OSV-2022-349 Heap-buffer-overflow in JS_CallInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46701 Crash type: Heap-buffer-overflow READ 1 Crash state: JSCallInternal JSEvalFunctionInternal JSEvalInternal...

OSV-2022-309 UNKNOWN READ in decompress_smooth_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46349 Crash type: UNKNOWN READ Crash state: decompresssmoothdata processdatasimplemain jpegreadscanlines...

OSV-2022-188 Incorrect-function-pointer-type in cv::split

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44937 Crash type: Incorrect-function-pointer-type Crash state: cv::split cv::split TestSplitAndMerge...

OSV-2022-177 UNKNOWN READ in gx_dc_default_fill_masked

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44855 Crash type: UNKNOWN READ Crash state: gxdcdefaultfillmasked copyportrait imagerendersimple...

OSV-2022-121 Heap-buffer-overflow in s_hex_process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44406 Crash type: Heap-buffer-overflow READ 1 Crash state: shexprocess sexDprocess sreadbuf...

OSV-2021-1804 Heap-buffer-overflow in ndpi_workflow_process_packet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43921 Crash type: Heap-buffer-overflow READ 2 Crash state: ndpiworkflowprocesspacket fuzzndpireader.c...

OSV-2021-1759 Heap-use-after-free in zend_hash_reverse_apply

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42894 Crash type: Heap-use-after-free READ 4 Crash state: zendhashreverseapply shutdowndestructors zendcalldestructors...

OSV-2021-1730 Heap-buffer-overflow in seturl

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42708 Crash type: Heap-buffer-overflow READ Crash state: seturl parseurl curlurlset...

OSV-2021-1692 Heap-use-after-free in chunk_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42324 Crash type: Heap-use-after-free READ 8 Crash state: chunkfreeobject pdfiopenmemorystreamfromfilteredstream pdfibuildmeshshading...

OSV-2021-1604 Heap-buffer-overflow in jxl::N_AVX2::SingleFromSingle

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41225 Crash type: Heap-buffer-overflow READ Crash state: jxl::NAVX2::SingleFromSingle jxl::ThreadPool::SequentialRunnerStatic jxl::ModularFrameDecoder::ModularImageToDecodedRect...

OSV-2021-1597 UNKNOWN READ in void jxl::CopyImageTo<int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41217 Crash type: UNKNOWN READ Crash state: void jxl::CopyImageTo jxl::ModularFrameDecoder::DecodeGroup jxl::FrameDecoder::ProcessACGroup...

OSV-2021-1554 UNKNOWN READ in helper_uc_tracecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40797 Crash type: UNKNOWN READ Crash state: helpeructracecode...

OSV-2021-1451 Heap-buffer-overflow in Imf_3_1::memstream_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39936 Crash type: Heap-buffer-overflow WRITE 1 Crash state: Imf31::memstreamread dispatchread readuncompresseddirect...

OSV-2021-1410 Heap-buffer-overflow in generic_unpack

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39571 Crash type: Heap-buffer-overflow WRITE 4 Crash state: genericunpack exrdecodingrun Imf31::checkCoreFile...

OSV-2021-1409 Heap-buffer-overflow in unpack_16bit_4chan_planar

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39538 Crash type: Heap-buffer-overflow WRITE 2 Crash state: unpack16bit4chanplanar exrdecodingrun Imf31::checkCoreFile...

OSV-2021-1395 Heap-buffer-overflow in Op_YCbCr_to_RGB<unsigned char>::convert_colorspace

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39373 Crash type: Heap-buffer-overflow READ Crash state: OpYCbCrtoRGB::convertcolorspace heif::ColorConversionPipeline::convertimage heif::convertcolorspace...

OSV-2021-1378 Container-overflow in std::__1::__function::__func<LLVMFuzzerTestOneInput::$_0, std::__1::allocator<LL

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39263 Crash type: Container-overflow READ 1 Crash state: std::1::function::funcLLVMFuzzerTestOneInput::$0, std::1::allocatorLL std::1::function::funcLLVMFuzzerTestOneInput::$1, std::1::allocatorLL function.h...

OSV-2021-1354 Stack-buffer-underflow in InterpretPhoneme

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39042 Crash type: Stack-buffer-underflow READ 8 Crash state: InterpretPhoneme InterpretPhoneme2 CalcLengths...

OSV-2021-1352 UNKNOWN READ in MqttProps_Free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39070 Crash type: UNKNOWN READ Crash state: MqttPropsFree MqttClientUnsubscribe wolfMQTTFuzzer::unsubscribe...

OSV-2021-1160 Heap-buffer-overflow in pe_valid_dll_name

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37443 Crash type: Heap-buffer-overflow READ 1 Crash state: pevaliddllname peparsedelayimportdllname peparsedelayedimports...

OSV-2021-1102 Heap-use-after-free in usbredirparser_serialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36861 Crash type: Heap-use-after-free WRITE 4 Crash state: usbredirparserserialize tryserialize usbredirparserfuzz.cc...

OSV-2021-1003 Dynamic-stack-buffer-overflow in mdb_numeric_to_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36187 Crash type: Dynamic-stack-buffer-overflow WRITE 16 Crash state: mdbnumerictostring mdbxferbounddata mdbattemptbind...

OSV-2021-997 Heap-buffer-overflow in ZSTD_createDDict_advanced

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36103 Crash type: Heap-buffer-overflow READ Crash state: ZSTDcreateDDictadvanced ZSTDcreateDDict bloscrundecompressionwithcontext...

OSV-2021-900 Negative-size-param in WebPRescalerInit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35583 Crash type: Negative-size-param Crash state: WebPRescalerInit AllocateAndInitRescaler VP8LDecodeImage...

OSV-2021-847 Heap-buffer-overflow in frame_get_vlmetalayers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35086 Crash type: Heap-buffer-overflow READ Crash state: framegetvlmetalayers frametoschunk blosc2schunkfrombuffer...

OSV-2021-812 Uncaught exception in com.esotericsoftware.kryo.serializers.FieldSerializer.read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34733 Crash type: Uncaught exception Crash state: com.esotericsoftware.kryo.serializers.FieldSerializer.read com.esotericsoftware.kryo.Kryo.readObject DeserializeStringFuzzer.fuzzerTestOneInput...

OSV-2021-765 Heap-use-after-free in LookupDict2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34298 Crash type: Heap-use-after-free READ 4 Crash state: LookupDict2 LookupDictList Lookup...

OSV-2021-688 Segv on unknown address in std::__Fuzzer::basic_string<char, std::__Fuzzer::char_traits<char>, std::__Fuzze

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33682 Crash type: Segv on unknown address Crash state: std::Fuzzer::basicstring, std::Fuzze std::Fuzzer::moneypunctbyname::init...

OSV-2021-652 Heap-use-after-free in ZSTD_freeDDict

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33324 Crash type: Heap-use-after-free READ 4 Crash state: ZSTDfreeDDict blosc2freectx blosc2schunkfree...

OSV-2021-559 Uncaught exception in java.base/java.nio.CharBuffer.wrap

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32405 Crash type: Uncaught exception Crash state: java.base/java.nio.CharBuffer.wrap java.base/sun.nio.cs.StreamDecoder.implRead java.base/sun.nio.cs.StreamDecoder.read...

OSV-2021-464 Heap-buffer-overflow in blosc_read_header

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31535 Crash type: Heap-buffer-overflow READ 16 Crash state: bloscreadheader blosc2cbuffersizes framegetlazychunk...

OSV-2020-2308 Heap-buffer-overflow in derive_collocated_motion_vectors

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30568 Crash type: Heap-buffer-overflow READ 1 Crash state: derivecollocatedmotionvectors derivetemporallumavectorprediction filllumamotionvectorpredictors...

OSV-2021-260 Heap-buffer-overflow in flb_parser_json_do

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30090 Crash type: Heap-buffer-overflow READ Crash state: flbparserjsondo flbparserdo parserfuzzer.c...

OSV-2021-236 Heap-use-after-free in DatasetAdd

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29886 Crash type: Heap-use-after-free READ 4 Crash state: DatasetAdd DetectDatasetBufferMatch DetectEngineContentInspection...

OSV-2018-441 Stack-buffer-underflow in ps_index

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9970 Crash type: Stack-buffer-underflow READ 8 Crash state: psindex psrun evalpostscriptfunc...

OSV-2018-388 Use-of-uninitialized-value in MatShaperEval16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5748 Crash type: Use-of-uninitialized-value Crash state: MatShaperEval16 PrecalculatedXFORM cmsDoTransform...

OSV-2018-362 Use-of-uninitialized-value in fz_unpack_tile

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11022 Crash type: Use-of-uninitialized-value Crash state: fzunpacktile fzdecompimagefromstream compressedimagegetpixmap...

OSV-2021-184 Heap-buffer-overflow in H5HL__fl_deserialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29580 Crash type: Heap-buffer-overflow READ 1 Crash state: H5HLfldeserialize H5HLcachedatablockdeserialize H5Cloadentry...

OSV-2021-169 Heap-buffer-overflow in H5O__cont_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29549 Crash type: Heap-buffer-overflow READ 1 Crash state: H5Ocontdecode H5Ochunkdeserialize H5Ocachedeserialize...

OSV-2017-104 Heap-buffer-overflow in Unpack::CopyString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4373 Crash type: Heap-buffer-overflow WRITE 1 Crash state: Unpack::CopyString Unpack::Unpack5 CmdExtract::ExtractCurrentFile...

OSV-2017-76 Use-of-uninitialized-value in Archive::ConvertFileHeader

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4279 Crash type: Use-of-uninitialized-value Crash state: Archive::ConvertFileHeader Archive::ReadHeader15 Archive::ReadHeader...

OSV-2017-64 Use-of-uninitialized-value in SetExtraInfo20

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4408 Crash type: Use-of-uninitialized-value Crash state: SetExtraInfo20 CmdExtract::ExtractCurrentFile CmdExtract::ExtractArchive...

OSV-2021-144 Use-of-uninitialized-value in rawspeed::RawImageData::checkMemIsInitialized

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7171 Crash type: Use-of-uninitialized-value Crash state: rawspeed::RawImageData::checkMemIsInitialized Cr2Decompressor.cpp rawspeed::alignedMalloc...

OSV-2018-208 Global-buffer-overflow in bloaty::wasm::Section::Read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9540 Crash type: Global-buffer-overflow READ 8 Crash state: bloaty::wasm::Section::Read bloaty::wasm::ParseSections bloaty::wasm::WebAssemblyObjectFile::ProcessFile...

OSV-2018-146 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11526 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short OT::KernSubTable::getsize void hbsanitizecontextt::setobjectOT::KernSubTableOT::KernOTSubTableHeader...

OSV-2018-95 Heap-use-after-free in Envoy::FakeConnectionBase::close

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8783 Crash type: Heap-use-after-free READ 1 Crash state: Envoy::FakeConnectionBase::close Envoy::Event::DispatcherImpl::runPostCallbacks eventprocessactivesinglequeue...

OSV-2017-14 Use-of-uninitialized-value in Archive::ConvertFileHeader

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4614 Crash type: Use-of-uninitialized-value Crash state: Archive::ConvertFileHeader Archive::ReadHeader15 Archive::ReadHeader...

OSV-2020-2197 Heap-use-after-free in decode_NXAST_RAW_ENCAP

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27851 Crash type: Heap-use-after-free WRITE 2 Crash state: decodeNXASTRAWENCAP ofpactdecode ofpactsdecode...

OSV-2020-2168 Heap-buffer-overflow in H5D__scatter_mem

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27625 Crash type: Heap-buffer-overflow WRITE Crash state: H5Dscattermem H5Dscatgathread H5Dcontigread...

OSV-2020-2122 Heap-buffer-overflow in void parquet::internal::DefRepLevelsToListInfo<int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26829 Crash type: Heap-buffer-overflow WRITE 1 Crash state: void parquet::internal::DefRepLevelsToListInfo parquet::internal::DefRepLevelsToBitmap parquet::arrow::StructReader::BuildArray...