OSV-2020-244 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20036 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::IndexArray::addindexesto...

OSV-2020-238 Heap-use-after-free in copy_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19990 Crash type: Heap-use-after-free READ 1 Crash state: copystring douncompressblock processblock...

OSV-2020-233 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20022 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int decltype...

OSV-2020-231 UNKNOWN WRITE in gen_mftr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20081 Crash type: UNKNOWN WRITE Crash state: genmftr...

OSV-2020-232 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20021 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::ArrayOf...

gdal:lvbag_fuzzer: Heap-buffer-overflow in OGR_RawField_IsUnset

Project: https://github.com/OSGeo/gdal.git Detailed Report: https://oss-fuzz.com/testcase?key=5186645136769024 Project: gdal Fuzzing Engine: honggfuzz Fuzz Target: lvbagfuzzer Job Type: honggfuzzasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x6020000038b0 Cras...

skia:image_filter_deserialize_width: Use-of-uninitialized-value in SkVerticesPriv::Decode

Project: https://skia.googlesource.com/skia.git Detailed Report: https://oss-fuzz.com/testcase?key=5193804545261568 Project: skia Fuzzing Engine: libFuzzer Fuzz Target: imagefilterdeserializewidth Job Type: libfuzzermsanskia Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

ndpi:fuzz_ndpi_reader: Heap-use-after-free in check_content_type_and_change_protocol

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=5161200102146048 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzndpireader Job Type: libfuzzerasanndpi Platform Id: linux Crash Type: Heap-use-after-free READ 2 Crash Address: 0x62b0000102df Cra...

OSV-2020-214 Heap-use-after-free in String_clear

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20437 Crash type: Heap-use-after-free READ 8 Crash state: Stringclear clearStructure Variantclear...

OSV-2020-209 Stack-buffer-overflow in coolkey_rsa_op

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22392 Crash type: Stack-buffer-overflow READ Crash state: coolkeyrsaop coolkeycomputecrypt scdecipher...

OSV-2020-215 Use-of-uninitialized-value in xmlStrdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23144 Crash type: Use-of-uninitialized-value Crash state: xmlStrdup xmlRaiseError xmlErrValidNode...

OSV-2020-213 Heap-buffer-overflow in Op_YCbCr422_to_RGB_16bit::convert_colorspace

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21114 Crash type: Heap-buffer-overflow READ Crash state: OpYCbCr422toRGB16bit::convertcolorspace heif::ColorConversionPipeline::convertimage heif::convertcolorspace...

OSV-2020-211 Heap-buffer-overflow in res2_inverse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22298 Crash type: Heap-buffer-overflow READ 4 Crash state: res2inverse mapping0inverse vorbissynthesis1...

OSV-2020-223 Heap-use-after-free in CRYPTO_DOWN_REF

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21550 Crash type: Heap-use-after-free WRITE 4 Crash state: CRYPTODOWNREF DHfree evppkeyfreelegacy...

OSV-2020-187 UNKNOWN READ in arrow::ipc::MessageDecoder::MessageDecoderImpl::ConsumeDataBufferInt32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21680 Crash type: UNKNOWN READ Crash state: arrow::ipc::MessageDecoder::MessageDecoderImpl::ConsumeDataBufferInt32 arrow::ipc::MessageDecoder::MessageDecoderImpl::ConsumeInitialBuffer...

OSV-2020-189 Stack-buffer-overflow in tvb_get_ipv4_addr_with_prefix_len

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21718 Crash type: Stack-buffer-overflow READ 4 Crash state: tvbgetipv4addrwithprefixlen dissectlspextipreachabilityclv isisdissectclvs...

OSV-2020-207 Heap-buffer-overflow in pcpp::IPv6Layer::parseExtensions

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22232 Crash type: Heap-buffer-overflow READ 1 Crash state: pcpp::IPv6Layer::parseExtensions pcpp::IPv6Layer::IPv6Layer pcpp::Packet::createFirstLayer...

OSV-2020-200 Heap-buffer-overflow in spng_decode_scanline

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22595 Crash type: Heap-buffer-overflow WRITE 2 Crash state: spngdecodescanline spngdecoderow spngdecodeimage...

OSV-2020-204 Negative-size-param in parquet::ColumnReaderImplBase<parquet::PhysicalType<

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20698 Crash type: Negative-size-param Crash state: parquet::ColumnReaderImplBaseparquet::PhysicalType parquet::internal::TypedRecordReaderparquet::PhysicalType parquet::arrow::LeafReader::NextBatch...

OSV-2020-188 Heap-buffer-overflow in BEInt<short, 2>::operator short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20924 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator short OT::IntType::operator int OT::TupleVarHeader::calculatescalar...