OSV-2022-165 Stack-buffer-overflow in fmt::v8::basic_memory_buffer<unsigned int, 32ul, std::__1::allocator<unsigned in

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44763 Crash type: Stack-buffer-overflow READ 4 Crash state: fmt::v8::basicmemorybufferunsigned int, 32ul, std::1::allocatorunsigned in fmt::v8::detail::bigint::square fmt::v8::detail::bigint::assignpow10...

OSV-2022-116 Heap-buffer-overflow in parse_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44301 Crash type: Heap-buffer-overflow READ 4 Crash state: parseobject parseobject parseobject...

OSV-2022-105 Heap-buffer-overflow in parse_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44199 Crash type: Heap-buffer-overflow READ 4 Crash state: parseobject parseobject parseobject...

OSV-2021-1670 Dynamic-stack-buffer-overflow in zend_calc_live_ranges

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42156 Crash type: Dynamic-stack-buffer-overflow READ 4 Crash state: zendcalcliveranges passtwo zendcompilefuncdecl...

OSV-2021-1644 Container-overflow in void jxl::CopyImageTo<int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41608 Crash type: Container-overflow READ 4 Crash state: void jxl::CopyImageTo jxl::ModularFrameDecoder::DecodeGroup jxl::FrameDecoder::ProcessACGroup...

OSV-2021-1607 Container-overflow in void jxl::CopyImageTo<int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41235 Crash type: Container-overflow READ 4 Crash state: void jxl::CopyImageTo jxl::ModularFrameDecoder::DecodeGroup jxl::FrameDecoder::ProcessACGroup...

OSV-2021-1592 Heap-buffer-overflow in arrow::internal::ValidateArrayImpl::Visit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41143 Crash type: Heap-buffer-overflow READ 4 Crash state: arrow::internal::ValidateArrayImpl::Visit arrow::internal::ValidateArrayImpl::ValidateWithType arrow::internal::ValidateArrayImpl::Validate...

OSV-2021-1381 Heap-buffer-overflow in OT::MathValueRecord::copy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39225 Crash type: Heap-buffer-overflow READ 4 Crash state: OT::MathValueRecord::copy OT::MathGlyphAssembly::subset OT::MathGlyphConstruction::subset...

OSV-2021-1249 Heap-buffer-overflow in int flatbuffers::ReadScalar<int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38578 Crash type: Heap-buffer-overflow READ 4 Crash state: int flatbuffers::ReadScalar flatbuffers::Table::GetVTable flatbuffers::Table::GetOptionalFieldOffset...

OSV-2021-1235 Heap-buffer-overflow in ih264d_fill_bs1_16x16mb_pslice

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38387 Crash type: Heap-buffer-overflow READ 4 Crash state: ih264dfillbs116x16mbpslice ih264dcomputebsnonmbaffthread ih264drecondeblkslice...

OSV-2021-652 Heap-use-after-free in ZSTD_freeDDict

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33324 Crash type: Heap-use-after-free READ 4 Crash state: ZSTDfreeDDict blosc2freectx blosc2schunkfree...

OSV-2021-631 Heap-buffer-overflow in ih264d_decode_slice_thread

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33167 Crash type: Heap-buffer-overflow READ 4 Crash state: ih264ddecodeslicethread ih264ddecodepicturethread clone...

OSV-2021-496 Heap-buffer-overflow in blosc_d

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31710 Crash type: Heap-buffer-overflow READ 4 Crash state: bloscd dojob bloscrundecompressionwithcontext...

OSV-2021-485 Heap-buffer-overflow in blosc_run_decompression_with_context

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31585 Crash type: Heap-buffer-overflow READ 4 Crash state: bloscrundecompressionwithcontext blosc2decompressctx framedecompresschunk...

OSV-2021-223 Heap-buffer-overflow in fdilate_1_56

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29819 Crash type: Heap-buffer-overflow READ 4 Crash state: fdilate156 fmorphopgenlow1 pixFMorphopGen1...

OSV-2021-221 Heap-buffer-overflow in blosc_d

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29816 Crash type: Heap-buffer-overflow READ 4 Crash state: bloscd bloscgetitem bloscgetitem...

OSV-2017-22 Heap-buffer-overflow in opj_tcd_mct_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3331 Crash type: Heap-buffer-overflow READ 4 Crash state: opjtcdmctdecode opjtcddecodetile opjj2kdecodetile...

OSV-2018-170 Heap-use-after-free in yr_re_ast_split_at_chaining_point

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11752 Crash type: Heap-use-after-free READ 4 Crash state: yrreastsplitatchainingpoint yrparserreducestringdeclaration yarayyparse...

OSV-2017-5 Heap-buffer-overflow in opj_dwt_interleave_partial_v

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3115 Crash type: Heap-buffer-overflow READ 4 Crash state: opjdwtinterleavepartialv opjdwtdecodepartialtile opjtcddwtdecode...

OSV-2020-2259 Stack-buffer-overflow in ot::MeshCoP::ChannelMaskEntry::GetMask

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28556 Crash type: Stack-buffer-overflow READ 4 Crash state: ot::MeshCoP::ChannelMaskEntry::GetMask ot::MeshCoP::ChannelMaskTlv::GetChannelMask ot::MeshCoP::Dataset::ConvertTo...