OSV-2020-1066 Heap-buffer-overflow in dav1dFeedData

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21947 Crash type: Heap-buffer-overflow READ Crash state: dav1dFeedData dav1dCodecGetNextImage avifDecoderNextImage...

OSV-2020-1065 Use-of-uninitialized-value in xsltNumberFormatInsertNumbers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14471 Crash type: Use-of-uninitialized-value Crash state: xsltNumberFormatInsertNumbers xsltNumberFormat xsltNumber...

OSV-2020-1056 Use-of-uninitialized-value in xmlStrlen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15069 Crash type: Use-of-uninitialized-value Crash state: xmlStrlen xmlBufferAdd xmlBufferCat...

OSV-2020-1053 UNKNOWN READ in js_parse_source_element

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21404 Crash type: UNKNOWN READ Crash state: jsparsesourceelement JSEvalInternal JSEval...

OSV-2020-1051 Global-buffer-overflow in kencodingprober::nsCodingStateMachine::NextState

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12918 Crash type: Global-buffer-overflow READ 4 Crash state: kencodingprober::nsCodingStateMachine::NextState kencodingprober::nsEscCharSetProber::HandleData kcodecsfuzzer.cc...

OSV-2020-1058 Heap-buffer-overflow in arrow::UnionType::UnionType

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20116 Crash type: Heap-buffer-overflow WRITE 4 Crash state: arrow::UnionType::UnionType arrow::union arrow::ipc::internal::ConcreteTypeFromFlatbuffer...

OSV-2020-1054 Heap-buffer-overflow in wabt::string_view::compare

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18962 Crash type: Heap-buffer-overflow READ 6 Crash state: wabt::stringview::compare wabt::operator== wabt::BinaryReader::ReadCustomSection...

OSV-2020-1047 UNKNOWN READ in arrow::ipc::internal::FieldFromFlatbuffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20123 Crash type: UNKNOWN READ Crash state: arrow::ipc::internal::FieldFromFlatbuffer arrow::ipc::internal::FieldFromFlatbuffer arrow::ipc::internal::GetSchema...

OSV-2020-1042 Heap-use-after-free in WelsDec::MapColToList0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14267 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::MapColToList0 WelsDec::PredBDirectTemporal WelsDec::WelsDecodeMbCavlcBSlice...

OSV-2020-1046 Stack-buffer-overflow in sc_pkcs15emu_object_add

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19251 Crash type: Stack-buffer-overflow READ Crash state: scpkcs15emuobjectadd scpkcs15emucoolkeyinit scpkcs15emucoolkeyinitex...

OSV-2020-1037 Heap-buffer-overflow in Sass::Prelexer::quoted_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Heap-buffer-overflow READ 1 Crash state: Sass::Prelexer::quotedstring char const Sass::Prelexer::sequence& char const Sass::Prelexer::alternatives&...

OSV-2020-1040 Heap-buffer-overflow in decode_bit_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16615 Crash type: Heap-buffer-overflow READ 1 Crash state: decodebitstring decodebitfield asn1decodeentry...

OSV-2020-1018 Heap-use-after-free in draco::Metadata::AddSubMetadata

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23342 Crash type: Heap-use-after-free READ 8 Crash state: draco::Metadata::AddSubMetadata draco::MetadataDecoder::DecodeMetadata draco::MetadataDecoder::DecodeGeometryMetadata...

OSV-2020-1017 Heap-buffer-overflow in decode_bit_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16614 Crash type: Heap-buffer-overflow READ 1 Crash state: decodebitstring scasn1printbitstring printtagsrecursive...

OSV-2020-1015 Heap-buffer-overflow in ndpi_search_memcached

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19324 Crash type: Heap-buffer-overflow READ 13 Crash state: ndpisearchmemcached checkndpiudpflowfunc ndpidetectionprocesspacket...

OSV-2020-1013 Heap-buffer-overflow in ndpi_search_amazon_video

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19100 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpisearchamazonvideo checkndpitcpflowfunc ndpidetectionprocesspacket...

OSV-2020-1022 Heap-buffer-overflow in ptls_set_negotiated_protocol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13682 Crash type: Heap-buffer-overflow READ Crash state: ptlssetnegotiatedprotocol clienthandleencryptedextensions handlehandshakerecord...

OSV-2020-1020 Use-of-uninitialized-value in Sass::Prelexer::quoted_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Use-of-uninitialized-value Crash state: Sass::Prelexer::quotedstring char const Sass::Prelexer::sequence& char const Sass::Prelexer::alternatives&...

OSV-2020-1023 Use-of-uninitialized-value in njs_vsprintf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23061 Crash type: Use-of-uninitialized-value Crash state: njsvsprintf njserrorfmtnew njsregexpmatchtracehandler...

OSV-2020-1006 Use-of-uninitialized-value in decimate_dsd_run

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19928 Crash type: Use-of-uninitialized-value Crash state: decimatedsdrun WavpackUnpackSamples WavpackSeekSample64...