OSV-2020-1159 Segv on unknown address in arrow::ipc::ReadMessage

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20124 Crash type: Segv on unknown address Crash state: arrow::ipc::ReadMessage arrow::ipc::RecordBatchFileReader::RecordBatchFileReaderImpl::ReadMessageFromBlo...

OSV-2020-1117 Heap-buffer-overflow in arrow::internal::CountSetBits

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20575 Crash type: Heap-buffer-overflow READ 8 Crash state: arrow::internal::CountSetBits arrow::Array::nullcount arrow::internal::ValidateArray...

OSV-2020-1058 Heap-buffer-overflow in arrow::UnionType::UnionType

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20116 Crash type: Heap-buffer-overflow WRITE 4 Crash state: arrow::UnionType::UnionType arrow::union arrow::ipc::internal::ConcreteTypeFromFlatbuffer...

OSV-2020-1050 UNKNOWN READ in arrow::Status arrow::internal::ValidateArrayVisitor::ValidateListArray<arrow::La

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20115 Crash type: UNKNOWN READ Crash state: arrow::Status arrow::internal::ValidateArrayVisitor::ValidateListArray arrow::internal::ValidateArray...

OSV-2020-1047 UNKNOWN READ in arrow::ipc::internal::FieldFromFlatbuffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20123 Crash type: UNKNOWN READ Crash state: arrow::ipc::internal::FieldFromFlatbuffer arrow::ipc::internal::FieldFromFlatbuffer arrow::ipc::internal::GetSchema...

OSV-2020-974 Heap-buffer-overflow in arrow::Status arrow::VisitArrayInline<arrow::internal::ValidateArrayDataVisitor>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20113 Crash type: Heap-buffer-overflow READ 4 Crash state: arrow::Status arrow::VisitArrayInline arrow::internal::ValidateArrayData arrow::RecordBatch::ValidateFull...

OSV-2020-936 Global-buffer-overflow in arrow::Status arrow::VisitArrayInline<arrow::internal::ValidateArrayDataVisitor>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20181 Crash type: Global-buffer-overflow READ 1 Crash state: arrow::Status arrow::VisitArrayInline arrow::internal::ValidateArrayData arrow::RecordBatch::ValidateFull...

OSV-2020-917 Heap-buffer-overflow in arrow::Status arrow::VisitArrayInline<arrow::internal::ValidateArrayVisitor>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21039 Crash type: Heap-buffer-overflow READ 4 Crash state: arrow::Status arrow::VisitArrayInline arrow::internal::ValidateArray arrow::RecordBatch::Validate...

OSV-2020-911 Heap-buffer-overflow in arrow::Status arrow::ConcatenateOffsets<int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23916 Crash type: Heap-buffer-overflow READ 4 Crash state: arrow::Status arrow::ConcatenateOffsets arrow::ConcatenateImpl::Visit arrow::Status arrow::VisitTypeInline...

OSV-2020-776 Negative-size-param in arrow::ConcatenateBuffers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24101 Crash type: Negative-size-param Crash state: arrow::ConcatenateBuffers arrow::ConcatenateImpl::Visit arrow::Status arrow::VisitTypeInline...

arrow:arrow-ipc-stream-fuzz: Negative-size-param in arrow::ConcatenateBuffers

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=4964779626856448 Project: arrow Fuzzing Engine: afl Fuzz Target: arrow-ipc-stream-fuzz Job Type: aflasanarrow Platform Id: linux Crash Type: Negative-size-param Crash Address: Crash State:...

OSV-2020-761 Heap-buffer-overflow in arrow::ConcatenateBuffers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23848 Crash type: Heap-buffer-overflow READ Crash state: arrow::ConcatenateBuffers arrow::ConcatenateImpl::Visit arrow::Status arrow::VisitTypeInline...

arrow:arrow-ipc-stream-fuzz: Heap-buffer-overflow in arrow::Status arrow::ConcatenateOffsets<int>

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=6440533038989312 Project: arrow Fuzzing Engine: afl Fuzz Target: arrow-ipc-stream-fuzz Job Type: aflasanarrow Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x6190000009ac...

arrow:arrow-ipc-file-fuzz: Heap-buffer-overflow in void arrow::internal::TransferBitmap<

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=5696379421982720 Project: arrow Fuzzing Engine: afl Fuzz Target: arrow-ipc-file-fuzz Job Type: aflasanarrow Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x60a000000100 Cras...

arrow:arrow-ipc-file-fuzz: Heap-buffer-overflow in arrow::ConcatenateBuffers

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=5760568177983488 Project: arrow Fuzzing Engine: afl Fuzz Target: arrow-ipc-file-fuzz Job Type: aflasanarrow Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x60a000000080 Crash...

OSV-2020-138 Heap-buffer-overflow in org::apache::arrow::flatbuf::Message::Verify

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21681 Crash type: Heap-buffer-overflow READ 4 Crash state: org::apache::arrow::flatbuf::Message::Verify arrow::ipc::CheckMetadataAndGetBodyLength arrow::ipc::MessageDecoder::MessageDecoderImpl::ConsumeMetadata...

OSV-2020-110 Heap-buffer-overflow in parquet::internal::RecordReader::Make

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20989 Crash type: Heap-buffer-overflow READ 8 Crash state: parquet::internal::RecordReader::Make parquet::arrow::LeafReader::LeafReader parquet::arrow::GetReader...

OSV-2020-104 Heap-buffer-overflow in void arrow::util::internal::ByteStreamSlitDecodeSSE2<double>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21420 Crash type: Heap-buffer-overflow READ 1 Crash state: void arrow::util::internal::ByteStreamSlitDecodeSSE2 virtual thunk to parquet::ByteStreamSplitDecoderparquet::PhysicalType parquet::TypedDecoderparquet::PhysicalType...

OSV-2020-109 UNKNOWN READ in arrow::BufferBuilder::Append

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20721 Crash type: UNKNOWN READ Crash state: arrow::BufferBuilder::Append arrow::BaseBinaryBuilder::Append parquet::ArrowBinaryHelper::Append...

OSV-2020-63 UNKNOWN READ in arrow::BaseBinaryBuilder<arrow::BinaryType>::UnsafeAppend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20697 Crash type: UNKNOWN READ Crash state: arrow::BaseBinaryBuilder::UnsafeAppend parquet::PlainByteArrayDecoder::DecodeArrowDense parquet::PlainByteArrayDecoder::DecodeArrow...