OSV-2020-1308 Heap-use-after-free in Interpreter::evaluate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15846 Crash type: Heap-use-after-free READ 4 Crash state: Interpreter::evaluate Interpreter::manifestJson Interpreter::evaluate...

OSV-2020-1307 Heap-buffer-overflow in pcpp::IPv6Extension::getExtensionLen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22636 Crash type: Heap-buffer-overflow READ 1 Crash state: pcpp::IPv6Extension::getExtensionLen pcpp::IPv6Layer::parseExtensions pcpp::IPv6Layer::IPv6Layer...

OSV-2020-1300 Heap-buffer-overflow in ihevcd_parse_slice_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17036 Crash type: Heap-buffer-overflow WRITE 1 Crash state: ihevcdparseslicedata ihevcddecode ihevcdcxaapifunction...

OSV-2020-1299 UNKNOWN WRITE in ideint_weave_blk

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17084 Crash type: UNKNOWN WRITE Crash state: ideintweaveblk ideintprocess impeg2ddeinterlace...

OSV-2020-1298 Heap-buffer-overflow in char const* Sass::Prelexer::alternatives<&

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Heap-buffer-overflow READ 1 Crash state: char const Sass::Prelexer::alternatives& char const Sass::Prelexer::alternatives& char const Sass::Prelexer::sequence&...

OSV-2020-1306 Use-of-uninitialized-value in TIFFYCbCrtoRGB

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16602 Crash type: Use-of-uninitialized-value Crash state: TIFFYCbCrtoRGB putcontig8bitYCbCr42tile gtTileContig...

OSV-2020-1292 Stack-buffer-overflow in ot::ExtendedTlv::GetLength

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20775 Crash type: Stack-buffer-overflow READ 2 Crash state: ot::ExtendedTlv::GetLength ot::Tlv::GetSize ot::Tlv::GetNext...

OSV-2020-1294 Heap-buffer-overflow in SHA1Update

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18740 Crash type: Heap-buffer-overflow READ Crash state: SHA1Update getSSCertificateFingerprint tlsDetectProtocolFromCertificate...

OSV-2020-1289 Heap-use-after-free in WelsDec::MapColToList0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13037 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::MapColToList0 WelsDec::PredBDirectTemporal WelsDec::ParseInterBInfo...

OSV-2020-1290 Bad-free in aes_gcm_cleanup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14333 Crash type: Bad-free Crash state: aesgcmcleanup EVPCIPHERCTXfree cryptofuzz::module::CTXCopier::copy...

OSV-2020-1291 UNKNOWN READ in std::__1::_MetaBase<__can_be_converted_to_string_view<char, std::__1::char_trait

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23429 Crash type: UNKNOWN READ Crash state: std::1::MetaBase, std::1::allocator std::1::treeiteratorstd::1::valuetypestd::1::basicstringchar, st...

OSV-2020-1274 Heap-buffer-overflow in exif_entry_get_value

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14543 Crash type: Heap-buffer-overflow READ 7 Crash state: exifentrygetvalue contentfunc exifcontentforeachentry...

OSV-2020-1278 Use-of-uninitialized-value in SampledFunction::SampledFunction

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12608 Crash type: Use-of-uninitialized-value Crash state: SampledFunction::SampledFunction Function::parse Function::parse...

OSV-2020-1285 Use-of-uninitialized-value in ihevc_deblk_luma_vert_ssse3

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17009 Crash type: Use-of-uninitialized-value Crash state: ihevcdeblklumavertssse3 ihevcddeblkctb ihevcdprocess...

OSV-2020-1272 Heap-buffer-overflow in ASN1_get_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13803 Crash type: Heap-buffer-overflow READ 1 Crash state: ASN1getobject asn1checktlen asn1itemexd2i...

OSV-2020-1264 Use-of-uninitialized-value in AnnotAppearanceBuilder::drawText

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17607 Crash type: Use-of-uninitialized-value Crash state: AnnotAppearanceBuilder::drawText AnnotAppearanceBuilder::drawFormFieldChoice AnnotAppearanceBuilder::drawFormField...

OSV-2020-1266 UNKNOWN READ in arrow::Array::IsNull

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20139 Crash type: UNKNOWN READ Crash state: arrow::Array::IsNull arrow::Status arrow::VisitArrayInline arrow::internal::ValidateArrayData...

OSV-2020-1260 Negative-size-param in heif::HeifPixelImage::fill_RGB_16bit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13563 Crash type: Negative-size-param Crash state: heif::HeifPixelImage::fillRGB16bit heif::HeifContext::decodeoverlayimage heif::HeifContext::decodeimage...

OSV-2020-1250 Heap-use-after-free in WelsDec::MapColToList0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13185 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::MapColToList0 WelsDec::ParseInterBMotionInfoCabac WelsDec::WelsDecodeMbCabacBSliceBaseMode0...

OSV-2020-1253 Heap-buffer-overflow in pixReadFromTiffStream

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21435 Crash type: Heap-buffer-overflow WRITE 1 Crash state: pixReadFromTiffStream pixReadMemTiff pixReadMem...