OSV-2020-88 Segv on unknown address in cbor_decref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21386 Crash type: Segv on unknown address Crash state: cbordecref cbordecref cborload...

OSV-2020-97 Use-of-uninitialized-value in file_vprintf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20702 Crash type: Use-of-uninitialized-value Crash state: filevprintf fileprintf mget...

OSV-2020-96 Heap-buffer-overflow in logfmt_parser

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21953 Crash type: Heap-buffer-overflow READ 1 Crash state: logfmtparser flbparserlogfmtdo parselogfmtfuzzer.c...

OSV-2020-77 Use-of-uninitialized-value in jbig2_text_region

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21571 Crash type: Use-of-uninitialized-value Crash state: jbig2textregion jbig2parsesegment jbig2completepage...

OSV-2020-78 Heap-buffer-overflow in ndpi_check_spotify

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22912 Crash type: Heap-buffer-overflow READ 7 Crash state: ndpicheckspotify ndpisearchspotify checkndpiudpflowfunc...

OSV-2020-68 Heap-double-free in ares_parse_soa_reply

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21176 Crash type: Heap-double-free Crash state: aresparsesoareply ares-test-fuzz.c aresparsesoareply...

OSV-2020-75 Index-out-of-bounds in der_tag

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20753 Crash type: Index-out-of-bounds Crash state: dertag dercmp magiccheck...

OSV-2020-67 Heap-buffer-overflow in ndpi_workflow_process_packet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21348 Crash type: Heap-buffer-overflow READ 2 Crash state: ndpiworkflowprocesspacket fuzzndpireader.c...

OSV-2020-71 Heap-buffer-overflow in ndpi_parse_packet_line_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22167 Crash type: Heap-buffer-overflow READ 8 Crash state: ndpiparsepacketlineinfo ndpichecksteamhttp ndpisearchsteam...

OSV-2020-63 UNKNOWN READ in arrow::BaseBinaryBuilder<arrow::BinaryType>::UnsafeAppend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20697 Crash type: UNKNOWN READ Crash state: arrow::BaseBinaryBuilder::UnsafeAppend parquet::PlainByteArrayDecoder::DecodeArrowDense parquet::PlainByteArrayDecoder::DecodeArrow...

OSV-2020-64 Heap-buffer-overflow in read_reloc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21835 Crash type: Heap-buffer-overflow WRITE 8 Crash state: readreloc populaterelocsrecordfromdynamic populaterelocsrecord...

OSV-2020-60 Heap-buffer-overflow in get_ndpi_flow_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20109 Crash type: Heap-buffer-overflow READ 2 Crash state: getndpiflowinfo getndpiflowinfo6 packetprocessing...

OSV-2020-65 Heap-use-after-free in std::__1::vector<unsigned long, std::__1::allocator<unsigned long> >::begin

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21908 Crash type: Heap-use-after-free READ 8 Crash state: std::1::vector ::begin perfetto::traceprocessor::TrackTracker::ResolveDescriptorTrack perfetto::traceprocessor::TrackTracker::GetDescriptorTrackImpl...

OSV-2020-59 Heap-buffer-overflow in ndpi_add_connection_as_bittorrent

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20777 Crash type: Heap-buffer-overflow READ Crash state: ndpiaddconnectionasbittorrent ndpiintsearchbittorrenttcpzero checkndpitcpflowfunc...

OSV-2020-55 Stack-buffer-overflow in tcos_decipher

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22967 Crash type: Stack-buffer-overflow WRITE Crash state: tcosdecipher scdecipher usekey...

OSV-2020-39 Heap-use-after-free in ndpi_http_check_content

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22899 Crash type: Heap-use-after-free READ 1 Crash state: ndpihttpcheckcontent ndpiinthttpaddconnection ndpicheckhttptcp...

OSV-2020-42 Heap-buffer-overflow in bool arrow::util::RleDecoder::NextCounts<int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20695 Crash type: Heap-buffer-overflow WRITE Crash state: bool arrow::util::RleDecoder::NextCounts int arrow::util::RleDecoder::GetBatchWithDictSpaced virtual thunk to parquet::DictDecoderImplparquet::PhysicalType...

OSV-2020-49 Heap-buffer-overflow in ndpi_netbios_name_interpret

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21365 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpinetbiosnameinterpret ndpiintnetbiosaddconnection checkndpiudpflowfunc...

OSV-2020-54 Heap-buffer-overflow in OT::HintingDevice* hb_serialize_context_t::embed<OT::HintingDevice>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20211 Crash type: Heap-buffer-overflow READ Crash state: OT::HintingDevice hbserializecontextt::embed OT::HintingDevice::copy OT::Device::copy...

OSV-2020-53 Index-out-of-bounds in parse_exp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22925 Crash type: Index-out-of-bounds Crash state: parseexp parsebranch parsealts...