OSV-2020-1340 Use-of-uninitialized-value in Gfx::fillPatch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15395 Crash type: Use-of-uninitialized-value Crash state: Gfx::fillPatch Gfx::doPatchMeshShFill Gfx::doShadingPatternFill...

OSV-2020-1325 Global-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21769 Crash type: Global-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int CFF::Charset0::getglyph...

OSV-2020-1321 UNKNOWN READ in FlowGetHash

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21479 Crash type: UNKNOWN READ Crash state: FlowGetHash FlowSetupPacket DecodeICMPV4...

OSV-2020-1328 UNKNOWN READ in std::__1::__tree<std::__1::__value_type<std::__1::basic_string<char, std::__1::c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23566 Crash type: UNKNOWN READ Crash state: std::1::tree, std::1...

OSV-2020-1326 Heap-buffer-overflow in ihevcd_parse_slice_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16804 Crash type: Heap-buffer-overflow READ 4 Crash state: ihevcdparseslicedata ihevcddecode ihevcdcxaapifunction...

OSV-2020-1319 Use-of-uninitialized-value in Interpreter::evaluate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15843 Crash type: Use-of-uninitialized-value Crash state: Interpreter::evaluate jsonnetvmexecute jsonnetevaluatesnippetaux...

OSV-2020-1310 Use-of-uninitialized-value in pcpp::SSLCertificateRequestMessage::SSLCertificateRequestMessage

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22513 Crash type: Use-of-uninitialized-value Crash state: pcpp::SSLCertificateRequestMessage::SSLCertificateRequestMessage pcpp::SSLHandshakeMessage::createHandhakeMessage pcpp::SSLHandshakeLayer::SSLHandshakeLayer...

OSV-2020-1314 Use-of-uninitialized-value in ndpi_strdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21309 Crash type: Use-of-uninitialized-value Crash state: ndpistrdup processClientServerHello processTLSBlock...

OSV-2020-1315 Heap-buffer-overflow in pcpp::IPv4Layer::getFragmentFlags

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22638 Crash type: Heap-buffer-overflow READ 2 Crash state: pcpp::IPv4Layer::getFragmentFlags pcpp::IPv4Layer::isFragment pcpp::IPv4Layer::parseNextLayer...

OSV-2020-1311 Use-of-uninitialized-value in Sass::Prelexer::quoted_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Use-of-uninitialized-value Crash state: Sass::Prelexer::quotedstring Sass::Prelexer::staticcomponent char const Sass::Prelexer::zeroplus&...

OSV-2020-1312 Use-of-uninitialized-value in FilterInput8bitWithStride_c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13004 Crash type: Use-of-uninitialized-value Crash state: FilterInput8bitWithStridec McHorVer20c McHorVer30c...

OSV-2020-1297 Heap-buffer-overflow in pcpp::DnsResource::getDataLength

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22102 Crash type: Heap-buffer-overflow READ 2 Crash state: pcpp::DnsResource::getDataLength pcpp::DnsResource::getSize pcpp::DnsLayer::parseResources...

OSV-2020-1307 Heap-buffer-overflow in pcpp::IPv6Extension::getExtensionLen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22636 Crash type: Heap-buffer-overflow READ 1 Crash state: pcpp::IPv6Extension::getExtensionLen pcpp::IPv6Layer::parseExtensions pcpp::IPv6Layer::IPv6Layer...

OSV-2020-1296 Heap-use-after-free in WelsDec::WelsReorderRefList

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13038 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::WelsReorderRefList WelsDec::DecodeCurrentAccessUnit WelsDec::ConstructAccessUnit...

OSV-2020-1308 Heap-use-after-free in Interpreter::evaluate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15846 Crash type: Heap-use-after-free READ 4 Crash state: Interpreter::evaluate Interpreter::manifestJson Interpreter::evaluate...

OSV-2020-1306 Use-of-uninitialized-value in TIFFYCbCrtoRGB

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16602 Crash type: Use-of-uninitialized-value Crash state: TIFFYCbCrtoRGB putcontig8bitYCbCr42tile gtTileContig...

OSV-2020-1298 Heap-buffer-overflow in char const* Sass::Prelexer::alternatives<&

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Heap-buffer-overflow READ 1 Crash state: char const Sass::Prelexer::alternatives& char const Sass::Prelexer::alternatives& char const Sass::Prelexer::sequence&...

OSV-2020-1299 UNKNOWN WRITE in ideint_weave_blk

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17084 Crash type: UNKNOWN WRITE Crash state: ideintweaveblk ideintprocess impeg2ddeinterlace...

OSV-2020-1300 Heap-buffer-overflow in ihevcd_parse_slice_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17036 Crash type: Heap-buffer-overflow WRITE 1 Crash state: ihevcdparseslicedata ihevcddecode ihevcdcxaapifunction...

OSV-2020-1292 Stack-buffer-overflow in ot::ExtendedTlv::GetLength

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20775 Crash type: Stack-buffer-overflow READ 2 Crash state: ot::ExtendedTlv::GetLength ot::Tlv::GetSize ot::Tlv::GetNext...