Cool-Tomato

An issue was discovered in LibOFX. There is a NULL pointer dereference in the function `OFXApplication::startElement` in the file `lib/ofx sgml.cpp`, as demonstrated by `ofxdump`.

An issue was discovered in the MAT File I/O Library, where a stack-based buffer over-read occurs in the `InflateDimensions()` function in `inflate.c` when called from `ReadNextCell` in `mat5.c`.

An issue was discovered in the MAT File I/O Library, where there is an out-of-bounds read that results in a SEGV in the `Mat VarReadNextInfo5()` function.

An issue was discovered in the MAT File I/O Library, specifically a stack-based buffer over-read in the `Mat VarReadNextInfo5()` function in mat5.c.

An issue was discovered in the MAT File I/O Library, where there is a NULL pointer dereference in the `Mat VarFree()` function in mat.c.

An issue was discovered in the MAT File I/O Library, specifically in the libmatio.a component. The problem is an out-of-bounds write that causes a segmentation fault (SEGV) in the `Mat VarFree()` function, located in mat.c.

An issue was discovered in the MAT File I/O Library, where a stack-based buffer over-read occurs for the "Rank and Dimension" feature in the function ReadNextCell() in mat5.c.

An issue was discovered in the MAT File I/O Library, where a stack-based buffer over-read occurs for a memcpy in the `ReadNextCell()` function in mat5.c.

An issue was discovered in the MAT File I/O Library, where a stack-based buffer over-read occurs in the `ReadNextStructField()` function in mat5.c.

A heap-based buffer overflow issue was found in the `ReadNextFunctionHandle()` function in mat5.c.

A buffer over-read issue was discovered in the `Mat VarPrint()` function in mat.c.

An issue was discovered in the MAT File I/O Library, specifically in the libmatio.a component. The problem is an out-of-bounds read that results in a segmentation fault (SEGV) in the `ReadNextCell()` function, located in the mat5.c file.

A heap-based buffer overflow issue exists in the InflateVarName() function, located in inflate.c, which is called from ReadNextCell in mat5.c. This issue can be exploited when processing certain input.

A heap-based buffer overflow issue exists in the function ReadNextCell() in mat5.c.

An issue was discovered in the function ` cairo arc in direction` in the file `cairo-arc.c`, which is related to an assertion problem.

The issue is related to an infinite loop in the `sixel decode raw impl()` function, located in the fromsixel.c file. This has been demonstrated using sixel2png.

The issue is related to a heap-based buffer over-read in the `load jpeg()` function, located in the `loader.c` file. This can be demonstrated by using `img2sixel`.

An issue was discovered in the `writePNG` function within the `dbl2png` command-line program, specifically in the file `util/dbl2png.c`. This issue involves a heap-based buffer over-read. Due to an erroneous call to `png write row` in `libpng`, there is a potential for an out-of-bounds write to occur under certain memory layouts.

The issue is a heap-based buffer over-read in the `put pixel rows` function, located in the wrbmp.c file. This has been demonstrated using the djpeg tool.

The issue is related to an infinite loop in the Exiv2::Image::printIFDStructure function, which can be triggered by a crafted input. This can lead to a remote denial of service attack.