OSV-2020-142 Heap-use-after-free in ndpi_strncasestr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22816 Crash type: Heap-use-after-free READ 1 Crash state: ndpistrncasestr ndpihttpcheckcontent ndpiinthttpaddconnection...

OSV-2020-137 UNKNOWN READ in dav1d_resize_ssse3

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21547 Crash type: UNKNOWN READ Crash state: dav1dresizessse3...

OSV-2020-125 Negative-size-param in parquet::PlainByteArrayDecoder::DecodeArrowDense

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20669 Crash type: Negative-size-param Crash state: parquet::PlainByteArrayDecoder::DecodeArrowDense parquet::PlainByteArrayDecoder::DecodeArrow parquet::internal::ByteArrayChunkedRecordReader::ReadValuesSpaced...

OSV-2020-133 Heap-use-after-free in r_bin_object_rebuild_classes_ht

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21602 Crash type: Heap-use-after-free READ 8 Crash state: rbinobjectrebuildclassesht rbinobjectsetitems rbinobjectnew...

OSV-2020-130 Use-of-uninitialized-value in OT::TupleVarHeader::calculate_scalar

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20919 Crash type: Use-of-uninitialized-value Crash state: OT::TupleVarHeader::calculatescalar OT::gvar::acceleratort::applydeltastopoints bool OT::glyf::Glyph::getpointsbool OT::glyf::acceleratort::getpointsOT::gl...

OSV-2020-129 UNKNOWN READ in pcpp::Packet::setRawPacket

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23011 Crash type: UNKNOWN READ Crash state: pcpp::Packet::setRawPacket pcpp::Packet::Packet FuzzTarget.cpp...

OSV-2020-122 Heap-buffer-overflow in ndpi_strnstr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22022 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpistrnstr ndpisearchnatstcp checkndpitcpflowfunc...

OSV-2020-124 Dynamic-stack-buffer-overflow in RetrieveFPForSig

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21758 Crash type: Dynamic-stack-buffer-overflow WRITE 4 Crash state: RetrieveFPForSig DetectSetFastPatternAndItsId SigGroupBuild...

OSV-2020-141 Heap-use-after-free in pixcmapDestroy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22110 Crash type: Heap-use-after-free READ 8 Crash state: pixcmapDestroy colorquantfuzzer.cc pixcmapDestroy...

OSV-2020-136 Heap-buffer-overflow in ndpi_netbios_name_interpret

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20823 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpinetbiosnameinterpret ndpiintnetbiosaddconnection checkndpiudpflowfunc...

OSV-2020-121 Heap-buffer-overflow in BEInt<short, 2>::operator short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21092 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator short OT::IntType::operator int OT::SegmentMaps::map...

OSV-2020-138 Heap-buffer-overflow in org::apache::arrow::flatbuf::Message::Verify

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21681 Crash type: Heap-buffer-overflow READ 4 Crash state: org::apache::arrow::flatbuf::Message::Verify arrow::ipc::CheckMetadataAndGetBodyLength arrow::ipc::MessageDecoder::MessageDecoderImpl::ConsumeMetadata...

OSV-2020-113 Heap-buffer-overflow in vorbis_book_decodev_add

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22207 Crash type: Heap-buffer-overflow READ 4 Crash state: vorbisbookdecodevadd 01inverse res1inverse...

OSV-2020-114 Use-of-uninitialized-value in read_non_idat_chunks

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22646 Crash type: Use-of-uninitialized-value Crash state: readnonidatchunks readchunks spnggetplte...

OSV-2020-104 Heap-buffer-overflow in void arrow::util::internal::ByteStreamSlitDecodeSSE2<double>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21420 Crash type: Heap-buffer-overflow READ 1 Crash state: void arrow::util::internal::ByteStreamSlitDecodeSSE2 virtual thunk to parquet::ByteStreamSplitDecoderparquet::PhysicalType parquet::TypedDecoderparquet::PhysicalType...

OSV-2020-101 UNKNOWN READ in apache::thrift::transport::TMemoryBuffer::readSlow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20681 Crash type: UNKNOWN READ Crash state: apache::thrift::transport::TMemoryBuffer::readSlow apache::thrift::transport::TBufferBase::read unsigned int apache::thrift::transport::readAllapache::thrift::transport::TBuff...

OSV-2020-105 Segv on unknown address in cbor_typeof

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21387 Crash type: Segv on unknown address Crash state: cbortypeof cbornesteddescribe cbornesteddescribe...

OSV-2020-115 UNKNOWN WRITE in arrow::BaseBinaryBuilder<arrow::BinaryType>::UnsafeAppend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21106 Crash type: UNKNOWN WRITE Crash state: arrow::BaseBinaryBuilder::UnsafeAppend parquet::PlainByteArrayDecoder::DecodeArrowDenseNonNull parquet::PlainByteArrayDecoder::DecodeArrow...

OSV-2020-111 Heap-use-after-free in int std::__1::__cxx_atomic_fetch_sub<int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21604 Crash type: Heap-use-after-free WRITE 4 Crash state: int std::1::cxxatomicfetchsub std::1::atomicbase::operator-- Object::free...

OSV-2020-107 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20944 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::gvar::getoffset...