glib:fuzz_uri_escape: Heap-buffer-overflow in uri_decoder

Project: https://gitlab.gnome.org/GNOME/glib.git Detailed Report: https://oss-fuzz.com/testcase?key=4881440516079616 Project: glib Fuzzing Engine: libFuzzer Fuzz Target: fuzzuriescape Job Type: libfuzzerasanglib Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

glib:fuzz_uri_parse: Heap-buffer-overflow in g_string_insert_len

Project: https://gitlab.gnome.org/GNOME/glib.git Detailed Report: https://oss-fuzz.com/testcase?key=4902921962782720 Project: glib Fuzzing Engine: afl Fuzz Target: fuzzuriparse Job Type: aflasanglib Platform Id: linux Crash Type: Heap-buffer-overflow READ 5 Crash Address: 0x602000000134 Crash...

glib:fuzz_uri_parse_params: Heap-buffer-overflow in uri_decoder

Project: https://gitlab.gnome.org/GNOME/glib.git Detailed Report: https://oss-fuzz.com/testcase?key=4815738421641216 Project: glib Fuzzing Engine: afl Fuzz Target: fuzzuriparseparams Job Type: aflasanglib Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x6020000000d2 Cra...

OSV-2020-729 Stack-buffer-overflow in ot::MeshCoP::Leader::HandlePetition

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13335 Crash type: Stack-buffer-overflow READ 1 Crash state: ot::MeshCoP::Leader::HandlePetition ot::Coap::CoapBase::ProcessReceivedRequest ot::Ip6::Udp::HandleMessage...

OSV-2020-739 UNKNOWN READ in str_decref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18756 Crash type: UNKNOWN READ Crash state: strdecref objfree mrbgcdestroy...

OSV-2020-732 Stack-buffer-overflow in ot::MeshCoP::Leader::HandlePetition

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13537 Crash type: Stack-buffer-overflow READ 1 Crash state: ot::MeshCoP::Leader::HandlePetition ot::Coap::CoapBase::ProcessReceivedRequest ot::Ip6::Udp::HandleMessage...

OSV-2020-730 Use-of-uninitialized-value in xmlOutputBufferWriteEscape

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15914 Crash type: Use-of-uninitialized-value Crash state: xmlOutputBufferWriteEscape xmlNodeDumpOutput xsltSaveResultTo...

OSV-2020-715 Heap-buffer-overflow in cras_rclient_message_from_client

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15058 Crash type: Heap-buffer-overflow READ 4 Crash state: crasrclientmessagefromclient crasrclientbufferfromclient rclientmessage.cc...

OSV-2020-713 Heap-buffer-overflow in XRef::getEntry

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12797 Crash type: Heap-buffer-overflow READ 4 Crash state: XRef::getEntry Parser::makeStream Parser::getObj...

OSV-2020-722 Heap-buffer-overflow in r_buf_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15218 Crash type: Heap-buffer-overflow WRITE Crash state: rbufread parsefunctionstarts inititems...

OSV-2020-708 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14919 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int hbmapiterthbmapiterthbarraytOT::OffsetToOT::AxisValue, OT::IntTypeu...

OSV-2020-728 Stack-buffer-overflow in ot::Ip6::OptionPadN::Init

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14854 Crash type: Stack-buffer-overflow WRITE 9 Crash state: ot::Ip6::OptionPadN::Init ot::Ip6::Ip6::RemoveMplOption ot::Ip6::Ip6::ProcessReceiveCallback...

OSV-2020-709 Heap-double-free in sc_pkcs15_free_object_content

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18890 Crash type: Heap-double-free Crash state: scpkcs15freeobjectcontent scpkcs15freeobject fuzzpkcs15decode.c...

OSV-2020-693 Heap-buffer-overflow in parse_sec_attr_44

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18798 Crash type: Heap-buffer-overflow READ 1 Crash state: parsesecattr44 setcosselectfile scselectfile...

OSV-2020-692 Heap-use-after-free in WelsDec::SetUnRef

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18458 Crash type: Heap-use-after-free WRITE 1 Crash state: WelsDec::SetUnRef WelsDec::SlidingWindow WelsDec::WelsMarkAsRef...

OSV-2020-698 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18515 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::ArrayOf, OT::IntType ::...

OSV-2020-705 Use-of-uninitialized-value in xmlOutputBufferWriteEscape

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15768 Crash type: Use-of-uninitialized-value Crash state: xmlOutputBufferWriteEscape xmlNodeListDumpOutput xmlNodeDumpOutputInternal...

OSV-2020-704 Heap-buffer-overflow in BEInt<unsigned char, 1>::set

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13736 Crash type: Heap-buffer-overflow WRITE 1 Crash state: BEInt::set CFF::CFFIndex ::setoffsetat bool CFF::FDArray ::serializeCFF::cff2fontdict...

OSV-2020-699 Heap-buffer-overflow in ihevcd_process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18406 Crash type: Heap-buffer-overflow READ 4 Crash state: ihevcdprocess ihevcdprocessthread startthread...

OSV-2020-694 Heap-buffer-overflow in r_read_le32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13942 Crash type: Heap-buffer-overflow READ 1 Crash state: rreadle32 iskernelcache checkbytes...