb.

Calling tm_min with a high number cause an out-of-bounds read in ggmtime.

You need to compile gnuplot with ASAN enabled. I updated the reproduction steps. I dont know why this is working without defining x, but it does. Just execute gnuplot (with ASAN enabled) with the provided payload.

Calling tm_min with a high number cause an out-of-bounds read in ggmtime.

Out-of-bounds read in strlen_tex()

Buffer overflow in setfont of pngcairo terminal

Out-of-bounds read in the 'set font' option of the pcl5 terminal