OSV-2021-926 Heap-use-after-free in zend_gc_addref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35876 Crash type: Heap-use-after-free READ 4 Crash state: zendgcaddref ZENDASSIGNOPSPECVARTMPVARHANDLER fuzzerexecuteex...

OSV-2021-924 Heap-buffer-overflow in check_bad_address

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35868 Crash type: Heap-buffer-overflow WRITE 1 Crash state: checkbadaddress checkforboguswildcard FuzzCheckForBogusWildcard...

OSV-2021-921 Stack-buffer-overflow in bool re2::DFA::InlinedSearchLoop<true, true, true>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35821 Crash type: Stack-buffer-overflow READ 1 Crash state: bool re2::DFA::InlinedSearchLoop re2::DFA::Search re2::Prog::SearchDFA...

OSV-2021-919 UNKNOWN READ in v_FindFunction

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35801 Crash type: UNKNOWN READ Crash state: vFindFunction m3FindFunction fuzzer.c...

OSV-2021-916 Use-of-uninitialized-value in jxl::ModularFrameDecoder::DecodeAcMetadata

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35778 Crash type: Use-of-uninitialized-value Crash state: jxl::ModularFrameDecoder::DecodeAcMetadata jxl::FrameDecoder::ProcessDCGroup jxl::ThreadPool::RunCallStatejxl::Status...

OSV-2021-915 Stack-buffer-overflow in sc_asn1_read_tag

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35766 Crash type: Stack-buffer-overflow READ 1 Crash state: scasn1readtag scasn1findtag pivcomputesignature...

OSV-2021-914 UNKNOWN READ in mrb_vm_ci_env

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35718 Crash type: UNKNOWN READ Crash state: mrbvmcienv cipop mrbvmexec...

OSV-2021-913 Heap-buffer-overflow in dispatch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35727 Crash type: Heap-buffer-overflow READ 1 Crash state: dispatch dispatchlinked codegen...

OSV-2021-912 Heap-buffer-overflow in mrb_vm_exec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35712 Crash type: Heap-buffer-overflow READ 4 Crash state: mrbvmexec mrbvmrun mrbtoprun...

OSV-2021-909 Heap-buffer-overflow in OT::CPALV1Tail::serialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35672 Crash type: Heap-buffer-overflow READ 2 Crash state: OT::CPALV1Tail::serialize OT::CPAL::subset bool trysubset...

OSV-2021-907 Heap-buffer-overflow in decode_header_value_literal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35675 Crash type: Heap-buffer-overflow READ 1 Crash state: decodeheadervalueliteral decodeheader h2ohpackparserequest...

OSV-2021-904 UNKNOWN READ in helper_uc_tracecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35567 Crash type: UNKNOWN READ Crash state: helpeructracecode...

OSV-2021-903 UNKNOWN WRITE in QOutlineMapper::convertPath

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35566 Crash type: UNKNOWN WRITE Crash state: QOutlineMapper::convertPath QRasterPaintEngine::fill QPaintEngineEx::stroke...

OSV-2021-902 Heap-buffer-overflow in ebitmap_match_any

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35553 Crash type: Heap-buffer-overflow READ 8 Crash state: ebitmapmatchany avtabmap cilcheckneverallow...

OSV-2021-901 Stack-use-after-return in __readlink

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35565 Crash type: Stack-use-after-return WRITE 8 Crash state: readlink v9fscoreadlink v9fsreadlink...

OSV-2021-900 Negative-size-param in WebPRescalerInit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35583 Crash type: Negative-size-param Crash state: WebPRescalerInit AllocateAndInitRescaler VP8LDecodeImage...

OSV-2021-899 Heap-buffer-overflow in synth_name_to_path

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35548 Crash type: Heap-buffer-overflow READ 8 Crash state: synthnametopath v9fsconametopath v9fscompleterename...

OSV-2021-897 Heap-buffer-overflow in ZSTD_decompressMultiFrame

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35537 Crash type: Heap-buffer-overflow READ Crash state: ZSTDdecompressMultiFrame ZSTDdecompressusingDDict bloscd...

OSV-2021-895 Segv on unknown address in helper_uc_tracecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35514 Crash type: Segv on unknown address Crash state: helpeructracecode...

OSV-2021-892 Heap-buffer-overflow in explicit_bzero

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35485 Crash type: Heap-buffer-overflow WRITE Crash state: explicitbzero cryptofree sshdisconnect...