OSV-2020-700 Stack-buffer-overflow in ot::Message::Write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15380 Crash type: Stack-buffer-overflow READ Crash state: ot::Message::Write ot::Message::Append ot::Mle::Mle::AppendResponse...

OSV-2020-701 Heap-use-after-free in read_chunks_before_idat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16266 Crash type: Heap-use-after-free READ Crash state: readchunksbeforeidat getancillary spngdecodedimagesize...

OSV-2020-680 Bad-free in sc_pkcs15_decode_prkdf_entry

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18482 Crash type: Bad-free Crash state: scpkcs15decodeprkdfentry fuzzpkcs15decode.c...

OSV-2020-688 Heap-use-after-free in icalparameter_new_from_value_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14737 Crash type: Heap-use-after-free READ 2 Crash state: icalparameternewfromvaluestring icalparseraddline icalparserparse...

OSV-2020-685 Global-buffer-overflow in backup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18464 Crash type: Global-buffer-overflow READ 1 Crash state: backup peek lexconfig...

OSV-2020-682 Heap-use-after-free in condition_free_list_type

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13878 Crash type: Heap-use-after-free READ 8 Crash state: conditionfreelisttype linkconfigfree linkloadone...

OSV-2020-679 Use-of-uninitialized-value in printUInt32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14642 Crash type: Use-of-uninitialized-value Crash state: printUInt32 printU1ImmOperand printInstruction...

OSV-2020-675 Use-of-uninitialized-value in UA_base64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14625 Crash type: Use-of-uninitialized-value Crash state: UAbase64 ByteStringencodeJson VariantencodeJson...

OSV-2020-676 Heap-use-after-free in String_clear

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14567 Crash type: Heap-use-after-free READ 8 Crash state: Stringclear clearStructure UAArraydelete...

OSV-2020-681 Heap-use-after-free in WelsDec::SetUnRef

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18459 Crash type: Heap-use-after-free WRITE 1 Crash state: WelsDec::SetUnRef WelsDec::WelsDelLongFromListSetUnref WelsDec::MMCOProcess...

OSV-2020-668 Heap-buffer-overflow in post_process_template

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19013 Crash type: Heap-buffer-overflow READ 4 Crash state: postprocesstemplate parsershutdown parsestring...

OSV-2020-674 Heap-buffer-overflow in ihevcd_mv_merge

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17196 Crash type: Heap-buffer-overflow READ 4 Crash state: ihevcdmvmerge ihevcdgetmvctb ihevcdparseslicedata...

OSV-2020-671 Heap-use-after-free in WelsDec::SetUnRef

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18743 Crash type: Heap-use-after-free WRITE 1 Crash state: WelsDec::SetUnRef WelsDec::SlidingWindow WelsDec::WelsMarkAsRef...

OSV-2020-670 Memcpy-param-overlap in ot::Cli::CoapSecure::Process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12679 Crash type: Memcpy-param-overlap Crash state: ot::Cli::CoapSecure::Process ot::Cli::Interpreter::ProcessCoapSecure ot::Cli::Interpreter::ProcessLine...

OSV-2020-663 Heap-buffer-overflow in Variant_decodeJson

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18259 Crash type: Heap-buffer-overflow READ 4 Crash state: VariantdecodeJson UAdecodeJson fuzzjsondecodeencode.cc...

OSV-2020-669 Use-of-uninitialized-value in g_date_time_get_week_number

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17648 Crash type: Use-of-uninitialized-value Crash state: gdatetimegetweeknumber gdatetimenewweek parseisoNUMBERdate...

OSV-2020-673 UNKNOWN WRITE in htp_connp_res_buffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19323 Crash type: UNKNOWN WRITE Crash state: htpconnpresbuffer htpconnpRESLINE htpconnpresdata...

OSV-2020-662 UNKNOWN READ in wmem_strdup_printf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13725 Crash type: UNKNOWN READ Crash state: wmemstrdupprintf dissectparametersequence dissectrtpssubmessagev2...

OSV-2020-672 Stack-buffer-overflow in ot::NetworkData::NetworkData::PrefixMatch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13333 Crash type: Stack-buffer-overflow READ 1 Crash state: ot::NetworkData::NetworkData::PrefixMatch ot::NetworkData::LeaderBase::GetContext ot::Mle::MleRouter::GetNeighbor...

OSV-2020-643 UNKNOWN READ in ot::Ip6::UdpSocket::GetNext

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13405 Crash type: UNKNOWN READ Crash state: ot::Ip6::UdpSocket::GetNext ot::Ip6::Udp::AddSocket ot::Ip6::UdpSocket::Open...