OSV-2020-1991 Use-of-uninitialized-value in RenderMVGContent

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26148 Crash type: Use-of-uninitialized-value Crash state: RenderMVGContent DrawImage ReadMVGImage...

OSV-2020-1851 Stack-buffer-underflow in fmt::v6::basic_format_args<fmt::v6::basic_format_context<std::__1::back_insert_i

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21794 Crash type: Stack-buffer-underflow READ 16 Crash state: fmt::v6::basicformatargsfmt::v6::basicformatcontextstd::1::backinserti fmt::v6::basicformatargsfmt::v6::basicformatcontextstd::1::backinserti...

OSV-2020-1784 Use-of-uninitialized-value in put_unweighted_pred_16_fallback

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25707 Crash type: Use-of-uninitialized-value Crash state: putunweightedpred16fallback accelerationfunctions::putunweightedpred generateinterpredictionsamples...

OSV-2020-1759 Index-out-of-bounds in LibRaw::ahd_interpolate_r_and_b_in_rgb_and_convert_to_cielab

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25652 Crash type: Index-out-of-bounds Crash state: LibRaw::ahdinterpolaterandbinrgbandconverttocielab LibRaw::ahdinterpolaterandbandconverttocielab LibRaw::ahdinterpolate...

OSV-2020-1647 UNKNOWN READ in aiTexture::~aiTexture

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25108 Crash type: UNKNOWN READ Crash state: aiTexture::aiTexture Assimp::MDLImporter::SkipSkinLump3DGSMDL7 Assimp::HMPImporter::ReadFirstSkin...

OSV-2020-1613 Segv on unknown address in std::__1::deque<std::__1::deque<boost::variant<libetonyek::MoveTo, libetonyek::L

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24858 Crash type: Segv on unknown address Crash state: std::1::dequestd::1::dequeboost::variantlibetonyek::MoveTo, libetonyek::L libetonyek::IWORKPath::appendCCurveTo libetonyek::IWAParser::parsePath...

OSV-2020-1590 Heap-buffer-overflow in ft_smooth_overlap_spans

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24726 Crash type: Heap-buffer-overflow READ 1 Crash state: ftsmoothoverlapspans graysweep grayconvertglyph...

OSV-2020-1589 UNKNOWN READ in RegisterSetjmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24695 Crash type: UNKNOWN READ Crash state: RegisterSetjmp wasmtimeruntime::traphandlers::CallThreadState::with::hada2d3d104ef56de wasmtime::func::invokewasmandcatchtraps::h25a8cbd9f03c9a30...

OSV-2020-1572 UNKNOWN WRITE in sarrayAddString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24617 Crash type: UNKNOWN WRITE Crash state: sarrayAddString gplotAddPlot numaQuantizeCrossingsByWidth...

OSV-2020-1531 Segv on unknown address in clang::Sema::PerformImplicitConversion

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19621 Crash type: Segv on unknown address Crash state: clang::Sema::PerformImplicitConversion clang::Sema::PerformImplicitConversion clang::Sema::PerformContextuallyConvertToBool...

OSV-2020-1529 Use-of-uninitialized-value in CorrectPSDAlphaBlend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13836 Crash type: Use-of-uninitialized-value Crash state: CorrectPSDAlphaBlend ReadPSDMergedImage ReadPSDImage...

OSV-2020-1528 Use-of-uninitialized-value in PushColormapIndex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10379 Crash type: Use-of-uninitialized-value Crash state: PushColormapIndex SyncImage WriteOnePNGImage...

OSV-2020-1513 Segv on unknown address in bool EvaluateComparisonBinaryOperator<IntExprEvaluator::VisitBinaryOperator

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23836 Crash type: Segv on unknown address Crash state: bool EvaluateComparisonBinaryOperator::Visit...

OSV-2020-1503 Use-of-uninitialized-value in clip

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22181 Crash type: Use-of-uninitialized-value Crash state: clip OpYCbCr420toRGB8bit::convertcolorspace heif::ColorConversionPipeline::convertimage...

OSV-2020-1486 Bad-cast to Sass::PreValue from Sass::Unary_Expression

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15896 Crash type: Bad-cast Crash state: Bad-cast to Sass::PreValue from Sass::UnaryExpression Sass::SharedImpl::SharedImpl Sass::Parser::parsevalueschema...

OSV-2020-1479 Segv on unknown address in clang::Preprocessor::AnnotatePreviousCachedTokens

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19064 Crash type: Segv on unknown address Crash state: clang::Preprocessor::AnnotatePreviousCachedTokens clang::Parser::TryAnnotateTypeOrScopeTokenAfterScopeSpec clang::Parser::TryAnnotateTypeOrScopeToken...

OSV-2020-1470 Segv on unknown address in clang::Sema::getCurBlock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19622 Crash type: Segv on unknown address Crash state: clang::Sema::getCurBlock clang::Sema::makeTypoCorrectionConsumer clang::Sema::CorrectTypoDelayed...

OSV-2020-1466 Segv on unknown address in clang::Sema::PushDeclContext

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19062 Crash type: Segv on unknown address Crash state: clang::Sema::PushDeclContext clang::Sema::ActOnStartOfObjCMethodDef clang::Parser::ParseLexedObjCMethodDefs...

OSV-2020-1463 Segv on unknown address in llvm::detail::IEEEFloat::roundSignificandWithExponent

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19171 Crash type: Segv on unknown address Crash state: llvm::detail::IEEEFloat::roundSignificandWithExponent llvm::detail::IEEEFloat::convertFromDecimalString llvm::detail::IEEEFloat::convertFromString...

OSV-2020-1446 Segv on unknown address in clang::Sema::CreateOverloadedBinOp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19567 Crash type: Segv on unknown address Crash state: clang::Sema::CreateOverloadedBinOp BuildOverloadedBinOp clang::Sema::BuildBinOp...