OSV-2020-1385 Segv on unknown address in clang::Parser::TryAnnotateCXXScopeToken

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21077 Crash type: Segv on unknown address Crash state: clang::Parser::TryAnnotateCXXScopeToken clang::Parser::TryParsePtrOperatorSeq clang::Parser::TryParseDeclarator...

OSV-2020-1378 Segv on unknown address in clang::Expr::EvaluateKnownConstInt

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20256 Crash type: Segv on unknown address Crash state: clang::Expr::EvaluateKnownConstInt clang::FieldDecl::getBitWidthValue clang::FieldDecl::isZeroLengthBitField...

OSV-2020-1367 Use-of-uninitialized-value in void intra_prediction_angular<unsigned char>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23615 Crash type: Use-of-uninitialized-value Crash state: void intrapredictionangular void decodeintrapredictioninternal decodeintraprediction...

OSV-2020-1369 Segv on unknown address in clang::Expr::skipRValueSubobjectAdjustments

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23669 Crash type: Segv on unknown address Crash state: clang::Expr::skipRValueSubobjectAdjustments visitLocalsRetainedByInitializer clang::Sema::checkInitializerLifetime...

OSV-2020-1368 Segv on unknown address in clang::LookupResult::sanity

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19683 Crash type: Segv on unknown address Crash state: clang::LookupResult::sanity clang::Sema::HandleDeclarator clang::Sema::ActOnDeclarator...

OSV-2020-1340 Use-of-uninitialized-value in Gfx::fillPatch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15395 Crash type: Use-of-uninitialized-value Crash state: Gfx::fillPatch Gfx::doPatchMeshShFill Gfx::doShadingPatternFill...

OSV-2020-1328 UNKNOWN READ in std::__1::__tree<std::__1::__value_type<std::__1::basic_string<char, std::__1::c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23566 Crash type: UNKNOWN READ Crash state: std::1::tree, std::1...

OSV-2020-1319 Use-of-uninitialized-value in Interpreter::evaluate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15843 Crash type: Use-of-uninitialized-value Crash state: Interpreter::evaluate jsonnetvmexecute jsonnetevaluatesnippetaux...

OSV-2020-1311 Use-of-uninitialized-value in Sass::Prelexer::quoted_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Use-of-uninitialized-value Crash state: Sass::Prelexer::quotedstring Sass::Prelexer::staticcomponent char const Sass::Prelexer::zeroplus&...

OSV-2020-1299 UNKNOWN WRITE in ideint_weave_blk

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17084 Crash type: UNKNOWN WRITE Crash state: ideintweaveblk ideintprocess impeg2ddeinterlace...

OSV-2020-1298 Heap-buffer-overflow in char const* Sass::Prelexer::alternatives<&

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Heap-buffer-overflow READ 1 Crash state: char const Sass::Prelexer::alternatives& char const Sass::Prelexer::alternatives& char const Sass::Prelexer::sequence&...

OSV-2020-1291 UNKNOWN READ in std::__1::_MetaBase<__can_be_converted_to_string_view<char, std::__1::char_trait

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23429 Crash type: UNKNOWN READ Crash state: std::1::MetaBase, std::1::allocator std::1::treeiteratorstd::1::valuetypestd::1::basicstringchar, st...

OSV-2020-1260 Negative-size-param in heif::HeifPixelImage::fill_RGB_16bit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13563 Crash type: Negative-size-param Crash state: heif::HeifPixelImage::fillRGB16bit heif::HeifContext::decodeoverlayimage heif::HeifContext::decodeimage...

OSV-2020-1253 Heap-buffer-overflow in pixReadFromTiffStream

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21435 Crash type: Heap-buffer-overflow WRITE 1 Crash state: pixReadFromTiffStream pixReadMemTiff pixReadMem...

OSV-2020-1206 Use-of-uninitialized-value in Sass::Prelexer::quoted_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Use-of-uninitialized-value Crash state: Sass::Prelexer::quotedstring char const Sass::Prelexer::nongreedy& Sass::Parser::lookaheadforvalue...

OSV-2020-1108 Heap-buffer-overflow in Sass::Prelexer::quoted_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Heap-buffer-overflow READ 1 Crash state: Sass::Prelexer::quotedstring char const Sass::Prelexer::alternatives& Sass::Prelexer::cssvariabletoplevelvalue...

OSV-2020-1101 Heap-buffer-overflow in Sass::Prelexer::quoted_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Heap-buffer-overflow READ 1 Crash state: Sass::Prelexer::quotedstring char const Sass::Parser::lex& Sass::Parser::parsevalue...

OSV-2020-1037 Heap-buffer-overflow in Sass::Prelexer::quoted_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Heap-buffer-overflow READ 1 Crash state: Sass::Prelexer::quotedstring char const Sass::Prelexer::sequence& char const Sass::Prelexer::alternatives&...

OSV-2020-1023 Use-of-uninitialized-value in njs_vsprintf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23061 Crash type: Use-of-uninitialized-value Crash state: njsvsprintf njserrorfmtnew njsregexpmatchtracehandler...

OSV-2020-1006 Use-of-uninitialized-value in decimate_dsd_run

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19928 Crash type: Use-of-uninitialized-value Crash state: decimatedsdrun WavpackUnpackSamples WavpackSeekSample64...