One of the two issues was interestingly found using Clang fuzzing capabilities. This is in-process fuzzing, that Clang libFuzzer makes quite easy:

http://blog.llvm.org/2015/04/fuzz-all-clangs.html

http://llvm.org/docs/LibFuzzer.html