OSV-2020-1289 Heap-use-after-free in WelsDec::MapColToList0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13037 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::MapColToList0 WelsDec::PredBDirectTemporal WelsDec::ParseInterBInfo...

OSV-2020-1294 Heap-buffer-overflow in SHA1Update

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18740 Crash type: Heap-buffer-overflow READ Crash state: SHA1Update getSSCertificateFingerprint tlsDetectProtocolFromCertificate...

OSV-2020-1290 Bad-free in aes_gcm_cleanup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14333 Crash type: Bad-free Crash state: aesgcmcleanup EVPCIPHERCTXfree cryptofuzz::module::CTXCopier::copy...

OSV-2020-1291 UNKNOWN READ in std::__1::_MetaBase<__can_be_converted_to_string_view<char, std::__1::char_trait

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23429 Crash type: UNKNOWN READ Crash state: std::1::MetaBase, std::1::allocator std::1::treeiteratorstd::1::valuetypestd::1::basicstringchar, st...

OSV-2020-1274 Heap-buffer-overflow in exif_entry_get_value

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14543 Crash type: Heap-buffer-overflow READ 7 Crash state: exifentrygetvalue contentfunc exifcontentforeachentry...

OSV-2020-1285 Use-of-uninitialized-value in ihevc_deblk_luma_vert_ssse3

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17009 Crash type: Use-of-uninitialized-value Crash state: ihevcdeblklumavertssse3 ihevcddeblkctb ihevcdprocess...

OSV-2020-1278 Use-of-uninitialized-value in SampledFunction::SampledFunction

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12608 Crash type: Use-of-uninitialized-value Crash state: SampledFunction::SampledFunction Function::parse Function::parse...

OSV-2020-1272 Heap-buffer-overflow in ASN1_get_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13803 Crash type: Heap-buffer-overflow READ 1 Crash state: ASN1getobject asn1checktlen asn1itemexd2i...

OSV-2020-1264 Use-of-uninitialized-value in AnnotAppearanceBuilder::drawText

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17607 Crash type: Use-of-uninitialized-value Crash state: AnnotAppearanceBuilder::drawText AnnotAppearanceBuilder::drawFormFieldChoice AnnotAppearanceBuilder::drawFormField...

OSV-2020-1266 UNKNOWN READ in arrow::Array::IsNull

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20139 Crash type: UNKNOWN READ Crash state: arrow::Array::IsNull arrow::Status arrow::VisitArrayInline arrow::internal::ValidateArrayData...

OSV-2020-1260 Negative-size-param in heif::HeifPixelImage::fill_RGB_16bit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13563 Crash type: Negative-size-param Crash state: heif::HeifPixelImage::fillRGB16bit heif::HeifContext::decodeoverlayimage heif::HeifContext::decodeimage...

OSV-2020-1250 Heap-use-after-free in WelsDec::MapColToList0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13185 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::MapColToList0 WelsDec::ParseInterBMotionInfoCabac WelsDec::WelsDecodeMbCabacBSliceBaseMode0...

OSV-2020-1253 Heap-buffer-overflow in pixReadFromTiffStream

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21435 Crash type: Heap-buffer-overflow WRITE 1 Crash state: pixReadFromTiffStream pixReadMemTiff pixReadMem...

OSV-2020-1256 UNKNOWN WRITE in TIFFReadRGBATileExt

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14185 Crash type: UNKNOWN WRITE Crash state: TIFFReadRGBATileExt cv::TiffDecoder::readData cv::imread...

OSV-2020-1258 Heap-use-after-free in WelsDec::MapColToList0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13457 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::MapColToList0 WelsDec::PredBDirectTemporal WelsDec::ParseInterBMotionInfoCabac...

OSV-2020-1257 Stack-buffer-overflow in readstat_convert

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12579 Crash type: Stack-buffer-overflow WRITE 1 Crash state: readstatconvert dtahandlerow dtahandlerows...

OSV-2020-1244 Use-of-uninitialized-value in decimate_dsd_run

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19925 Crash type: Use-of-uninitialized-value Crash state: decimatedsdrun WavpackUnpackSamples fuzzer.cc...

OSV-2020-1242 Heap-buffer-overflow in ih264d_cavlc_parse4x4coeff_n8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16587 Crash type: Heap-buffer-overflow READ 4 Crash state: ih264dcavlcparse4x4coeffn8 ih264dcavlcparse8x8blockbothavailable ih264dparseresidual4x4cavlc...

OSV-2020-1235 Heap-buffer-overflow in mbc_case_fold

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21977 Crash type: Heap-buffer-overflow READ 1 Crash state: mbccasefold stringcmpic matchat...

OSV-2020-1240 Use-of-uninitialized-value in jbig2_decode_mmr_line

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17855 Crash type: Use-of-uninitialized-value Crash state: jbig2decodemmrline jbig2decodehalftonemmr jbig2decodegrayscaleimage...