OSV-2020-1377 Segv on unknown address in slice_segment_header::operator=

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22924 Crash type: Segv on unknown address Crash state: slicesegmentheader::operator= slicesegmentheader::read decodercontext::readsliceNAL...

OSV-2020-1379 Heap-buffer-overflow in dotnet_parse_com

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8901 Crash type: Heap-buffer-overflow READ 16 Crash state: dotnetparsecom dotnetload yrmodulesload...

OSV-2020-1315 Heap-buffer-overflow in pcpp::IPv4Layer::getFragmentFlags

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22638 Crash type: Heap-buffer-overflow READ 2 Crash state: pcpp::IPv4Layer::getFragmentFlags pcpp::IPv4Layer::isFragment pcpp::IPv4Layer::parseNextLayer...

OSV-2020-1300 Heap-buffer-overflow in ihevcd_parse_slice_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17036 Crash type: Heap-buffer-overflow WRITE 1 Crash state: ihevcdparseslicedata ihevcddecode ihevcdcxaapifunction...

OSV-2020-1228 Heap-use-after-free in arrow::internal::CountSetBits

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20120 Crash type: Heap-use-after-free READ 8 Crash state: arrow::internal::CountSetBits arrow::Array::nullcount arrow::internal::ValidateArray...

OSV-2020-1186 Index-out-of-bounds in WelsDec::DecodeCurrentAccessUnit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12668 Crash type: Index-out-of-bounds Crash state: WelsDec::DecodeCurrentAccessUnit WelsDec::ConstructAccessUnit WelsDecodeBs...

OSV-2020-1178 Global-buffer-overflow in arrow::Status arrow::VisitArrayInline<arrow::internal::ValidateArrayDataVisitor>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20203 Crash type: Global-buffer-overflow READ 1 Crash state: arrow::Status arrow::VisitArrayInline arrow::Status arrow::internal::ValidateArrayDataVisitor::ValidateListArray...

OSV-2020-1152 Heap-buffer-overflow in pcpp::tbp_my_own_strnlen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22483 Crash type: Heap-buffer-overflow READ 1 Crash state: pcpp::tbpmyownstrnlen pcpp::HeaderField::HeaderField pcpp::TextBasedProtocolMessage::parseFields...

OSV-2020-1138 Heap-buffer-overflow in void apply_sao_internal<unsigned short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14184 Crash type: Heap-buffer-overflow READ 1 Crash state: void applysaointernal void applysao threadtasksao::work...

OSV-2020-1083 Heap-use-after-free in rpl_glob

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20176 Crash type: Heap-use-after-free READ Crash state: rplglob readconfigexpand readconfigexpand...

OSV-2020-1081 UNKNOWN WRITE in ideint_process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17077 Crash type: UNKNOWN WRITE Crash state: ideintprocess impeg2ddeinterlace impeg2ddecpicdatathread...

OSV-2020-1060 Use-of-uninitialized-value in ZSTD_createDDict_advanced

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23732 Crash type: Use-of-uninitialized-value Crash state: ZSTDcreateDDictadvanced ZSTDcreateDDict bloscrundecompressionwithcontext...

OSV-2020-1049 Heap-use-after-free in WelsDec::WelsReorderRefList

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14027 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::WelsReorderRefList WelsDec::InitRefPicList WelsDec::DecodeCurrentAccessUnit...

OSV-2020-1007 Heap-use-after-free in DetectParseDupSigCompareFunc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22715 Crash type: Heap-use-after-free READ 4 Crash state: DetectParseDupSigCompareFunc HashListTableLookup DetectEngineSignatureIsDuplicate...

OSV-2020-941 Heap-buffer-overflow in gc_mark_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19780 Crash type: Heap-buffer-overflow READ 4 Crash state: gcmarkstring gctrace gsgcreclaim...

OSV-2020-880 Heap-buffer-overflow in smtp_command_parse_line

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23514 Crash type: Heap-buffer-overflow READ 1 Crash state: smtpcommandparseline smtpcommandparse smtpcommandparsenext...

OSV-2020-867 Heap-buffer-overflow in icu_64::CollationIterator::appendCEsFromCE32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15613 Crash type: Heap-buffer-overflow READ 4 Crash state: icu64::CollationIterator::appendCEsFromCE32 icu64::DataBuilderCollationIterator::fetchCEs icu64::CollationDataBuilder::getCEs...

OSV-2020-863 Use-of-uninitialized-value in QPDFTokenizer::isSpace

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20391 Crash type: Use-of-uninitialized-value Crash state: QPDFTokenizer::isSpace QPDFTokenizer::presentCharacter QPDFTokenizer::readToken...

OSV-2020-864 Heap-buffer-overflow in H5O_attr_shared_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18806 Crash type: Heap-buffer-overflow READ Crash state: H5Oattrshareddecode H5Omsgiteratereal H5Oattropenbyname...

OSV-2020-854 UNKNOWN READ in std::__1::__hash_node_base<std::__1::__hash_node<std::__1::__hash_value_type<std

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20959 Crash type: UNKNOWN READ Crash state: std::1::hashnodebasestd::1::hashnodestd::1::hashvaluetypestd std::1::hashtablestd::1::hashvaluetypestd::1::basicstringchar,...

OSV-2020-849 Heap-buffer-overflow in dotnet_parse_tilde_2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19591 Crash type: Heap-buffer-overflow READ 2 Crash state: dotnetparsetilde2 dotnetparsetilde dotnetparsecom...

OSV-2020-825 Index-out-of-bounds in tcg_liveness_analysis_arm

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23971 Crash type: Index-out-of-bounds Crash state: tcglivenessanalysisarm tcggencodearm cpuarmgencodearm...

OSV-2020-785 Heap-buffer-overflow in sctp_handle_packet_dropped

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23656 Crash type: Heap-buffer-overflow READ 1 Crash state: sctphandlepacketdropped sctpprocesscontrol sctpcommoninputprocessing...

OSV-2020-769 Heap-buffer-overflow in perfetto::trace_processor::ClockTracker::ConvertSlowpath

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23149 Crash type: Heap-buffer-overflow READ 8 Crash state: perfetto::traceprocessor::ClockTracker::ConvertSlowpath perfetto::traceprocessor::ClockTracker::Convert perfetto::traceprocessor::ClockTracker::ToTraceTime...

OSV-2020-715 Heap-buffer-overflow in cras_rclient_message_from_client

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15058 Crash type: Heap-buffer-overflow READ 4 Crash state: crasrclientmessagefromclient crasrclientbufferfromclient rclientmessage.cc...

OSV-2020-708 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14919 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int hbmapiterthbmapiterthbarraytOT::OffsetToOT::AxisValue, OT::IntTypeu...

OSV-2020-727 Use-of-uninitialized-value in psnip_safe_size_mul

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17120 Crash type: Use-of-uninitialized-value Crash state: psnipsafesizemul SafeMul MatVarGetSize...

OSV-2020-693 Heap-buffer-overflow in parse_sec_attr_44

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18798 Crash type: Heap-buffer-overflow READ 1 Crash state: parsesecattr44 setcosselectfile scselectfile...

OSV-2020-642 Stack-use-after-return in sdb_itoa

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12751 Crash type: Stack-use-after-return WRITE 1 Crash state: sdbitoa parseresourcedirectory parseresourcedirectory...

OSV-2020-641 Use-of-uninitialized-value in bool std::__1::equal<std::__1::__wrap_iter<unsigned char const*>, std::__1::__wr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14353 Crash type: Use-of-uninitialized-value Crash state: bool std::1::equal, std::1::wr bool std::1::operator== std::1::enableifisconvertiblevdecltype...

OSV-2020-632 Global-buffer-overflow in parse_http_request

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14582 Crash type: Global-buffer-overflow READ 1 Crash state: parsehttprequest fuzzparsehttprequest...

OSV-2020-639 UNKNOWN READ in ot::Dhcp6::Dhcp6Client::UpdateAddresses

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13332 Crash type: UNKNOWN READ Crash state: ot::Dhcp6::Dhcp6Client::UpdateAddresses ot::Mle::Mle::HandleStateChanged ot::Notifier::HandleStateChanged...

OSV-2020-596 UNKNOWN READ in ot::PriorityQueue::GetHead

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13388 Crash type: UNKNOWN READ Crash state: ot::PriorityQueue::GetHead ot::Ip6::Ip6::HandleSendQueue ot::TaskletScheduler::ProcessQueuedTasklets...

OSV-2020-535 Heap-buffer-overflow in looks_ucs32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13222 Crash type: Heap-buffer-overflow READ 1 Crash state: looksucs32 fileencoding filebuffer...

OSV-2020-503 Heap-use-after-free in WelsDec::SetUnRef

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18438 Crash type: Heap-use-after-free WRITE 1 Crash state: WelsDec::SetUnRef WelsDec::WelsResetRefPic WelsFreeDynamicMemory...

OSV-2020-497 Heap-buffer-overflow in str_table_entry

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13956 Crash type: Heap-buffer-overflow READ 1 Crash state: strtableentry parseelfheader64be elfload...

OSV-2020-468 Stack-buffer-overflow in ot::Ip6::Address::FromString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14821 Crash type: Stack-buffer-overflow WRITE 1 Crash state: ot::Ip6::Address::FromString ot::Cli::Coap::ProcessRequest ot::Cli::Interpreter::ProcessCoap...

OSV-2020-473 Heap-use-after-free in Envoy::Server::InitManagerImpl::initializeTarget

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13221 Crash type: Heap-use-after-free READ 8 Crash state: Envoy::Server::InitManagerImpl::initializeTarget Envoy::Server::InitManagerImpl::initialize Envoy::Server::ValidationInstance::initialize...

OSV-2020-399 Heap-use-after-free in sdb_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13704 Crash type: Heap-use-after-free READ 8 Crash state: sdbfree nsfree sdbnsfree...

OSV-2020-328 UNKNOWN READ in dotnet_parse_tilde_2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16448 Crash type: UNKNOWN READ Crash state: dotnetparsetilde2 dotnetparsetilde dotnetparsecom...

OSV-2020-324 Heap-buffer-overflow in av1_convolve_2d_copy_sr_sse2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12549 Crash type: Heap-buffer-overflow READ 16 Crash state: av1convolve2dcopysrsse2 av1convolve2dfacade av1makeinterpredictor...

OSV-2020-305 Stack-buffer-overflow in ot::NetworkData::Leader::SendCommissioningGetResponse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17297 Crash type: Stack-buffer-overflow READ 1 Crash state: ot::NetworkData::Leader::SendCommissioningGetResponse ot::NetworkData::Leader::HandleCommissioningGet ot::Coap::CoapBase::ProcessReceivedRequest...

OSV-2020-249 Heap-buffer-overflow in cipher_generic_initiv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19926 Crash type: Heap-buffer-overflow READ 16 Crash state: ciphergenericinitiv ciphergenericinitinternal cryptofuzz::module::OpenSSL::OpSymmetricDecryptEVP...

OSV-2020-242 Heap-buffer-overflow in ndpi_workflow_process_packet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20089 Crash type: Heap-buffer-overflow READ 2 Crash state: ndpiworkflowprocesspacket fuzzndpireader.c...

OSV-2020-209 Stack-buffer-overflow in coolkey_rsa_op

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22392 Crash type: Stack-buffer-overflow READ Crash state: coolkeyrsaop coolkeycomputecrypt scdecipher...

OSV-2020-185 Heap-buffer-overflow in ndpi_search_kerberos

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22419 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpisearchkerberos checkndpiudpflowfunc ndpicheckflowfunc...

OSV-2020-180 Heap-buffer-overflow in parquet::PlainByteArrayDecoder::DecodeArrowDense

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21009 Crash type: Heap-buffer-overflow READ 4 Crash state: parquet::PlainByteArrayDecoder::DecodeArrowDense parquet::PlainByteArrayDecoder::DecodeArrow parquet::internal::ByteArrayChunkedRecordReader::ReadValuesSpaced...

OSV-2020-62 Stack-buffer-overflow in tvb_get_ipv4_addr_with_prefix_len

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21715 Crash type: Stack-buffer-overflow READ 4 Crash state: tvbgetipv4addrwithprefixlen decodepathprefix4 decodeprefixMP...

OSV-2020-40 Heap-buffer-overflow in ndpi_workflow_process_packet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20766 Crash type: Heap-buffer-overflow READ 2 Crash state: ndpiworkflowprocesspacket fuzzndpireader.c...

OSV-2020-32 Heap-buffer-overflow in read_bits_16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20459 Crash type: Heap-buffer-overflow READ 1 Crash state: readbits16 decodenumber douncompressblock...