OSV-2020-1644 Segv on unknown address in clang::Sema::PushDeclContext

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25059 Crash type: Segv on unknown address Crash state: clang::Sema::PushDeclContext clang::Sema::ActOnStartDelayedMemberDeclarations clang::Parser::ParseLexedPragmas...

OSV-2020-1606 UNKNOWN READ in hb_set_digest_lowest_bits_t<unsigned long, 4u>::may_have

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24842 Crash type: UNKNOWN READ Crash state: hbsetdigestlowestbitst::mayhave hbsetdigestcombinert, hbset OT::hbotlayoutlookupacceleratort::mayhave...

OSV-2020-1599 Use-of-uninitialized-value in slide_hash

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24820 Crash type: Use-of-uninitialized-value Crash state: slidehash fillwindow deflatefast...

OSV-2020-1583 Segv on unknown address in clang::Preprocessor::LexHeaderName

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24668 Crash type: Segv on unknown address Crash state: clang::Preprocessor::LexHeaderName clang::Preprocessor::HandleIncludeDirective clang::Preprocessor::HandleDirective...

OSV-2020-1550 UNKNOWN WRITE in hb_vector_t<CFF::dict_val_t>::resize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24489 Crash type: UNKNOWN WRITE Crash state: hbvectort::resize hbvectort::push CFF::dictvalt hbvectort::push...

OSV-2020-1541 UNKNOWN READ in eval_expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22919 Crash type: UNKNOWN READ Crash state: evalexpr pathxeval pathxsymtabdefine...

OSV-2020-1540 UNKNOWN READ in eval_expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23781 Crash type: UNKNOWN READ Crash state: evalexpr evalbinary evalexpr...

OSV-2020-1538 Use-of-uninitialized-value in cmsMLUgetASCII

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19724 Crash type: Use-of-uninitialized-value Crash state: cmsMLUgetASCII cmsGetProfileInfoASCII GetICCProperty...

OSV-2020-1536 Segv on unknown address in GetValueFromLinkedList

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20923 Crash type: Segv on unknown address Crash state: GetValueFromLinkedList Magick::throwException Magick::Image::read...

OSV-2020-1534 Use-of-uninitialized-value in void transform_idct_add<unsigned short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23918 Crash type: Use-of-uninitialized-value Crash state: void transformidctadd transform8x8add16fallback void accelerationfunctions::transformadd...

OSV-2020-1532 Heap-buffer-overflow in Op_RGB_to_RGB24_32::convert_colorspace

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22109 Crash type: Heap-buffer-overflow READ 1 Crash state: OpRGBtoRGB2432::convertcolorspace heif::ColorConversionPipeline::convertimage heif::convertcolorspace...

OSV-2020-1527 Use-of-uninitialized-value in ConstantString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21159 Crash type: Use-of-uninitialized-value Crash state: ConstantString SetImageProperty TIFFGetProperties...

OSV-2020-1523 UNKNOWN READ in Mat_H5ReadFieldNames

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23456 Crash type: UNKNOWN READ Crash state: MatH5ReadFieldNames MatH5ReadGroupInfo MatVarReadNextInfoIterate...

OSV-2020-1522 Segv on unknown address in clang::Sema::EnterDeclaratorContext

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20232 Crash type: Segv on unknown address Crash state: clang::Sema::EnterDeclaratorContext clang::Sema::ActOnCXXEnterDeclaratorScope clang::Parser::ParseDirectDeclarator...

OSV-2020-1520 Use-of-uninitialized-value in transform_4x4_luma_add_8_fallback

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23288 Crash type: Use-of-uninitialized-value Crash state: transform4x4lumaadd8fallback void accelerationfunctions::transform4x4dstadd void transformcoefficients...

OSV-2020-1516 Use-of-uninitialized-value in ScaleQuantumToChar

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22583 Crash type: Use-of-uninitialized-value Crash state: ScaleQuantumToChar LosslessReduceDepthOK ReadOneMNGImage...

OSV-2020-1505 Heap-buffer-overflow in yr_object_set_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6402 Crash type: Heap-buffer-overflow READ 16 Crash state: yrobjectsetstring dexparse dexload...

OSV-2020-1503 Use-of-uninitialized-value in clip

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22181 Crash type: Use-of-uninitialized-value Crash state: clip OpYCbCr420toRGB8bit::convertcolorspace heif::ColorConversionPipeline::convertimage...

OSV-2020-1504 Segv on unknown address in clang::Sema::ActOnMethodDeclaration

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19620 Crash type: Segv on unknown address Crash state: clang::Sema::ActOnMethodDeclaration clang::Parser::ParseObjCMethodDecl clang::Parser::ParseObjCMethodDefinition...

OSV-2020-1502 Use-of-uninitialized-value in void add_residual_fallback<unsigned short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22810 Crash type: Use-of-uninitialized-value Crash state: void addresidualfallback void accelerationfunctions::addresidual void scalecoefficientsinternal...