OSV-2020-1256 UNKNOWN WRITE in TIFFReadRGBATileExt

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14185 Crash type: UNKNOWN WRITE Crash state: TIFFReadRGBATileExt cv::TiffDecoder::readData cv::imread...

OSV-2020-1258 Heap-use-after-free in WelsDec::MapColToList0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13457 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::MapColToList0 WelsDec::PredBDirectTemporal WelsDec::ParseInterBMotionInfoCabac...

OSV-2020-1257 Stack-buffer-overflow in readstat_convert

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12579 Crash type: Stack-buffer-overflow WRITE 1 Crash state: readstatconvert dtahandlerow dtahandlerows...

OSV-2020-1244 Use-of-uninitialized-value in decimate_dsd_run

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19925 Crash type: Use-of-uninitialized-value Crash state: decimatedsdrun WavpackUnpackSamples fuzzer.cc...

OSV-2020-1242 Heap-buffer-overflow in ih264d_cavlc_parse4x4coeff_n8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16587 Crash type: Heap-buffer-overflow READ 4 Crash state: ih264dcavlcparse4x4coeffn8 ih264dcavlcparse8x8blockbothavailable ih264dparseresidual4x4cavlc...

OSV-2020-1235 Heap-buffer-overflow in mbc_case_fold

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21977 Crash type: Heap-buffer-overflow READ 1 Crash state: mbccasefold stringcmpic matchat...

OSV-2020-1240 Use-of-uninitialized-value in jbig2_decode_mmr_line

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17855 Crash type: Use-of-uninitialized-value Crash state: jbig2decodemmrline jbig2decodehalftonemmr jbig2decodegrayscaleimage...

OSV-2020-1238 Use-of-uninitialized-value in pcpp::Packet::createFirstLayer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22085 Crash type: Use-of-uninitialized-value Crash state: pcpp::Packet::createFirstLayer pcpp::Packet::setRawPacket FuzzTarget.cpp...

OSV-2020-1228 Heap-use-after-free in arrow::internal::CountSetBits

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20120 Crash type: Heap-use-after-free READ 8 Crash state: arrow::internal::CountSetBits arrow::Array::nullcount arrow::internal::ValidateArray...

OSV-2020-1226 Heap-buffer-overflow in void mc_chroma<unsigned short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13583 Crash type: Heap-buffer-overflow READ 2 Crash state: void mcchroma generateinterpredictionsamples decodepredictionunit...

OSV-2020-1229 Heap-buffer-overflow in Sass::Prelexer::quoted_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Heap-buffer-overflow READ 1 Crash state: Sass::Prelexer::quotedstring char const Sass::Prelexer::alternatives& char const Sass::Prelexer::sequence&...

OSV-2020-1232 Use-of-uninitialized-value in TIFFYCbCrtoRGB

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16844 Crash type: Use-of-uninitialized-value Crash state: TIFFYCbCrtoRGB putcontig8bitYCbCr22tile gtTileContig...

OSV-2020-1233 Heap-buffer-overflow in getTLScertificate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19269 Crash type: Heap-buffer-overflow READ 6 Crash state: getTLScertificate tlsDetectProtocolFromCertificate ndpisearchtlstcpudp...

OSV-2020-1231 Heap-buffer-overflow in find_dom

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15284 Crash type: Heap-buffer-overflow WRITE Crash state: finddom optloop bpfoptimize...

OSV-2020-1230 Heap-buffer-overflow in to_u32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16734 Crash type: Heap-buffer-overflow READ 1 Crash state: tou32 fuzzgettlvcomn fuzzaddmimepart...

OSV-2020-1212 Heap-buffer-overflow in helper_ret_stb_mmu_mips

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13489 Crash type: Heap-buffer-overflow READ 4 Crash state: helperretstbmmumips...

OSV-2020-1220 Heap-use-after-free in WelsDec::WelsReorderRefList

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12728 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::WelsReorderRefList WelsDec::DecodeCurrentAccessUnit WelsDec::ConstructAccessUnit...

OSV-2020-1211 Heap-buffer-overflow in ihevcd_parse_slice_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16805 Crash type: Heap-buffer-overflow READ 4 Crash state: ihevcdparseslicedata ihevcdnalunit ihevcddecode...

OSV-2020-1206 Use-of-uninitialized-value in Sass::Prelexer::quoted_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Use-of-uninitialized-value Crash state: Sass::Prelexer::quotedstring char const Sass::Prelexer::nongreedy& Sass::Parser::lookaheadforvalue...

OSV-2020-1203 Heap-use-after-free in WelsDec::WelsReorderRefList

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20491 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::WelsReorderRefList WelsDec::InitRefPicList WelsDec::DecodeCurrentAccessUnit...