OSV-2020-101 UNKNOWN READ in apache::thrift::transport::TMemoryBuffer::readSlow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20681 Crash type: UNKNOWN READ Crash state: apache::thrift::transport::TMemoryBuffer::readSlow apache::thrift::transport::TBufferBase::read unsigned int apache::thrift::transport::readAllapache::thrift::transport::TBuff...

OSV-2020-115 UNKNOWN WRITE in arrow::BaseBinaryBuilder<arrow::BinaryType>::UnsafeAppend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21106 Crash type: UNKNOWN WRITE Crash state: arrow::BaseBinaryBuilder::UnsafeAppend parquet::PlainByteArrayDecoder::DecodeArrowDenseNonNull parquet::PlainByteArrayDecoder::DecodeArrow...

OSV-2020-114 Use-of-uninitialized-value in read_non_idat_chunks

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22646 Crash type: Use-of-uninitialized-value Crash state: readnonidatchunks readchunks spnggetplte...

OSV-2020-111 Heap-use-after-free in int std::__1::__cxx_atomic_fetch_sub<int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21604 Crash type: Heap-use-after-free WRITE 4 Crash state: int std::1::cxxatomicfetchsub std::1::atomicbase::operator-- Object::free...

OSV-2020-113 Heap-buffer-overflow in vorbis_book_decodev_add

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22207 Crash type: Heap-buffer-overflow READ 4 Crash state: vorbisbookdecodevadd 01inverse res1inverse...

OSV-2020-78 Heap-buffer-overflow in ndpi_check_spotify

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22912 Crash type: Heap-buffer-overflow READ 7 Crash state: ndpicheckspotify ndpisearchspotify checkndpiudpflowfunc...

OSV-2020-82 Heap-buffer-overflow in template_image_compose_opt

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20332 Crash type: Heap-buffer-overflow WRITE 1 Crash state: templateimagecomposeopt jbig2imagecomposeoptREPLACE jbig2imagecompose...

OSV-2020-88 Segv on unknown address in cbor_decref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21386 Crash type: Segv on unknown address Crash state: cbordecref cbordecref cborload...

OSV-2020-95 Use-of-uninitialized-value in jbig2_arith_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20493 Crash type: Use-of-uninitialized-value Crash state: jbig2arithdecode jbig2decodegenerictemplate0TPGDON jbig2immediategenericregion...

OSV-2020-96 Heap-buffer-overflow in logfmt_parser

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21953 Crash type: Heap-buffer-overflow READ 1 Crash state: logfmtparser flbparserlogfmtdo parselogfmtfuzzer.c...

OSV-2020-97 Use-of-uninitialized-value in file_vprintf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20702 Crash type: Use-of-uninitialized-value Crash state: filevprintf fileprintf mget...

OSV-2020-77 Use-of-uninitialized-value in jbig2_text_region

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21571 Crash type: Use-of-uninitialized-value Crash state: jbig2textregion jbig2parsesegment jbig2completepage...

OSV-2020-86 Heap-buffer-overflow in bool arrow::util::RleDecoder::NextCounts<int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20735 Crash type: Heap-buffer-overflow WRITE Crash state: bool arrow::util::RleDecoder::NextCounts parquet::DictByteArrayDecoderImpl::DecodeArrowDense parquet::DictByteArrayDecoderImpl::DecodeArrow...

OSV-2020-92 Heap-buffer-overflow in ndpi_parse_packet_line_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22169 Crash type: Heap-buffer-overflow READ 2 Crash state: ndpiparsepacketlineinfo ndpisearchmailsmtptcp checkndpitcpflowfunc...

OSV-2020-89 Heap-use-after-free in __xmlRaiseError

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23120 Crash type: Heap-use-after-free READ 2 Crash state: xmlRaiseError xmlErrValidNode xmlValidateRef...

OSV-2020-59 Heap-buffer-overflow in ndpi_add_connection_as_bittorrent

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20777 Crash type: Heap-buffer-overflow READ Crash state: ndpiaddconnectionasbittorrent ndpiintsearchbittorrenttcpzero checkndpitcpflowfunc...

OSV-2020-64 Heap-buffer-overflow in read_reloc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21835 Crash type: Heap-buffer-overflow WRITE 8 Crash state: readreloc populaterelocsrecordfromdynamic populaterelocsrecord...

OSV-2020-67 Heap-buffer-overflow in ndpi_workflow_process_packet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21348 Crash type: Heap-buffer-overflow READ 2 Crash state: ndpiworkflowprocesspacket fuzzndpireader.c...

OSV-2020-55 Stack-buffer-overflow in tcos_decipher

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22967 Crash type: Stack-buffer-overflow WRITE Crash state: tcosdecipher scdecipher usekey...

OSV-2020-60 Heap-buffer-overflow in get_ndpi_flow_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20109 Crash type: Heap-buffer-overflow READ 2 Crash state: getndpiflowinfo getndpiflowinfo6 packetprocessing...