OSV-2021-1686 Segv on unknown address in chunk_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42312 Crash type: Segv on unknown address Crash state: chunkfreeobject fileclosefile sclose...

OSV-2021-1685 Heap-buffer-overflow in pdfi_dereference

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42327 Crash type: Heap-buffer-overflow READ 8 Crash state: pdfidereference pdfiderefloopdetect pdfidictget...

OSV-2021-1646 Heap-buffer-overflow in uncompress_b44_impl

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41625 Crash type: Heap-buffer-overflow READ Crash state: uncompressb44impl defaultdecompresschunk exrdecodingrun...

OSV-2021-1601 Heap-buffer-overflow in parquet::DeltaByteArrayDecoder::GetInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41221 Crash type: Heap-buffer-overflow WRITE 1 Crash state: parquet::DeltaByteArrayDecoder::GetInternal parquet::DeltaByteArrayDecoder::DecodeArrow parquet::internal::ByteArrayChunkedRecordReader::ReadValuesSpaced...

OSV-2021-1592 Heap-buffer-overflow in arrow::internal::ValidateArrayImpl::Visit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41143 Crash type: Heap-buffer-overflow READ 4 Crash state: arrow::internal::ValidateArrayImpl::Visit arrow::internal::ValidateArrayImpl::ValidateWithType arrow::internal::ValidateArrayImpl::Validate...

OSV-2021-1514 Container-overflow in m3d_load

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40535 Crash type: Container-overflow READ 1 Crash state: m3dload Assimp::M3DWrapper::M3DWrapper Assimp::M3DImporter::InternReadFile...

OSV-2021-1502 Heap-buffer-overflow in asn_realloc_rbuild_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40431 Crash type: Heap-buffer-overflow READ Crash state: asnreallocrbuildstring snmpv3scopedPDUheaderreallocrbuild snmpv3packetreallocrbuild...

OSV-2021-1482 Heap-buffer-overflow in generic_unpack

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40234 Crash type: Heap-buffer-overflow READ 2 Crash state: genericunpack exrdecodingrun Imf31::checkCoreFile...

OSV-2021-1420 Heap-buffer-overflow in unpack_16bit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39623 Crash type: Heap-buffer-overflow WRITE Crash state: unpack16bit exrdecodingrun Imf31::checkCoreFile...

OSV-2021-1371 Heap-use-after-free in dispatch_print_error

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39212 Crash type: Heap-use-after-free READ 6 Crash state: dispatchprinterror internalexrparseheader exrstartread...

OSV-2021-1269 Use-of-uninitialized-value in std::__1::basic_ostream<char, std::__1::char_traits<char> >& std::__1::__put_cha

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38777 Crash type: Use-of-uninitialized-value Crash state: std::1::basicostream & std::1::putcha S2LaxPolylineShape::Init S2LaxPolylineShape::S2LaxPolylineShape...

OSV-2021-1230 UNKNOWN READ in helper_ret_stb_mmu_x86_64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38438 Crash type: UNKNOWN READ Crash state: helperretstbmmux8664 resumeallvcpusx8664 vmstartx8664...

OSV-2021-1222 Invalid-free in swift_unexpectedError

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38323 Crash type: Invalid-free Crash state: swiftunexpectedError SwiftProtobuf.TextFormatEncodingVisitor.visitRepeatedMessageFieldA where A: Swi merged protocol witness for SwiftProtobuf.Visitor.visitRepeatedEnumFieldA where...

OSV-2021-1198 Heap-buffer-overflow in parse_param_name

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38052 Crash type: Heap-buffer-overflow READ 1 Crash state: parseparamname parseparam2 parseparams2...

OSV-2021-1117 Heap-buffer-overflow in json_object_new_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37017 Crash type: Heap-buffer-overflow READ Crash state: jsonobjectnewstring clijsonstr clihwp5header...

OSV-2021-1108 Use-of-uninitialized-value in init_main_qtable

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36913 Crash type: Use-of-uninitialized-value Crash state: initmainqtable LibRaw::fujidecodestrip LibRaw::fujidecodeloop...

OSV-2021-1085 Stack-buffer-overflow in strcat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36743 Crash type: Stack-buffer-overflow WRITE Crash state: strcat prvTidystrrep tidyMessageCreateInitV...

OSV-2021-1039 Use-after-poison in AK::RefPtr<AK::StringImpl, AK::RefPtrTraits<AK::StringImpl> >::RefPtr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36388 Crash type: Use-after-poison WRITE 8 Crash state: AK::RefPtr ::RefPtr AK::String::String JS::abstractrelation...

OSV-2021-1011 Use-of-uninitialized-value in jxl::N_AVX2::AddNoise

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36158 Crash type: Use-of-uninitialized-value Crash state: jxl::NAVX2::AddNoise jxl::FinalizeImageRect jxl::ThreadPool::RunCallStatejxl::FinalizeFrameDecoding...

OSV-2021-948 Use-of-uninitialized-value in residual_coding

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35950 Crash type: Use-of-uninitialized-value Crash state: residualcoding readtransformunit readtransformtree...

OSV-2021-887 Use-after-poison in AK::RefPtr<AK::StringImpl, AK::RefPtrTraits<AK::StringImpl> >::RefPtr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35436 Crash type: Use-after-poison WRITE 8 Crash state: AK::RefPtr ::RefPtr AK::String::String JS::abstractrelation...

OSV-2021-821 Stack-buffer-overflow in jsoncons::bson::decimal128_to_chars

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34816 Crash type: Stack-buffer-overflow WRITE 6 Crash state: jsoncons::bson::decimal128tochars jsoncons::bson::basicbsonparserjsoncons::binarystreamsource, std::1::allo...

OSV-2021-766 Negative-size-param in frame_get_vlmetalayers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34259 Crash type: Negative-size-param Crash state: framegetvlmetalayers frametoschunk blosc2schunkfrombuffer...

OSV-2021-710 Heap-use-after-free in iov_from_buf_full

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33785 Crash type: Heap-use-after-free WRITE 2 Crash state: iovfrombuffull iovfrombuf virtionetreceivercu...

OSV-2021-615 Use-of-uninitialized-value in DES_set_key_unchecked

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33023 Crash type: Use-of-uninitialized-value Crash state: DESsetkeyunchecked osslcipherhwtdesede3initkey tdesinit...

OSV-2021-563 Heap-use-after-free in AK::NonnullOwnPtr<JS::IndexedPropertyStorage>::operator->

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32459 Crash type: Heap-use-after-free READ 8 Crash state: AK::NonnullOwnPtr::operator- JS::IndexedProperties::arraylikesize JS::IndexedProperties::append...

OSV-2021-534 Container-overflow in tesseract::ExtractResults16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32142 Crash type: Container-overflow WRITE Crash state: tesseract::ExtractResults16 tesseract::PartialMatrixDotVector16 tesseract::matrixDotVector...

OSV-2021-525 Use-of-uninitialized-value in void edge_filtering_chroma_internal<unsigned char>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32059 Crash type: Use-of-uninitialized-value Crash state: void edgefilteringchromainternal edgefilteringchroma threadtaskdeblockCTBRow::work...

OSV-2021-453 UNKNOWN WRITE in std::__1::pair<unsigned int, void*> uWS::HttpParser::fenceAndConsumePostPadded<0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31457 Crash type: UNKNOWN WRITE Crash state: std::1::pair uWS::HttpParser::fenceAndConsumePostPadded0 uWS::HttpParser::consumePostPadded std::1::function::funcLLVMFuzzerTestOneInput::$0, std::1::allocatorLL...

OSV-2021-389 Bad-cast to tt_cmap_t' (aka 'struct _tt_cmap')_cairo_truetype_index_to_ucs4

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30823 Crash type: Bad-cast Crash state: Bad-cast to ttcmapt' aka 'struct ttcmap'cairotruetypeindextoucs4 cairosubfontglyphlookupunicode cairosubfontmapglyph...

OSV-2021-367 Heap-buffer-overflow in H5MM_memcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30749 Crash type: Heap-buffer-overflow READ Crash state: H5MMmemcpy H5VMmemcpyvv H5Dcompactreadvv...

OSV-2021-347 Heap-buffer-overflow in flatbuffers::Table* flatbuffers::GetMutableRoot<flatbuffers::Table>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30682 Crash type: Heap-buffer-overflow READ 4 Crash state: flatbuffers::Table flatbuffers::GetMutableRoot flatbuffers::Table const flatbuffers::GetRoot flatbuffers::JsonPrinter::GenFieldOffset...

OSV-2021-304 Stack-buffer-overflow in processClientServerHello

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30393 Crash type: Stack-buffer-overflow WRITE 6 Crash state: processClientServerHello processTLSBlock ndpisearchtlstcp...

OSV-2021-245 UNKNOWN WRITE in WelsDecodeBs

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29969 Crash type: UNKNOWN WRITE Crash state: WelsDecodeBs WelsDec::CWelsDecoder::DecodeFrame2WithCtx WelsDec::CWelsDecoder::DecodeFrame2...

OSV-2021-221 Heap-buffer-overflow in blosc_d

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29816 Crash type: Heap-buffer-overflow READ 4 Crash state: bloscd bloscgetitem bloscgetitem...

OSV-2021-219 UNKNOWN READ in H5HG__cache_heap_deserialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29759 Crash type: UNKNOWN READ Crash state: H5HGcacheheapdeserialize H5Cloadentry H5Cprotect...

OSV-2016-5 Global-buffer-overflow in vte_write_debug

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=182 Crash type: Global-buffer-overflow READ 1 Crash state: vtewritedebug doaction parsedata...

OSV-2016-3 UNKNOWN READ in file_regexec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=143 Crash type: UNKNOWN READ Crash state: fileregexec magiccheck match...

OSV-2018-384 Use-of-uninitialized-value in template_affine_N_lerp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5616 Crash type: Use-of-uninitialized-value Crash state: templateaffineNlerp paintaffinelerpdasa0 fzpaintimageimp...

OSV-2020-2301 Heap-buffer-overflow in H5MM_xstrdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29553 Crash type: Heap-buffer-overflow READ Crash state: H5MMxstrdup H5Genttolink H5Gnodeiterate...

OSV-2018-291 Use-of-uninitialized-value in pdf_lex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5610 Crash type: Use-of-uninitialized-value Crash state: pdflex pdfloadcmap pdfloadembeddedcmap...

OSV-2018-255 Heap-use-after-free in add_range

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5492 Crash type: Heap-use-after-free READ 4 Crash state: addrange pdfmaprangetorange pdfparsebfrange...

OSV-2016-2 UNKNOWN READ in file_regexec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=283 Crash type: UNKNOWN READ Crash state: fileregexec magiccheck match...

OSV-2017-95 Use-of-uninitialized-value in Archive::GetComment

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4410 Crash type: Use-of-uninitialized-value Crash state: Archive::GetComment Archive::ViewComment CmdExtract::ExtractArchive...

OSV-2017-69 Use-of-uninitialized-value in IsRelativeSymlinkSafe

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4409 Crash type: Use-of-uninitialized-value Crash state: IsRelativeSymlinkSafe ExtractUnixLink30 ExtractSymlink...

OSV-2021-147 Use-of-uninitialized-value in gnutls_ocsp_resp_get_status

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1492 Crash type: Use-of-uninitialized-value Crash state: gnutlsocsprespgetstatus gnutlsocsprespimport start...

OSV-2018-227 Heap-buffer-overflow in rawspeed::TableLookUp::setTable

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5256 Crash type: Heap-buffer-overflow WRITE 2 Crash state: rawspeed::TableLookUp::setTable rawspeed::RawImageData::setTable rawspeed::DngDecoder::handleMetadata...

OSV-2021-120 Heap-use-after-free in UA_SecureChannel_deleteMembersCleanup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5652 Crash type: Heap-use-after-free READ 8 Crash state: UASecureChanneldeleteMembersCleanup UASecureChannelManagerdeleteMembers UAServerdelete...

OSV-2018-219 UNKNOWN READ in pcf_get_encodings

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9527 Crash type: UNKNOWN READ Crash state: pcfgetencodings pcfloadfont PCFFaceInit...

OSV-2017-25 Use-of-uninitialized-value in ToPercent

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4512 Crash type: Use-of-uninitialized-value Crash state: ToPercent Archive::ReadHeader15 Archive::ReadHeader...