OSV-2020-2108 Stack-buffer-overflow in simdjson::internal::decimal_right_shift

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26773 Crash type: Stack-buffer-overflow READ 1 Crash state: simdjson::internal::decimalrightshift simdjson::internal::adjustedmantissa simdjson::internal::computefloatsimdjson simdjson::internal::adjustedmantissa...

skia:skruntimeeffect: Segv on unknown address in SkSL::Expression::kind

Project: https://skia.googlesource.com/skia.git Detailed Report: https://oss-fuzz.com/testcase?key=5118234535395328 Project: skia Fuzzing Engine: libFuzzer Fuzz Target: skruntimeeffect Job Type: libfuzzerasanskia Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State:...

OSV-2020-2107 Heap-buffer-overflow in WelsDec::ParseIntra4x4Mode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26723 Crash type: Heap-buffer-overflow WRITE 1 Crash state: WelsDec::ParseIntra4x4Mode WelsDec::WelsActualDecodeMbCavlcISlice WelsDec::WelsDecodeMbCavlcISlice...

OSV-2020-2106 UNKNOWN READ in grk::SparseBuffer<6u, 6u>::read_or_write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26702 Crash type: UNKNOWN READ Crash state: grk::SparseBuffer::readorwrite grk::SparseBuffer::read bool grk::decompresspartialtile...

llvm:clang-fuzzer: Global-buffer-overflow in ProcessCharEscape

Detailed Report: https://oss-fuzz.com/testcase?key=5730186039132160 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: clang-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: Global-buffer-overflow READ 4 Crash Address: 0x00000ccfc3dc Crash State: ProcessCharEscape...

cras:rclient_message: Heap-buffer-overflow in ccr_handle_message_from_client

Detailed Report: https://oss-fuzz.com/testcase?key=5711735765598208 Project: cras Fuzzing Engine: libFuzzer Fuzz Target: rclientmessage Job Type: libfuzzerasancras Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x629000004208 Crash State: ccrhandlemessagefromclient...

llvm:clang-objc-fuzzer: Global-buffer-overflow in clang::Lexer::tryReadUCN

Detailed Report: https://oss-fuzz.com/testcase?key=5120846479491072 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: clang-objc-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: Global-buffer-overflow READ 4 Crash Address: 0x00000ccf823c Crash State: clang::Lexer::tryReadUCN...

OSV-2020-2103 Use-of-uninitialized-value in tinfl_decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26682 Crash type: Use-of-uninitialized-value Crash state: tinfldecompress mzinflate mzuncompress2...

OSV-2020-2101 Heap-buffer-overflow in lduw_he_p

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26691 Crash type: Heap-buffer-overflow READ 2 Crash state: lduwhep ldnhep flatviewwritecontinue...

libreoffice:htmlfuzzer: Heap-use-after-free in SfxItemSet::Count

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=5699610401832960 Project: libreoffice Fuzzing Engine: honggfuzz Fuzz Target: htmlfuzzer Job Type: honggfuzzasanlibreoffice Platform Id: linux Crash Type: Heap-use-after-free READ 2 Crash...

grok:grk_decompress_fuzzer: Crash in grk::SparseBuffer<6u, 6u>::read_or_write

Detailed Report: https://oss-fuzz.com/testcase?key=6267600499376128 Project: grok Fuzzing Engine: afl Fuzz Target: grkdecompressfuzzer Job Type: aflasangrok Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000003c2c Crash State: grk::SparseBuffer::readorwrite grk::SparseBuffer::rea...

skia:sksl2metal: Use-of-uninitialized-value in std::__1::default_delete<SkSL::Symbol const>::operator

Project: https://skia.googlesource.com/skia.git Detailed Report: https://oss-fuzz.com/testcase?key=5139847045709824 Project: skia Fuzzing Engine: libFuzzer Fuzz Target: sksl2metal Job Type: libfuzzermsanskia Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

mupdf:pdf_fuzzer: Crash in template_affine_N_near_fb0

Project: git://git.ghostscript.com/mupdf.git Detailed Report: https://oss-fuzz.com/testcase?key=4867473373134848 Project: mupdf Fuzzing Engine: honggfuzz Fuzz Target: pdffuzzer Job Type: honggfuzzasanmupdf Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7ff23addb19e Crash State:...

qemu:qemu-fuzz-i386-target-generic-fuzz-xhci: Index-out-of-bounds in xhci_runtime_write

Detailed Report: https://oss-fuzz.com/testcase?key=5747786781556736 Project: qemu Fuzzing Engine: libFuzzer Fuzz Target: qemu-fuzz-i386-target-generic-fuzz-xhci Job Type: libfuzzerubsanqemu Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State: xhciruntimewrite...

qemu:qemu-fuzz-i386-target-generic-fuzz-pc-q35: Heap-buffer-overflow in lduw_he_p

Detailed Report: https://oss-fuzz.com/testcase?key=5734439902248960 Project: qemu Fuzzing Engine: libFuzzer Fuzz Target: qemu-fuzz-i386-target-generic-fuzz-pc-q35 Job Type: libfuzzerasanqemu Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x6030000e1f82 Crash State:...

binutils:fuzz_bfd: Heap-buffer-overflow in _bfd_vms_save_sized_string

Detailed Report: https://oss-fuzz.com/testcase?key=5191938237792256 Project: binutils Fuzzing Engine: honggfuzz Fuzz Target: fuzzbfd Job Type: honggfuzzasanbinutils Platform Id: linux Crash Type: Heap-buffer-overflow READ 12 Crash Address: 0x615000000280 Crash State: bfdvmssavesizedstring...

OSV-2020-2098 Use-of-uninitialized-value in std::__1::__function::__func<LLVMFuzzerTestOneInput::$_0, std::__1::allocator<LL

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26617 Crash type: Use-of-uninitialized-value Crash state: std::1::function::funcLLVMFuzzerTestOneInput::$0, std::1::allocatorLL functional std::1::function::funcLLVMFuzzerTestOneInput::$0, std::1::allocatorLL...

libreoffice:htmlfuzzer: Bad-cast to SwFormat from SwClient in SwHTMLParser::SetAttr_

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=5205016312545280 Project: libreoffice Fuzzing Engine: libFuzzer Fuzz Target: htmlfuzzer Job Type: libfuzzerubsanlibreoffice Platform Id: linux Crash Type: Bad-cast Crash Address:...

OSV-2020-2095 Heap-buffer-overflow in grk::Subband::Subband

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26589 Crash type: Heap-buffer-overflow READ 1 Crash state: grk::Subband::Subband grk::TileComponent::subbandIntersectsAOI grk::T2Decompress::decompresspackets...

OSV-2020-2094 Heap-buffer-overflow in flb_utils_time_to_seconds

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26593 Crash type: Heap-buffer-overflow READ 1 Crash state: flbutilstimetoseconds utilsfuzzer.c...