OSV-2021-347 Heap-buffer-overflow in flatbuffers::Table* flatbuffers::GetMutableRoot<flatbuffers::Table>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30682 Crash type: Heap-buffer-overflow READ 4 Crash state: flatbuffers::Table flatbuffers::GetMutableRoot flatbuffers::Table const flatbuffers::GetRoot flatbuffers::JsonPrinter::GenFieldOffset...

OSV-2021-304 Stack-buffer-overflow in processClientServerHello

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30393 Crash type: Stack-buffer-overflow WRITE 6 Crash state: processClientServerHello processTLSBlock ndpisearchtlstcp...

OSV-2021-245 UNKNOWN WRITE in WelsDecodeBs

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29969 Crash type: UNKNOWN WRITE Crash state: WelsDecodeBs WelsDec::CWelsDecoder::DecodeFrame2WithCtx WelsDec::CWelsDecoder::DecodeFrame2...

OSV-2021-221 Heap-buffer-overflow in blosc_d

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29816 Crash type: Heap-buffer-overflow READ 4 Crash state: bloscd bloscgetitem bloscgetitem...

OSV-2021-219 UNKNOWN READ in H5HG__cache_heap_deserialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29759 Crash type: UNKNOWN READ Crash state: H5HGcacheheapdeserialize H5Cloadentry H5Cprotect...

OSV-2016-5 Global-buffer-overflow in vte_write_debug

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=182 Crash type: Global-buffer-overflow READ 1 Crash state: vtewritedebug doaction parsedata...

OSV-2018-384 Use-of-uninitialized-value in template_affine_N_lerp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5616 Crash type: Use-of-uninitialized-value Crash state: templateaffineNlerp paintaffinelerpdasa0 fzpaintimageimp...

OSV-2020-2301 Heap-buffer-overflow in H5MM_xstrdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29553 Crash type: Heap-buffer-overflow READ Crash state: H5MMxstrdup H5Genttolink H5Gnodeiterate...

OSV-2018-291 Use-of-uninitialized-value in pdf_lex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5610 Crash type: Use-of-uninitialized-value Crash state: pdflex pdfloadcmap pdfloadembeddedcmap...

OSV-2018-255 Heap-use-after-free in add_range

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5492 Crash type: Heap-use-after-free READ 4 Crash state: addrange pdfmaprangetorange pdfparsebfrange...

OSV-2016-2 UNKNOWN READ in file_regexec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=283 Crash type: UNKNOWN READ Crash state: fileregexec magiccheck match...

OSV-2017-95 Use-of-uninitialized-value in Archive::GetComment

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4410 Crash type: Use-of-uninitialized-value Crash state: Archive::GetComment Archive::ViewComment CmdExtract::ExtractArchive...

OSV-2017-69 Use-of-uninitialized-value in IsRelativeSymlinkSafe

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4409 Crash type: Use-of-uninitialized-value Crash state: IsRelativeSymlinkSafe ExtractUnixLink30 ExtractSymlink...

OSV-2021-147 Use-of-uninitialized-value in gnutls_ocsp_resp_get_status

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1492 Crash type: Use-of-uninitialized-value Crash state: gnutlsocsprespgetstatus gnutlsocsprespimport start...

OSV-2018-227 Heap-buffer-overflow in rawspeed::TableLookUp::setTable

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5256 Crash type: Heap-buffer-overflow WRITE 2 Crash state: rawspeed::TableLookUp::setTable rawspeed::RawImageData::setTable rawspeed::DngDecoder::handleMetadata...

OSV-2021-120 Heap-use-after-free in UA_SecureChannel_deleteMembersCleanup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5652 Crash type: Heap-use-after-free READ 8 Crash state: UASecureChanneldeleteMembersCleanup UASecureChannelManagerdeleteMembers UAServerdelete...

OSV-2018-219 UNKNOWN READ in pcf_get_encodings

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9527 Crash type: UNKNOWN READ Crash state: pcfgetencodings pcfloadfont PCFFaceInit...

OSV-2017-25 Use-of-uninitialized-value in ToPercent

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4512 Crash type: Use-of-uninitialized-value Crash state: ToPercent Archive::ReadHeader15 Archive::ReadHeader...

OSV-2018-212 Heap-buffer-overflow in token_stream_prepare

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9805 Crash type: Heap-buffer-overflow READ 1 Crash state: tokenstreamprepare parse typedeclparse...

OSV-2018-201 Heap-buffer-overflow in r_str_utf16_to_utf8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10487 Crash type: Heap-buffer-overflow READ 1 Crash state: rstrutf16toutf8 sections rbinobjectsetitems...

OSV-2018-192 Stack-buffer-overflow in highbd_dr_prediction_z1_64xN_avx2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11517 Crash type: Stack-buffer-overflow READ 16 Crash state: highbddrpredictionz164xNavx2 av1highbddrpredictionz1avx2 av1predictintrablock...

OSV-2018-64 Heap-buffer-overflow in BEInt<unsigned int, 4>::operator unsigned int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11522 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned int void hbsanitizecontextt::setobject::sanitize...

OSV-2018-56 UNKNOWN READ in OT::propagate_attachment_offsets

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11013 Crash type: UNKNOWN READ Crash state: OT::propagateattachmentoffsets OT::propagateattachmentoffsets OT::GPOS::positionfinishoffsets...

OSV-2018-55 Heap-buffer-overflow in ot::MeshForwarder::GetFramePriority

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11376 Crash type: Heap-buffer-overflow READ 8 Crash state: ot::MeshForwarder::GetFramePriority ot::MeshForwarder::HandleFragment ot::MeshForwarder::HandleReceivedFrame...

OSV-2018-22 Heap-buffer-overflow in gvs_read_unaligned_le

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9807 Crash type: Heap-buffer-overflow READ 1 Crash state: gvsreadunalignedle gvstupleisnormal gvariantserialisedisnormal...

OSV-2020-2276 Negative-size-param in tcos_decipher

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28768 Crash type: Negative-size-param Crash state: tcosdecipher scdecipher usekey...

OSV-2020-2264 Stack-buffer-overflow in ot::IsValidUtf8String

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28682 Crash type: Stack-buffer-overflow READ 1 Crash state: ot::IsValidUtf8String ot::MeshCoP::NetworkNameTlv::IsValid ot::MeshCoP::Tlv::IsValid...

OSV-2020-2263 Heap-buffer-overflow in McChromaWithFragMv_c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28639 Crash type: Heap-buffer-overflow READ 1 Crash state: McChromaWithFragMvc McChromassse3 WelsDec::BaseMC...

OSV-2020-2233 Heap-buffer-overflow in flb_sds_cat_utf8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28222 Crash type: Heap-buffer-overflow READ 1 Crash state: flbsdscatutf8 flbmsgpackgelfvalue flbmsgpacktogelf...

OSV-2020-2230 Heap-buffer-overflow in _zend_is_inconsistent

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28129 Crash type: Heap-buffer-overflow READ 4 Crash state: zendisinconsistent zendhashfind zendhashfindptr...

OSV-2020-2134 UNKNOWN READ in wpabuf_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27269 Crash type: UNKNOWN READ Crash state: wpabuffree p2pdevicefree p2pflush...

OSV-2020-2119 UNKNOWN READ in numberparsing.h

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26858 Crash type: UNKNOWN READ Crash state: numberparsing.h...

OSV-2020-2075 Heap-use-after-free in flb_parser_decoder_list_destroy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26345 Crash type: Heap-use-after-free READ 8 Crash state: flbparserdecoderlistdestroy parserfuzzer.c flbfree...

OSV-2020-2071 Heap-buffer-overflow in flb_log_print

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26325 Crash type: Heap-buffer-overflow READ Crash state: flblogprint flbparsertypecast logfmtparser...

OSV-2020-2045 Use-of-uninitialized-value in WelsDec::GetColocatedMb

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26272 Crash type: Use-of-uninitialized-value Crash state: WelsDec::GetColocatedMb WelsDec::PredBDirectTemporal WelsDec::WelsDecodeMbCavlcBSlice...

OSV-2020-2042 UNKNOWN WRITE in pb_release_single_field

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22329 Crash type: UNKNOWN WRITE Crash state: pbreleasesinglefield pbrelease pbdecode...

OSV-2020-2000 Heap-buffer-overflow in sctp_process_init

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26197 Crash type: Heap-buffer-overflow WRITE 1 Crash state: sctpprocessinit sctpprocesscookieexisting sctphandlecookieecho...

OSV-2020-1923 Heap-buffer-overflow in do_print_ex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13914 Crash type: Heap-buffer-overflow READ 1 Crash state: doprintex asn1itemprintctx ASN1itemprint...

OSV-2020-1894 Heap-buffer-overflow in parquet::arrow::ApplyOriginalStorageMetadata

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26064 Crash type: Heap-buffer-overflow READ 4 Crash state: parquet::arrow::ApplyOriginalStorageMetadata parquet::arrow::SchemaManifest::Make parquet::arrow::FileReader::Make...

OSV-2020-1887 Heap-buffer-overflow in zmq::tcp_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26042 Crash type: Heap-buffer-overflow WRITE Crash state: zmq::tcpread zmq::streamenginebaset::read zmq::streamenginebaset::ineventinternal...

OSV-2020-1883 Use-of-uninitialized-value in s_exD_process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22225 Crash type: Use-of-uninitialized-value Crash state: sexDprocess sreadbuf sprocessreadbuf...

OSV-2020-1884 Segv on unknown address in process_ndpi_collected_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26015 Crash type: Segv on unknown address Crash state: processndpicollectedinfo packetprocessing ndpiworkflowprocesspacket...

OSV-2020-1847 Heap-buffer-overflow in WelsDec::NeedErrorCon

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25921 Crash type: Heap-buffer-overflow READ 1 Crash state: WelsDec::NeedErrorCon WelsDec::CheckAndFinishLastPic WelsDecodeBs...

OSV-2020-1841 UNKNOWN READ in avifRWDataSet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25911 Crash type: UNKNOWN READ Crash state: avifRWDataSet avifParseItemDataBox avifParseMetaBox...

OSV-2020-1804 Heap-buffer-overflow in text_normalize_buffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22211 Crash type: Heap-buffer-overflow READ 1 Crash state: textnormalizebuffer arjreadmainheader cliunarjopen...

OSV-2020-1792 Heap-buffer-overflow in text_normalize_buffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20464 Crash type: Heap-buffer-overflow READ 1 Crash state: textnormalizebuffer arjreadfileheader cliscanarj...

OSV-2020-1720 Heap-buffer-overflow in hextoint

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25473 Crash type: Heap-buffer-overflow READ 2 Crash state: hextoint getnamefromEFDatiPersonali itacnsadddatafiles...

OSV-2020-1700 UNKNOWN READ in zend_gc_delref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25384 Crash type: UNKNOWN READ Crash state: zendgcdelref izvalptrdtor zenduncleanzvalptrdtor...

OSV-2020-1587 UNKNOWN WRITE in count_blocks

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24704 Crash type: UNKNOWN WRITE Crash state: countblocks optinit bpfoptimize...

OSV-2020-1510 UNKNOWN WRITE in FLAC__bitwriter_write_raw_uint32_nocheck

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19816 Crash type: UNKNOWN WRITE Crash state: FLACbitwriterwriterawuint32nocheck FLACbitwriterwriterawuint32 FLACframeaddheader...