OSV-2020-1172 Global-buffer-overflow in WelsDec::ParseInterBInfo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12652 Crash type: Global-buffer-overflow READ 1 Crash state: WelsDec::ParseInterBInfo WelsDec::WelsActualDecodeMbCavlcBSlice WelsDec::WelsDecodeMbCavlcBSlice...

OSV-2020-1127 Use-of-uninitialized-value in WelsDec::CWelsDecoder::ReorderPicturesInDisplay

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12647 Crash type: Use-of-uninitialized-value Crash state: WelsDec::CWelsDecoder::ReorderPicturesInDisplay WelsDec::CWelsDecoder::DecodeFrame2 WelsDec::CWelsDecoder::DecodeFrameNoDelay...

OSV-2020-1115 Heap-use-after-free in WelsDec::MapColToList0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13941 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::MapColToList0 WelsDec::PredBDirectTemporal WelsDec::ParseInterBInfo...

OSV-2020-1098 Heap-use-after-free in WelsDec::MapColToList0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14060 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::MapColToList0 WelsDec::PredBDirectTemporal WelsDec::ParseInterBInfo...

OSV-2020-1049 Heap-use-after-free in WelsDec::WelsReorderRefList

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14027 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::WelsReorderRefList WelsDec::InitRefPicList WelsDec::DecodeCurrentAccessUnit...

OSV-2020-1042 Heap-use-after-free in WelsDec::MapColToList0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14267 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::MapColToList0 WelsDec::PredBDirectTemporal WelsDec::WelsDecodeMbCavlcBSlice...

OSV-2020-1041 Use-of-uninitialized-value in McCopyWidthEq16_c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13005 Crash type: Use-of-uninitialized-value Crash state: McCopyWidthEq16c WelsDec::BaseMC WelsDec::GetInterPred...

OSV-2020-736 Heap-use-after-free in WelsDec::DecreasePicBuff

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14423 Crash type: Heap-use-after-free READ 8 Crash state: WelsDec::DecreasePicBuff WelsRequestMem SyncPictureResolutionExt...

OSV-2020-692 Heap-use-after-free in WelsDec::SetUnRef

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18458 Crash type: Heap-use-after-free WRITE 1 Crash state: WelsDec::SetUnRef WelsDec::SlidingWindow WelsDec::WelsMarkAsRef...

OSV-2020-681 Heap-use-after-free in WelsDec::SetUnRef

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18459 Crash type: Heap-use-after-free WRITE 1 Crash state: WelsDec::SetUnRef WelsDec::WelsDelLongFromListSetUnref WelsDec::MMCOProcess...

OSV-2020-671 Heap-use-after-free in WelsDec::SetUnRef

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18743 Crash type: Heap-use-after-free WRITE 1 Crash state: WelsDec::SetUnRef WelsDec::SlidingWindow WelsDec::WelsMarkAsRef...

OSV-2020-607 UNKNOWN READ in WelsDec::CWelsDecoder::DecodeFrame2WithCtx

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18864 Crash type: UNKNOWN READ Crash state: WelsDec::CWelsDecoder::DecodeFrame2WithCtx WelsDec::CWelsDecoder::DecodeFrame2 WelsDec::CWelsDecoder::DecodeFrameNoDelay...

OSV-2020-578 Heap-use-after-free in WelsDec::ResetRefPicReferences

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13450 Crash type: Heap-use-after-free READ 8 Crash state: WelsDec::ResetRefPicReferences WelsDec::DecreasePicBuff WelsRequestMem...

OSV-2020-555 Heap-use-after-free in WelsDec::CWelsDecoder::SetOption

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18747 Crash type: Heap-use-after-free WRITE 1 Crash state: WelsDec::CWelsDecoder::SetOption decoderfuzzer.cpp WelsCommon::WelsFree...

OSV-2020-502 Heap-use-after-free in WelsDec::SetUnRef

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18644 Crash type: Heap-use-after-free WRITE 1 Crash state: WelsDec::SetUnRef WelsDec::WelsResetRefPic WelsFreeDynamicMemory...

OSV-2020-503 Heap-use-after-free in WelsDec::SetUnRef

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18438 Crash type: Heap-use-after-free WRITE 1 Crash state: WelsDec::SetUnRef WelsDec::WelsResetRefPic WelsFreeDynamicMemory...

OSV-2020-414 Heap-use-after-free in WelsDec::MapColToList0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14035 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::MapColToList0 WelsDec::PredBDirectTemporal WelsDec::WelsDecodeMbCavlcBSlice...

OSV-2020-261 Use-of-uninitialized-value in WelsDec::CWelsDecoder::ReleaseBufferedReadyPicture

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18744 Crash type: Use-of-uninitialized-value Crash state: WelsDec::CWelsDecoder::ReleaseBufferedReadyPicture WelsDec::CWelsDecoder::ReorderPicturesInDisplay WelsDec::CWelsDecoder::DecodeFrame2WithCtx...

openh264:decoder_fuzzer: Heap-use-after-free in WelsDec::WelsReorderRefList

Project: https://github.com/cisco/openh264.git Detailed Report: https://oss-fuzz.com/testcase?key=5696756392394752 Project: openh264 Fuzzing Engine: libFuzzer Fuzz Target: decoderfuzzer Job Type: libfuzzerasanopenh264 Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address:...

openh264:decoder_fuzzer: Crash in WelsDec::CWelsDecoder::DecodeFrame2WithCtx

Project: https://github.com/cisco/openh264.git Detailed Report: https://oss-fuzz.com/testcase?key=5718090986029056 Project: openh264 Fuzzing Engine: libFuzzer Fuzz Target: decoderfuzzer Job Type: libfuzzerubsanopenh264 Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7fdd6a6f5080 Cras...