OSV-2020-1877 Use-of-uninitialized-value in FAPI_FF_get_glyph

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23115 Crash type: Use-of-uninitialized-value Crash state: FAPIFFgetglyph getfapiglyphdata loadtruetypeglyph...

OSV-2020-1876 UNKNOWN READ in mem_mapped4_fill_rectangle

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22007 Crash type: UNKNOWN READ Crash state: memmapped4fillrectangle gxdcpurefillrectangle gxdefaultfillpage...

OSV-2020-1875 Heap-use-after-free in dict_find_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20652 Crash type: Heap-use-after-free READ 8 Crash state: dictfindstring gsmaintempnames gsmainfinit...

OSV-2020-1874 Use-of-uninitialized-value in load_truetype_glyph

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22182 Crash type: Use-of-uninitialized-value Crash state: loadtruetypeglyph TTLoadGlyph ttglyphload...

OSV-2020-1872 Use-of-uninitialized-value in s_exD_process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21643 Crash type: Use-of-uninitialized-value Crash state: sexDprocess sreadbuf sgets...

OSV-2020-1873 Use-of-uninitialized-value in zcheck_r6_password

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23440 Crash type: Use-of-uninitialized-value Crash state: zcheckr6password interp gscallinterp...

OSV-2020-1870 Use-of-uninitialized-value in get_fapi_glyph_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22752 Crash type: Use-of-uninitialized-value Crash state: getfapiglyphdata loadtruetypeglyph TTLoadGlyph...

OSV-2020-1864 Heap-use-after-free in grk::TileProcessor::~TileProcessor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26008 Crash type: Heap-use-after-free READ 8 Crash state: grk::TileProcessor::TileProcessor grk::CodeStream::decompresstiles grk::CodeStream::dodecompress...

OSV-2020-1863 Bad-cast to pcpp::Layer from invalid vptr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26013 Crash type: Bad-cast Crash state: Bad-cast to pcpp::Layer from invalid vptr pcpp::IDnsResource::getRawData pcpp::DnsResource::getDataLength...

OSV-2020-1860 Stack-buffer-overflow in sc_get_response

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25998 Crash type: Stack-buffer-overflow WRITE Crash state: scgetresponse sctransmit sctransmitapdu...

libxml2:xml: Heap-use-after-free in xmlStaticCopyNode

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed Report: https://oss-fuzz.com/testcase?key=6039216293937152 Project: libxml2 Fuzzing Engine: honggfuzz Fuzz Target: xml Job Type: honggfuzzasanlibxml2 Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x60c00000220...

pcapplusplus:FuzzTarget: Bad-cast to pcpp::Layer from invalid vptr in pcpp::IDnsResource::getRawData

Project: https://github.com/seladb/PcapPlusPlus.git Detailed Report: https://oss-fuzz.com/testcase?key=5207250026889216 Project: pcapplusplus Fuzzing Engine: libFuzzer Fuzz Target: FuzzTarget Job Type: libfuzzerubsanpcapplusplus Platform Id: linux Crash Type: Bad-cast Crash Address: 0x00000179002...

c-ares:ares_parse_reply_fuzzer: Use-of-uninitialized-value in ares_parse_caa_reply

Project: https://github.com/c-ares/c-ares.git Detailed Report: https://oss-fuzz.com/testcase?key=5149417215361024 Project: c-ares Fuzzing Engine: libFuzzer Fuzz Target: aresparsereplyfuzzer Job Type: libfuzzermsanc-ares Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Cras...

grok:grk_decompress_fuzzer: Heap-use-after-free in grk::TileProcessor::~TileProcessor

Detailed Report: https://oss-fuzz.com/testcase?key=5629659654651904 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzerasangrok Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x60d000000390 Crash State:...

OSV-2020-1857 Heap-buffer-overflow in WelsDec::WelsDecodeMbCabacPSlice

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25973 Crash type: Heap-buffer-overflow WRITE 16 Crash state: WelsDec::WelsDecodeMbCabacPSlice WelsDec::WelsDecodeSlice WelsDec::DecodeCurrentAccessUnit...

OSV-2020-1855 Heap-buffer-overflow in WelsDec::UpdateP16x16MotionInfo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25961 Crash type: Heap-buffer-overflow WRITE 4 Crash state: WelsDec::UpdateP16x16MotionInfo WelsDec::ParseInterPMotionInfoCabac WelsDec::WelsDecodeMbCabacPSliceBaseMode0...

OSV-2020-1854 Use-of-uninitialized-value in UpdateDecStatNoFreezingInfo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25970 Crash type: Use-of-uninitialized-value Crash state: UpdateDecStatNoFreezingInfo UpdateDecStat WelsDec::DecodeFrameConstruction...

libreoffice:sftfuzzer: Crash in GetUShort

Detailed Report: https://oss-fuzz.com/testcase?key=5679219483607040 Project: libreoffice Fuzzing Engine: afl Fuzz Target: sftfuzzer Job Type: aflasanlibreoffice Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x6140000104e9 Crash State: GetUShort ParseCMAP...

openh264:decoder_fuzzer: Heap-buffer-overflow in WelsDec::WelsDecodeMbCabacPSlice

Project: https://github.com/cisco/openh264.git Detailed Report: https://oss-fuzz.com/testcase?key=5730626752479232 Project: openh264 Fuzzing Engine: afl Fuzz Target: decoderfuzzer Job Type: aflasanopenh264 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 16 Crash Address: 0x61800000379b...

OSV-2020-1853 Heap-buffer-overflow in WelsDec::DoErrorConSliceCopy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25932 Crash type: Heap-buffer-overflow READ 1 Crash state: WelsDec::DoErrorConSliceCopy WelsDec::ImplementErrorCon WelsDec::CheckAndFinishLastPic...