OSV-2020-1135 Heap-buffer-overflow in sas_read4

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12584 Crash type: Heap-buffer-overflow READ 4 Crash state: sasread4 sas7bcatparseblock readstatparsesas7bcat...

OSV-2020-1114 Heap-buffer-overflow in ndpi_int_check_stun

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19332 Crash type: Heap-buffer-overflow READ 2 Crash state: ndpiintcheckstun ndpisearchstun checkndpiudpflowfunc...

OSV-2020-1046 Stack-buffer-overflow in sc_pkcs15emu_object_add

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19251 Crash type: Stack-buffer-overflow READ Crash state: scpkcs15emuobjectadd scpkcs15emucoolkeyinit scpkcs15emucoolkeyinitex...

OSV-2020-936 Global-buffer-overflow in arrow::Status arrow::VisitArrayInline<arrow::internal::ValidateArrayDataVisitor>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20181 Crash type: Global-buffer-overflow READ 1 Crash state: arrow::Status arrow::VisitArrayInline arrow::internal::ValidateArrayData arrow::RecordBatch::ValidateFull...

OSV-2020-889 Use-of-uninitialized-value in RGBTOHLS

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22740 Crash type: Use-of-uninitialized-value Crash state: RGBTOHLS XCFImageFormat::mergeRGBToRGB XCFImageFormat::mergeLayerIntoImage...

OSV-2020-873 Use-of-uninitialized-value in format_u8x

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21426 Crash type: Use-of-uninitialized-value Crash state: formatu8x formatodptungtpuopt formatodptunattr...

OSV-2020-866 UNKNOWN READ in icu_64::UCharsTrie::branchNext

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15671 Crash type: UNKNOWN READ Crash state: icu64::UCharsTrie::branchNext icu64::UCharsTrie::nextImpl icu64::UCharsTrie::next...

OSV-2020-859 UNKNOWN READ in H5O_sdspace_shared_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19220 Crash type: UNKNOWN READ Crash state: H5Osdspaceshareddecode H5Oattrshareddecode H5Omsgiteratereal...

OSV-2020-853 Use-of-uninitialized-value in llvm_ks::MCAssembler::computeFragmentSize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22482 Crash type: Use-of-uninitialized-value Crash state: llvmks::MCAssembler::computeFragmentSize llvmks::MCAsmLayout::layoutFragment llvmks::MCAsmLayout::ensureValid...

OSV-2020-851 Use-of-uninitialized-value in Mat_VarRead5

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17115 Crash type: Use-of-uninitialized-value Crash state: MatVarRead5 ReadNextStructField MatVarReadNextInfo5...

OSV-2020-805 UNKNOWN READ in H5MM_xstrdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17335 Crash type: UNKNOWN READ Crash state: H5MMxstrdup H5Genttolink H5Gnodeiterate...

OSV-2020-802 UNKNOWN READ

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22234 Crash type: UNKNOWN READ Crash state: NULL...

OSV-2020-775 Use-of-uninitialized-value in blosc_run_decompression_with_context

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23826 Crash type: Use-of-uninitialized-value Crash state: bloscrundecompressionwithcontext bloscdecompress fuzzdecompress.c...

OSV-2020-705 Use-of-uninitialized-value in xmlOutputBufferWriteEscape

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15768 Crash type: Use-of-uninitialized-value Crash state: xmlOutputBufferWriteEscape xmlNodeListDumpOutput xmlNodeDumpOutputInternal...

OSV-2020-679 Use-of-uninitialized-value in printUInt32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14642 Crash type: Use-of-uninitialized-value Crash state: printUInt32 printU1ImmOperand printInstruction...

OSV-2020-670 Memcpy-param-overlap in ot::Cli::CoapSecure::Process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12679 Crash type: Memcpy-param-overlap Crash state: ot::Cli::CoapSecure::Process ot::Cli::Interpreter::ProcessCoapSecure ot::Cli::Interpreter::ProcessLine...

OSV-2020-651 Stack-buffer-overflow in tvb_memcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15936 Crash type: Stack-buffer-overflow WRITE Crash state: tvbmemcpy quicextractheader dissectquic...

OSV-2020-630 Use-of-uninitialized-value in ares__parse_into_addrinfo2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15379 Crash type: Use-of-uninitialized-value Crash state: aresparseintoaddrinfo2 aresparseaaaareply ares-test-fuzz.c...

OSV-2020-568 Heap-use-after-free in proc_plaintext

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13730 Crash type: Heap-use-after-free READ 4 Crash state: procplaintext doprocpackets procsignaturepackets...

OSV-2020-530 Stack-buffer-overflow in ares_parse_aaaa_reply

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15459 Crash type: Stack-buffer-overflow WRITE 4 Crash state: aresparseaaaareply ares-test-fuzz.c...

OSV-2020-531 Stack-buffer-overflow in ot::MeshCoP::DatasetManager::HandleSet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15374 Crash type: Stack-buffer-overflow READ 15 Crash state: ot::MeshCoP::DatasetManager::HandleSet ot::MeshCoP::ActiveDataset::HandleSet ot::Coap::CoapBase::ProcessReceivedRequest...

OSV-2020-526 Use-of-uninitialized-value in Mat_VarRead4

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16857 Crash type: Use-of-uninitialized-value Crash state: MatVarRead4 MatVarReadDataAll matiofuzzer.cc...

OSV-2020-489 UNKNOWN READ in ot::Dhcp6::Dhcp6Client::ProcessNextIdentityAssociation

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13348 Crash type: UNKNOWN READ Crash state: ot::Dhcp6::Dhcp6Client::ProcessNextIdentityAssociation ot::Dhcp6::Dhcp6Client::Start ot::Dhcp6::Dhcp6Client::UpdateAddresses...

OSV-2020-466 Heap-buffer-overflow in LzmaDec_DecodeToDic

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17198 Crash type: Heap-buffer-overflow READ 1 Crash state: LzmaDecDecodeToDic LzmaDecDecodeToBuf htpgzipdecompressordecompress...

OSV-2020-467 UNKNOWN READ in ot::MessageQueue::GetTail

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13345 Crash type: UNKNOWN READ Crash state: ot::MessageQueue::GetTail ot::Message::GetNext ot::MeshForwarder::GetDirectTransmission...

OSV-2020-462 Global-buffer-overflow in strsep_char

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14509 Crash type: Global-buffer-overflow READ Crash state: strsepchar parseproxyprotocolv1 parsehttprequest...

OSV-2020-427 Stack-buffer-overflow in Mat_uint32Swap

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17113 Crash type: Stack-buffer-overflow READ 4 Crash state: Matuint32Swap MatVarReadNextInfo5 MatGetDir...

OSV-2020-412 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18503 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int decltype...

OSV-2020-416 Use-of-uninitialized-value in UA_ServerConfig_clean

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14848 Crash type: Use-of-uninitialized-value Crash state: UAServerConfigclean UAServerdelete fuzzbinarymessage.cc...

OSV-2020-429 Heap-buffer-overflow in MEM_read32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14368 Crash type: Heap-buffer-overflow READ 4 Crash state: MEMread32 ZSTDv05decodeSequence ZSTDv05decompressSequences...

OSV-2020-405 Stack-buffer-overflow in ZSTD_decodeLiteralsBlock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16445 Crash type: Stack-buffer-overflow WRITE Crash state: ZSTDdecodeLiteralsBlock ZSTDdecompressBlock ZSTDdecompressDCtx...

OSV-2020-365 UNKNOWN READ in fuzzshark_ip_proto-udp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16442 Crash type: UNKNOWN READ Crash state: fuzzsharkipproto-udp ghashtablelookup dissecttls...

OSV-2020-345 Index-out-of-bounds in yara_yyparse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18942 Crash type: Index-out-of-bounds Crash state: yarayyparse yrlexparserulesstring rulesfuzzer.cc...

OSV-2020-353 Stack-buffer-overflow in ot::MeshCoP::Commissioner::GeneratePskc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19386 Crash type: Stack-buffer-overflow WRITE Crash state: ot::MeshCoP::Commissioner::GeneratePskc ot::Ncp::NcpBase::HandlePropertySetSPINELPROPMESHCOPCOMMISSIONERGENERATEPS ot::Ncp::NcpBase::HandlePropertySetForSpecialPropert...

OSV-2020-355 Use-of-uninitialized-value in LzmaDec_TryDummy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17189 Crash type: Use-of-uninitialized-value Crash state: LzmaDecTryDummy LzmaDecDecodeToDic LzmaDecDecodeToBuf...

OSV-2020-255 Heap-buffer-overflow in dname_pkt_copy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20093 Crash type: Heap-buffer-overflow READ 1 Crash state: dnamepktcopy pktstrictsub scrubnormalize...

OSV-2020-176 UNKNOWN READ in OT::SBIXGlyph::copy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20223 Crash type: UNKNOWN READ Crash state: OT::SBIXGlyph::copy OT::SBIXStrike::subset OT::sbix::addstrike...

OSV-2020-182 Heap-buffer-overflow in hb_array_t<OT::IntType<unsigned char, 1u> const> hb_array_t<OT::IntType<unsigned

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20249 Crash type: Heap-buffer-overflow READ 1 Crash state: hbarrayt const hbarrayt ::copy OT::SBIXGlyph::copy...

OSV-2020-161 Heap-use-after-free in jbig2_release_huffman_table

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21587 Crash type: Heap-use-after-free READ 8 Crash state: jbig2releasehuffmantable jbig2textregion jbig2datain...

OSV-2020-115 UNKNOWN WRITE in arrow::BaseBinaryBuilder<arrow::BinaryType>::UnsafeAppend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21106 Crash type: UNKNOWN WRITE Crash state: arrow::BaseBinaryBuilder::UnsafeAppend parquet::PlainByteArrayDecoder::DecodeArrowDenseNonNull parquet::PlainByteArrayDecoder::DecodeArrow...

OSV-2020-77 Use-of-uninitialized-value in jbig2_text_region

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21571 Crash type: Use-of-uninitialized-value Crash state: jbig2textregion jbig2parsesegment jbig2completepage...

OSV-2020-63 UNKNOWN READ in arrow::BaseBinaryBuilder<arrow::BinaryType>::UnsafeAppend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20697 Crash type: UNKNOWN READ Crash state: arrow::BaseBinaryBuilder::UnsafeAppend parquet::PlainByteArrayDecoder::DecodeArrowDense parquet::PlainByteArrayDecoder::DecodeArrow...

OSV-2020-55 Stack-buffer-overflow in tcos_decipher

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22967 Crash type: Stack-buffer-overflow WRITE Crash state: tcosdecipher scdecipher usekey...

OSV-2020-52 Heap-buffer-overflow in int arrow::util::RleDecoder::GetBatchWithDictSpaced<double>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20665 Crash type: Heap-buffer-overflow READ 8 Crash state: int arrow::util::RleDecoder::GetBatchWithDictSpaced virtual thunk to parquet::DictDecoderImplparquet::PhysicalType...

OSV-2020-50 Bad-cast to pcpp::IDnsResource from invalid vptr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22872 Crash type: Bad-cast Crash state: Bad-cast to pcpp::IDnsResource from invalid vptr pcpp::DnsLayer::DnsLayer pcpp::DnsLayer::DnsLayer...

OSV-2020-27 Heap-buffer-overflow in parquet::LevelDecoder::SetData

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20940 Crash type: Heap-buffer-overflow READ 4 Crash state: parquet::LevelDecoder::SetData parquet::ColumnReaderImplBaseparquet::PhysicalType parquet::internal::TypedRecordReaderparquet::PhysicalType...

OSV-2026-1309 Heap-buffer-overflow in janet_bytecode_movopt_basic_block

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=563659412 Crash type: Heap-buffer-overflow READ 4 Crash state: janetbytecodemovoptbasicblock janetbytecodemovoptfull janetbytecodeoptimize...

OSV-2026-1198 Stack-buffer-overflow in msLayoutTextSymbol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=551099259 Crash type: Stack-buffer-overflow READ 4 Crash state: msLayoutTextSymbol msWriteErrorImage msWMSException...

OSV-2026-1026 Global-buffer-overflow in txt2sd

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=530698821 Crash type: Global-buffer-overflow READ 1 Crash state: txt2sd fuzzmdnsxht.cc...

OSV-2026-969 Heap-use-after-free in Ogre::VertexData::convertPackedColour

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=527766102 Crash type: Heap-use-after-free READ 1 Crash state: Ogre::VertexData::convertPackedColour Ogre::MeshSerializerImpl::readGeometry Ogre::MeshSerializerImpl::readMesh...