OSV-2020-182 Heap-buffer-overflow in hb_array_t<OT::IntType<unsigned char, 1u> const> hb_array_t<OT::IntType<unsigned

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20249 Crash type: Heap-buffer-overflow READ 1 Crash state: hbarrayt const hbarrayt ::copy OT::SBIXGlyph::copy...

OSV-2020-171 Heap-buffer-overflow in ndpi_parse_packet_line_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23396 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpiparsepacketlineinfo ndpiintsearchbittorrenttcpzero ndpiintsearchbittorrenttcp...

OSV-2020-184 Heap-buffer-overflow in file_strncmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23044 Crash type: Heap-buffer-overflow READ 13 Crash state: filestrncmp magiccheck match...

OSV-2020-174 Heap-buffer-overflow in int arrow::BitUtil::BitReader::GetBatch<short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21166 Crash type: Heap-buffer-overflow WRITE 8 Crash state: int arrow::BitUtil::BitReader::GetBatch int arrow::util::RleDecoder::GetBatch parquet::internal::TypedRecordReaderparquet::PhysicalType...

OSV-2020-180 Heap-buffer-overflow in parquet::PlainByteArrayDecoder::DecodeArrowDense

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21009 Crash type: Heap-buffer-overflow READ 4 Crash state: parquet::PlainByteArrayDecoder::DecodeArrowDense parquet::PlainByteArrayDecoder::DecodeArrow parquet::internal::ByteArrayChunkedRecordReader::ReadValuesSpaced...

OSV-2020-173 Use-of-uninitialized-value in BaseCryptStream::BaseCryptStream

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20200 Crash type: Use-of-uninitialized-value Crash state: BaseCryptStream::BaseCryptStream DecryptStream::DecryptStream Parser::getObj...

OSV-2020-179 Heap-buffer-overflow in get16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20832 Crash type: Heap-buffer-overflow READ 2 Crash state: get16 searchvaliddns ndpisearchdns...

OSV-2020-146 Heap-buffer-overflow in Json::OurReader::parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21916 Crash type: Heap-buffer-overflow READ 1 Crash state: Json::OurReader::parse Json::OurCharReader::parse fuzz.cpp...

OSV-2020-160 Heap-buffer-overflow in populate_relocs_record

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21842 Crash type: Heap-buffer-overflow WRITE 4 Crash state: populaterelocsrecord relcachenew getimportaddr...

OSV-2020-147 Heap-buffer-overflow in BEInt<short, 2>::operator short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21026 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator short OT::IntType::operator int OT::TupleVarHeader::calculatescalar...

OSV-2020-154 Heap-buffer-overflow in search_valid_dns

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21263 Crash type: Heap-buffer-overflow READ 1 Crash state: searchvaliddns ndpisearchdns checkndpiudpflowfunc...

OSV-2020-153 UNKNOWN WRITE in Variant_encodeJson

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20578 Crash type: UNKNOWN WRITE Crash state: VariantencodeJson VariantencodeJson VariantencodeJson...

OSV-2020-164 Stack-buffer-overflow in ot::NetworkData::NetworkData::FindService

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21762 Crash type: Stack-buffer-overflow READ Crash state: ot::NetworkData::NetworkData::FindService ot::NetworkData::Leader::Validate ot::NetworkData::Leader::RegisterNetworkData...

OSV-2020-165 UNKNOWN READ in apache::thrift::protocol::TCompactProtocolT<apache::thrift::transport::TMemoryBu

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20670 Crash type: UNKNOWN READ Crash state: apache::thrift::protocol::TCompactProtocolT...

OSV-2020-142 Heap-use-after-free in ndpi_strncasestr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22816 Crash type: Heap-use-after-free READ 1 Crash state: ndpistrncasestr ndpihttpcheckcontent ndpiinthttpaddconnection...

OSV-2020-137 UNKNOWN READ in dav1d_resize_ssse3

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21547 Crash type: UNKNOWN READ Crash state: dav1dresizessse3...

OSV-2020-125 Negative-size-param in parquet::PlainByteArrayDecoder::DecodeArrowDense

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20669 Crash type: Negative-size-param Crash state: parquet::PlainByteArrayDecoder::DecodeArrowDense parquet::PlainByteArrayDecoder::DecodeArrow parquet::internal::ByteArrayChunkedRecordReader::ReadValuesSpaced...

OSV-2020-130 Use-of-uninitialized-value in OT::TupleVarHeader::calculate_scalar

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20919 Crash type: Use-of-uninitialized-value Crash state: OT::TupleVarHeader::calculatescalar OT::gvar::acceleratort::applydeltastopoints bool OT::glyf::Glyph::getpointsbool OT::glyf::acceleratort::getpointsOT::gl...

OSV-2020-124 Dynamic-stack-buffer-overflow in RetrieveFPForSig

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21758 Crash type: Dynamic-stack-buffer-overflow WRITE 4 Crash state: RetrieveFPForSig DetectSetFastPatternAndItsId SigGroupBuild...

OSV-2020-133 Heap-use-after-free in r_bin_object_rebuild_classes_ht

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21602 Crash type: Heap-use-after-free READ 8 Crash state: rbinobjectrebuildclassesht rbinobjectsetitems rbinobjectnew...