OSV-2023-1378 Heap-buffer-overflow in ih264d_get_bits_h264

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65418 Crash type: Heap-buffer-overflow READ 4 Crash state: ih264dgetbitsh264 ih264dparsefgc ih264dparseseipayload...

OSV-2023-1360 Heap-buffer-overflow in NetworkInterface::dissectPacket

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65332 Crash type: Heap-buffer-overflow READ 2 Crash state: NetworkInterface::dissectPacket fuzzdissectpacket.cpp...

OSV-2023-1322 UNKNOWN READ in ih264d_filter_boundary_left_nonmbaff

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65132 Crash type: UNKNOWN READ Crash state: ih264dfilterboundaryleftnonmbaff ih264ddeblockmbnonmbaff ih264ddecoderecontfrnmb...

OSV-2023-1276 Heap-use-after-free in authentic_emu_update_tokeninfo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64898 Crash type: Heap-use-after-free READ 8 Crash state: authenticemuupdatetokeninfo scpkcs15initupdatetokeninfo scpkcs15initupdatelastupdate...

OSV-2023-1259 Use-of-uninitialized-value in std::__1::__stdoutbuf<char>::xsputn

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64693 Crash type: Use-of-uninitialized-value Crash state: std::1::stdoutbuf::xsputn std::1::ostreambufiterator std::1::pa std::1::basicostream & std::1::putcha...

OSV-2023-1239 Heap-buffer-overflow in decToString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64574 Crash type: Heap-buffer-overflow WRITE 1 Crash state: decToString decNumberToString jvnumbergetliteral...

OSV-2023-1222 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64514 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr java.base/java.nio.ByteBuffer.position java.base/sun.nio.cs.UTF8.updatePositions...

OSV-2023-1171 Heap-buffer-overflow in pcpp::SomeIpSdLayer::SomeIpSdLayer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64190 Crash type: Heap-buffer-overflow READ 2 Crash state: pcpp::SomeIpSdLayer::SomeIpSdLayer pcpp::SomeIpLayer::parseSomeIpLayer pcpp::SomeIpLayer::parseNextLayer...

OSV-2023-1153 Heap-buffer-overflow in pcpp::SSLClientHelloMessage::getCipherSuite

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64124 Crash type: Heap-buffer-overflow READ 2 Crash state: pcpp::SSLClientHelloMessage::getCipherSuite readParsedPacket FuzzTarget.cpp...

OSV-2023-617 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60844 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr java.base/java.lang.Exception. java.base/java.lang.RuntimeException...

OSV-2023-215 Global-buffer-overflow in htmlParsePI

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57304 Crash type: Global-buffer-overflow READ 1 Crash state: htmlParsePI htmlParseDocument htmlDoRead...

OSV-2023-160 Global-buffer-overflow in OT::gvar::accelerator_t::apply_deltas_to_points

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56800 Crash type: Global-buffer-overflow READ 2 Crash state: OT::gvar::acceleratort::applydeltastopoints bool OT::glyfimpl::Glyph::getpoints bool OT::glyfimpl::Glyph::getpoints...

OSV-2022-1157 Stack-buffer-overflow in merge_utf16be_ascii

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53149 Crash type: Stack-buffer-overflow WRITE 1 Crash state: mergeutf16beascii probeisoNUMBER superblocksprobe...

OSV-2022-1121 Global-buffer-overflow in get_unpack_proc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52870 Crash type: Global-buffer-overflow READ 8 Crash state: getunpackproc xpsbegintypedimage epobegintypedimage...

OSV-2022-774 Segv on unknown address in cranelift_filetests::function_runner::CompiledFunction::call::ha6b9162cd2eNUMBER

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50556 Crash type: Segv on unknown address Crash state: craneliftfiletests::functionrunner::CompiledFunction::call::ha6b9162cd2eNUMBER...

OSV-2022-669 Heap-buffer-overflow in llvm::DataLayout::getIndexedOffsetInType

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49728 Crash type: Heap-buffer-overflow READ 4 Crash state: llvm::DataLayout::getIndexedOffsetInType InterpreterStackFrame::ResolveConstantValue InterpreterStackFrame::ResolveConstant...

OSV-2022-598 Heap-buffer-overflow in get_symbols_64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49209 Crash type: Heap-buffer-overflow READ 8 Crash state: getsymbols64 getmain64 binsym...

OSV-2022-485 Segv on unknown address in duckdb::ExpressionBinder::BindExpression

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48047 Crash type: Segv on unknown address Crash state: duckdb::ExpressionBinder::BindExpression duckdb::ExpressionBinder::BindExpression duckdb::SelectBinder::BindExpression...

OSV-2022-295 Use-of-uninitialized-value in unsigned long grk::N_SSE4::vscheduler<grk::N_SSE4::DecompressDcShiftIrrev>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46241 Crash type: Use-of-uninitialized-value Crash state: unsigned long grk::NSSE4::vscheduler std::1::function::funcunsigned long grk::NSSE4::vschedulergrk::NSSE4:: tf::Executor::invoke...

OSV-2022-289 Heap-buffer-overflow in add_compile_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46086 Crash type: Heap-buffer-overflow READ 4 Crash state: addcompilestring compiletree compiletree...

OSV-2022-264 Heap-buffer-overflow in jxl::N_AVX2::BlendingStage::ProcessRow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45822 Crash type: Heap-buffer-overflow READ 4 Crash state: jxl::NAVX2::BlendingStage::ProcessRow jxl::LowMemoryRenderPipeline::RenderRect jxl::LowMemoryRenderPipeline::ProcessBuffers...

OSV-2022-128 Stack-buffer-overflow in decompress_rNUMBER

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44432 Crash type: Stack-buffer-overflow WRITE 1 Crash state: decompressrNUMBER readrNUMBERmetadata dwgdecode...

OSV-2022-35 Use-after-poison in absl::BytesToHexString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43554 Crash type: Use-after-poison READ 1 Crash state: absl::BytesToHexString...

OSV-2021-1795 Negative-size-param in general_endcidrange_func

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43156 Crash type: Negative-size-param Crash state: generalendcidrangefunc cmapendcidrangefunc pdfipscriptinterpret...

OSV-2021-1663 Heap-buffer-overflow in ndlz4_decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42131 Crash type: Heap-buffer-overflow WRITE Crash state: ndlz4decompress bloscd dojob...

OSV-2021-1640 Global-buffer-overflow in draco::MeshEdgebreakerDecoderImpl<draco::MeshEdgebreakerTraversalValenceDecoder>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41545 Crash type: Global-buffer-overflow READ 4 Crash state: draco::MeshEdgebreakerDecoderImpl draco::MeshEdgebreakerDecoderImpl draco::MeshDecoder::DecodeGeometryData...

OSV-2021-1478 Uncaught exception in com.alibaba.fastjson.parser.DefaultJSONParser.parseObject

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40208 Crash type: Uncaught exception Crash state: com.alibaba.fastjson.parser.DefaultJSONParser.parseObject java.base/java.util.HashMap.tableSizeFor java.base/java.util.HashMap...

OSV-2021-1392 Container-overflow in std::__1::__function::__func<uWS::TemplatedApp<false>&& uWS::TemplatedApp<false>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39354 Crash type: Container-overflow READ 1 Crash state: std::1::function::func&& uWS::TemplatedApp uWS::TopicTree::publish ofats::anydetail::handlertraitsvoid, uWS::WebSocketfalse, true, test...

OSV-2021-1390 Container-overflow in std::__1::__function::__func<uWS::TemplatedApp<false>&& uWS::TemplatedApp<false>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39348 Crash type: Container-overflow READ 1 Crash state: std::1::function::func&& uWS::TemplatedApp uWS::WebSocketfalse, true, test uWS::WebSocketfalse, true, test...

OSV-2021-1368 Stack-buffer-overflow in dispatch_print_error

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39196 Crash type: Stack-buffer-overflow READ Crash state: dispatchprinterror internalexrparseheader exrstartread...

OSV-2021-1171 Heap-buffer-overflow in luaG_runerror

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37621 Crash type: Heap-buffer-overflow READ 8 Crash state: luaGrunerror luaDpretailcall luaVexecute...

OSV-2021-1153 Heap-buffer-overflow in hb_array_t<OT::IntType<unsigned int, 4u> const> hb_array_t<OT::IntType<unsigned

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37348 Crash type: Heap-buffer-overflow READ 4 Crash state: hbarrayt const hbarrayt ::copy hbheadt , decltype...

OSV-2021-1128 Heap-buffer-overflow in exif_mnote_data_apple_identify

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37211 Crash type: Heap-buffer-overflow READ 3 Crash state: exifmnotedataappleidentify interpretmakernote exifdataloaddata...

OSV-2021-950 Dynamic-stack-buffer-overflow in std::__1::__wrap_iter<hsql::Expr**>::__wrap_iter

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35944 Crash type: Dynamic-stack-buffer-overflow WRITE 8 Crash state: std::1::wrapiter::wrapiter std::1::vector ::makeiter std::1::vector ::begin...

OSV-2021-929 Heap-buffer-overflow in extract_name

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35858 Crash type: Heap-buffer-overflow WRITE 1 Crash state: extractname hashquestions fuzzutil.c...

OSV-2021-840 Use-after-poison in AK::RefPtr<AK::StringImpl, AK::RefPtrTraits<AK::StringImpl> >::RefPtr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34971 Crash type: Use-after-poison WRITE 8 Crash state: AK::RefPtr ::RefPtr AK::String::String JS::abstractrelation...

OSV-2021-804 Heap-use-after-free in AK::NonnullOwnPtr<JS::IndexedPropertyStorage>::operator->

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34688 Crash type: Heap-use-after-free READ 8 Crash state: AK::NonnullOwnPtr::operator- JS::IndexedProperties::arraylikesize JS::IndexedProperties::append...

OSV-2021-635 Heap-use-after-free in std::__1::__tree_iterator<std::__1::__value_type<std::__1::basic_string<char, st

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33227 Crash type: Heap-use-after-free READ 8 Crash state: std::1::treeiteratorstd::1::valuetypestd::1::basicstringchar, st void draco::Metadata::AddEntrystd::1::vectorunsigned char, std::1::allocat...

OSV-2021-500 Heap-buffer-overflow in put_epel_8_fallback

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31738 Crash type: Heap-buffer-overflow READ 1 Crash state: putepel8fallback accelerationfunctions::puthevcepel void mcchroma...

OSV-2021-349 Heap-buffer-overflow in flatbuffers::vector_downward::fill

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30684 Crash type: Heap-buffer-overflow WRITE 1 Crash state: flatbuffers::vectordownward::fill flatbuffers::FlatBufferBuilder::PreAlign flatbuffers::FlatBufferBuilder::ForceVectorAlignment...

OSV-2021-204 Heap-buffer-overflow in WelsDec::NeedErrorCon

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29604 Crash type: Heap-buffer-overflow READ 1 Crash state: WelsDec::NeedErrorCon WelsDec::CheckAndFinishLastPic WelsDecodeBs...

OSV-2017-161 Global-buffer-overflow in vte_write_debug

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=449 Crash type: Global-buffer-overflow READ 1 Crash state: vtewritedebug doexecute doaction...

OSV-2017-157 Global-buffer-overflow in vte_write_debug

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=744 Crash type: Global-buffer-overflow READ 1 Crash state: vtewritedebug dotrans tsmvteinput...

OSV-2017-120 Global-buffer-overflow in csnStreamDissector

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1571 Crash type: Global-buffer-overflow READ 2 Crash state: csnStreamDissector csnStreamDissector csnStreamDissector...

OSV-2017-121 Global-buffer-overflow in vte_write_debug

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8923 Crash type: Global-buffer-overflow READ 1 Crash state: vtewritedebug dotrans tsmvteinput...

OSV-2017-119 Stack-buffer-overflow in ot::MeshCoP::CommissionerSessionIdTlv::GetCommissionerSessionId

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3376 Crash type: Stack-buffer-overflow READ 2 Crash state: ot::MeshCoP::CommissionerSessionIdTlv::GetCommissionerSessionId ot::NetworkData::Leader::HandleCommissioningSet ot::Coap::Coap::ProcessReceivedRequest...

OSV-2017-117 Use-of-uninitialized-value in CharToWide

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4290 Crash type: Use-of-uninitialized-value Crash state: CharToWide Archive::GetComment Archive::ViewComment...

OSV-2017-93 Use-of-uninitialized-value in CharToWideMap

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4285 Crash type: Use-of-uninitialized-value Crash state: CharToWideMap CharToWide Archive::GetComment...

OSV-2017-72 Use-of-uninitialized-value in _gnutls_mpi_dprint_size

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1494 Crash type: Use-of-uninitialized-value Crash state: gnutlsmpidprintsize wrapnettlepkencrypt gnutlsgenrsaclientkx...

OSV-2017-65 Use-of-uninitialized-value in Archive::GetComment

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4275 Crash type: Use-of-uninitialized-value Crash state: Archive::GetComment Archive::ViewComment CmdExtract::ExtractArchive...