FreeType later changed SHZ, the instruction that moves points in a glyph. It now picks the right set of points and stops at the end of that set. The two cards show the code. This fix came after 2.14.3. github.com/freetype/freetype…

The change is easy to miss. In 2.14.2, FreeType made room for the glyph's existing points, plus four more. In 2.14.3, it only made room for four. That wasn't enough for some glyphs made from other glyphs. github.com/freetype/freetype…

Before the fix, PackedImage::Create() allocated after unchecked size arithmetic. The decoder’s output callback then wrote beyond that buffer. The patch calls VerifyDimensions() first and rejects wrapped stride or total size. The card shows the actual code change.

Now the filter. On 9.0.1, firequalizer=delay=30000 overflows the FIR-length calculation under UBSan. 9.0.2 rejects that value. But a later signed multiplication, nsamples_max * 2, is still there. Patch: github.com/FFmpeg/FFmpeg/com…

In the Ogg demuxer, buf_realloc() doubled an unsigned buffer size without checking the limit first. Near UINT_MAX/2, that can wrap. On 9.0.1, our raised-limit run hit an ASan invalid write (WRITE of size 31895). On 9.0.2, it returns ENOMEM. Patch: github.com/FFmpeg/FFmpeg/com…

The patch moves i++ into the inner sample loop and bounds the sample read with i < width. The PRE/POST card focuses on the counter change; the complete patch also adds a bit-depth guard.

The DDS reader copied a file-derived pixel width into a 4-byte uint32_t. The patch caps memcpy at sizeof(pixel), then continues extracting the color channels. The destination's capacity now bounds the copy.

The 7.7 patch measures the username and suffix before encoding. If their sum exceeds MAX_LOGIN_SZ, Squid rejects the credentials. The card shows the new guard in the peer-login branch; the buffer declaration and encoder sit just outside this excerpt.

On Unix, file_put_contents() could create zbx_config_cache as 0644 with umask 022. In 7.0.30, tempnam() creates a 0600 file, writes the JSON, and rename() replaces the cache path. The card shows the actual diff.

The fix treats a zero remainder as a full 8 KiB block. The existing size check then rejects the empty block before ID properties are returned. Exact code: github.com/ip7z/7zip/blob/26…

Another fix: an ONNX tensor could declare a shape larger than its payload. getMatFromTensor() built a Mat from that declared shape over the payload, without checking the two matched. We published a 96-byte PoC for it. Result: a heap out-of-bounds read. No CVE.