OSV-2020-1264 Use-of-uninitialized-value in AnnotAppearanceBuilder::drawText

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17607 Crash type: Use-of-uninitialized-value Crash state: AnnotAppearanceBuilder::drawText AnnotAppearanceBuilder::drawFormFieldChoice AnnotAppearanceBuilder::drawFormField...

OSV-2020-1266 UNKNOWN READ in arrow::Array::IsNull

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20139 Crash type: UNKNOWN READ Crash state: arrow::Array::IsNull arrow::Status arrow::VisitArrayInline arrow::internal::ValidateArrayData...

OSV-2020-1260 Negative-size-param in heif::HeifPixelImage::fill_RGB_16bit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13563 Crash type: Negative-size-param Crash state: heif::HeifPixelImage::fillRGB16bit heif::HeifContext::decodeoverlayimage heif::HeifContext::decodeimage...

OSV-2020-1250 Heap-use-after-free in WelsDec::MapColToList0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13185 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::MapColToList0 WelsDec::ParseInterBMotionInfoCabac WelsDec::WelsDecodeMbCabacBSliceBaseMode0...

OSV-2020-1253 Heap-buffer-overflow in pixReadFromTiffStream

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21435 Crash type: Heap-buffer-overflow WRITE 1 Crash state: pixReadFromTiffStream pixReadMemTiff pixReadMem...

OSV-2020-1258 Heap-use-after-free in WelsDec::MapColToList0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13457 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::MapColToList0 WelsDec::PredBDirectTemporal WelsDec::ParseInterBMotionInfoCabac...

OSV-2020-1256 UNKNOWN WRITE in TIFFReadRGBATileExt

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14185 Crash type: UNKNOWN WRITE Crash state: TIFFReadRGBATileExt cv::TiffDecoder::readData cv::imread...

OSV-2020-1257 Stack-buffer-overflow in readstat_convert

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12579 Crash type: Stack-buffer-overflow WRITE 1 Crash state: readstatconvert dtahandlerow dtahandlerows...

OSV-2020-1244 Use-of-uninitialized-value in decimate_dsd_run

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19925 Crash type: Use-of-uninitialized-value Crash state: decimatedsdrun WavpackUnpackSamples fuzzer.cc...

OSV-2020-1242 Heap-buffer-overflow in ih264d_cavlc_parse4x4coeff_n8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16587 Crash type: Heap-buffer-overflow READ 4 Crash state: ih264dcavlcparse4x4coeffn8 ih264dcavlcparse8x8blockbothavailable ih264dparseresidual4x4cavlc...

OSV-2020-1238 Use-of-uninitialized-value in pcpp::Packet::createFirstLayer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22085 Crash type: Use-of-uninitialized-value Crash state: pcpp::Packet::createFirstLayer pcpp::Packet::setRawPacket FuzzTarget.cpp...

OSV-2020-1235 Heap-buffer-overflow in mbc_case_fold

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21977 Crash type: Heap-buffer-overflow READ 1 Crash state: mbccasefold stringcmpic matchat...

OSV-2020-1240 Use-of-uninitialized-value in jbig2_decode_mmr_line

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17855 Crash type: Use-of-uninitialized-value Crash state: jbig2decodemmrline jbig2decodehalftonemmr jbig2decodegrayscaleimage...

OSV-2020-1233 Heap-buffer-overflow in getTLScertificate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19269 Crash type: Heap-buffer-overflow READ 6 Crash state: getTLScertificate tlsDetectProtocolFromCertificate ndpisearchtlstcpudp...

OSV-2020-1232 Use-of-uninitialized-value in TIFFYCbCrtoRGB

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16844 Crash type: Use-of-uninitialized-value Crash state: TIFFYCbCrtoRGB putcontig8bitYCbCr22tile gtTileContig...

OSV-2020-1228 Heap-use-after-free in arrow::internal::CountSetBits

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20120 Crash type: Heap-use-after-free READ 8 Crash state: arrow::internal::CountSetBits arrow::Array::nullcount arrow::internal::ValidateArray...

OSV-2020-1226 Heap-buffer-overflow in void mc_chroma<unsigned short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13583 Crash type: Heap-buffer-overflow READ 2 Crash state: void mcchroma generateinterpredictionsamples decodepredictionunit...

OSV-2020-1229 Heap-buffer-overflow in Sass::Prelexer::quoted_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Heap-buffer-overflow READ 1 Crash state: Sass::Prelexer::quotedstring char const Sass::Prelexer::alternatives& char const Sass::Prelexer::sequence&...

OSV-2020-1231 Heap-buffer-overflow in find_dom

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15284 Crash type: Heap-buffer-overflow WRITE Crash state: finddom optloop bpfoptimize...

OSV-2020-1230 Heap-buffer-overflow in to_u32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16734 Crash type: Heap-buffer-overflow READ 1 Crash state: tou32 fuzzgettlvcomn fuzzaddmimepart...