OSV-2018-128 Use-of-uninitialized-value in iclip

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11392 Crash type: Use-of-uninitialized-value Crash state: iclip avgc dav1dreconbinter16bpc...

OSV-2018-122 Use-of-uninitialized-value in gnutls_pkcs12_get_bag

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10136 Crash type: Use-of-uninitialized-value Crash state: gnutlspkcs12getbag gnutlspkcs12simpleparse gnutlspkcs12keyparserfuzzer.c...

OSV-2018-104 Heap-buffer-overflow in git__strntol64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11382 Crash type: Heap-buffer-overflow READ 1 Crash state: gitstrntol64 gitstrntol32 parsemode...

OSV-2018-89 Heap-use-after-free in TunnelIPv6Interface::remove_address

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10864 Crash type: Heap-use-after-free READ 4 Crash state: TunnelIPv6Interface::removeaddress nl::wpantund::NCPInstanceBase::unicastaddresswasremoved nl::wpantund::NCPInstanceBase::onmeshprefixwasremoved...

OSV-2018-72 Use-of-uninitialized-value in read_pbkdf2_params

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10143 Crash type: Use-of-uninitialized-value Crash state: readpbkdf2params gnutlsreadpkcsschemaparams pkcs8keydecrypt...

OSV-2018-62 Heap-buffer-overflow in parse_odp_key_mask_attr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11170 Crash type: Heap-buffer-overflow READ 1 Crash state: parseodpkeymaskattr parseodpaction odpactionsfromstring...

OSV-2017-10 Heap-use-after-free in UA_Subscription_answerPublishRequestsNoSubscription

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4097 Crash type: Heap-use-after-free READ 8 Crash state: UASubscriptionanswerPublishRequestsNoSubscription UAServerrunshutdown start...

OSV-2020-2300 Heap-buffer-overflow in H5MM_strdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29493 Crash type: Heap-buffer-overflow READ Crash state: H5MMstrdup H5Oattrshareddecode H5Omsgiteratereal...

OSV-2021-16 Stack-buffer-overflow in JS::Heap::gather_conservative_roots

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29266 Crash type: Stack-buffer-overflow READ 8 Crash state: JS::Heap::gatherconservativeroots JS::Heap::gatherroots JS::Heap::collectgarbage...

OSV-2020-2291 Heap-buffer-overflow in dotnet_parse_tilde_2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28981 Crash type: Heap-buffer-overflow READ 2 Crash state: dotnetparsetilde2 dotnetparsetilde dotnetparsecom...

OSV-2020-2273 Stack-buffer-overflow in perfetto::trace_processor::MemoryTrackerSnapshotParser::EmitRows

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28766 Crash type: Stack-buffer-overflow READ 4 Crash state: perfetto::traceprocessor::MemoryTrackerSnapshotParser::EmitRows perfetto::traceprocessor::MemoryTrackerSnapshotParser::GenerateGraphFromRawNode...

OSV-2020-2264 Stack-buffer-overflow in ot::IsValidUtf8String

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28682 Crash type: Stack-buffer-overflow READ 1 Crash state: ot::IsValidUtf8String ot::MeshCoP::NetworkNameTlv::IsValid ot::MeshCoP::Tlv::IsValid...

OSV-2020-2238 Heap-buffer-overflow in dotnet_parse_tilde_2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28253 Crash type: Heap-buffer-overflow READ Crash state: dotnetparsetilde2 dotnetparsetilde dotnetparsecom...

OSV-2020-2158 Global-buffer-overflow in arrow::Status arrow::internal::ValidateArrayFullImpl::ValidateListLike<arrow::Li

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27475 Crash type: Global-buffer-overflow READ 4 Crash state: arrow::Status arrow::internal::ValidateArrayFullImpl::ValidateListLikearrow::Li arrow::internal::ValidateArrayFullImpl::ValidateWithType...

OSV-2020-2139 Heap-double-free in flb_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27025 Crash type: Heap-double-free Crash state: flbfree flbsdsdestroy flbkvitemdestroy...

OSV-2020-2129 Heap-double-free in wmem_simple_free_all

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26952 Crash type: Heap-double-free Crash state: wmemsimplefreeall wmemleavepacketscope fuzzshark.c...

OSV-2020-2119 UNKNOWN READ in numberparsing.h

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26858 Crash type: UNKNOWN READ Crash state: numberparsing.h...

OSV-2020-2092 Heap-buffer-overflow in RsaPad_PSS

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26567 Crash type: Heap-buffer-overflow WRITE Crash state: RsaPadPSS wcRsaPadex RsaPublicEncryptEx...

OSV-2020-2084 UNKNOWN READ in WelsCommon::WelsMalloc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26420 Crash type: UNKNOWN READ Crash state: WelsCommon::WelsMalloc WelsCommon::CMemoryAlign::WelsMalloc WelsCommon::CMemoryAlign::WelsMallocz...

OSV-2020-2071 Heap-buffer-overflow in flb_log_print

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26325 Crash type: Heap-buffer-overflow READ Crash state: flblogprint flbparsertypecast logfmtparser...

OSV-2020-2007 Heap-buffer-overflow in WelsDec::WelsCheckAndRecoverForFutureDecoding

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26220 Crash type: Heap-buffer-overflow WRITE Crash state: WelsDec::WelsCheckAndRecoverForFutureDecoding WelsDec::WelsInitBSliceRefList WelsDec::InitRefPicList...

OSV-2020-1999 Bad-cast to pcpp::IDnsResource from invalid vptr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26196 Crash type: Bad-cast Crash state: Bad-cast to pcpp::IDnsResource from invalid vptr pcpp::DnsLayer::parseResources pcpp::DnsLayer::DnsLayer...

OSV-2020-1880 Use-of-uninitialized-value in c_pdf14trans_clist_read_update

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21640 Crash type: Use-of-uninitialized-value Crash state: cpdf14transclistreadupdate applycreatecompositor executecompositorqueue...

OSV-2020-1874 Use-of-uninitialized-value in load_truetype_glyph

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22182 Crash type: Use-of-uninitialized-value Crash state: loadtruetypeglyph TTLoadGlyph ttglyphload...

OSV-2020-1841 UNKNOWN READ in avifRWDataSet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25911 Crash type: UNKNOWN READ Crash state: avifRWDataSet avifParseItemDataBox avifParseMetaBox...

OSV-2020-1804 Heap-buffer-overflow in text_normalize_buffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22211 Crash type: Heap-buffer-overflow READ 1 Crash state: textnormalizebuffer arjreadmainheader cliunarjopen...

OSV-2020-1792 Heap-buffer-overflow in text_normalize_buffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20464 Crash type: Heap-buffer-overflow READ 1 Crash state: textnormalizebuffer arjreadfileheader cliscanarj...

OSV-2020-1677 Heap-use-after-free in UA_NodeMap_delete

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25245 Crash type: Heap-use-after-free READ 4 Crash state: UANodeMapdelete UAServernew fuzzbinarymessage.cc...

OSV-2020-1668 Memcpy-param-overlap in ot::Message::Write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25226 Crash type: Memcpy-param-overlap Crash state: ot::Message::Write ot::Message::CopyTo ot::Ip6::Ip6::InsertMplOption...

OSV-2020-1629 Segv on unknown address in wabt::BinaryReader::PrintError

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24992 Crash type: Segv on unknown address Crash state: wabt::BinaryReader::PrintError wabt::BinaryReader::ReadRelocSection wabt::BinaryReader::ReadCustomSection...

OSV-2020-1587 UNKNOWN WRITE in count_blocks

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24704 Crash type: UNKNOWN WRITE Crash state: countblocks optinit bpfoptimize...

OSV-2020-1510 UNKNOWN WRITE in FLAC__bitwriter_write_raw_uint32_nocheck

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19816 Crash type: UNKNOWN WRITE Crash state: FLACbitwriterwriterawuint32nocheck FLACbitwriterwriterawuint32 FLACframeaddheader...

OSV-2020-1377 Segv on unknown address in slice_segment_header::operator=

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22924 Crash type: Segv on unknown address Crash state: slicesegmentheader::operator= slicesegmentheader::read decodercontext::readsliceNAL...

OSV-2020-1379 Heap-buffer-overflow in dotnet_parse_com

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8901 Crash type: Heap-buffer-overflow READ 16 Crash state: dotnetparsecom dotnetload yrmodulesload...

OSV-2020-1315 Heap-buffer-overflow in pcpp::IPv4Layer::getFragmentFlags

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22638 Crash type: Heap-buffer-overflow READ 2 Crash state: pcpp::IPv4Layer::getFragmentFlags pcpp::IPv4Layer::isFragment pcpp::IPv4Layer::parseNextLayer...

OSV-2020-1300 Heap-buffer-overflow in ihevcd_parse_slice_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17036 Crash type: Heap-buffer-overflow WRITE 1 Crash state: ihevcdparseslicedata ihevcddecode ihevcdcxaapifunction...

OSV-2020-1301 Heap-buffer-overflow in hts_md5_update

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22231 Crash type: Heap-buffer-overflow READ Crash state: htsmd5update cramdecodeslice cramdecodeslicemt...

OSV-2020-1290 Bad-free in aes_gcm_cleanup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14333 Crash type: Bad-free Crash state: aesgcmcleanup EVPCIPHERCTXfree cryptofuzz::module::CTXCopier::copy...

OSV-2020-1285 Use-of-uninitialized-value in ihevc_deblk_luma_vert_ssse3

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17009 Crash type: Use-of-uninitialized-value Crash state: ihevcdeblklumavertssse3 ihevcddeblkctb ihevcdprocess...

OSV-2020-1252 Heap-buffer-overflow in jpc_dec_process_sot

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13310 Crash type: Heap-buffer-overflow READ 4 Crash state: jpcdecprocesssot jpcdecode jp2decode...

OSV-2020-1228 Heap-use-after-free in arrow::internal::CountSetBits

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20120 Crash type: Heap-use-after-free READ 8 Crash state: arrow::internal::CountSetBits arrow::Array::nullcount arrow::internal::ValidateArray...

OSV-2020-1186 Index-out-of-bounds in WelsDec::DecodeCurrentAccessUnit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12668 Crash type: Index-out-of-bounds Crash state: WelsDec::DecodeCurrentAccessUnit WelsDec::ConstructAccessUnit WelsDecodeBs...

OSV-2020-1152 Heap-buffer-overflow in pcpp::tbp_my_own_strnlen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22483 Crash type: Heap-buffer-overflow READ 1 Crash state: pcpp::tbpmyownstrnlen pcpp::HeaderField::HeaderField pcpp::TextBasedProtocolMessage::parseFields...

OSV-2020-1138 Heap-buffer-overflow in void apply_sao_internal<unsigned short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14184 Crash type: Heap-buffer-overflow READ 1 Crash state: void applysaointernal void applysao threadtasksao::work...

OSV-2020-1083 Heap-use-after-free in rpl_glob

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20176 Crash type: Heap-use-after-free READ Crash state: rplglob readconfigexpand readconfigexpand...

OSV-2020-1081 UNKNOWN WRITE in ideint_process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17077 Crash type: UNKNOWN WRITE Crash state: ideintprocess impeg2ddeinterlace impeg2ddecpicdatathread...

OSV-2020-1060 Use-of-uninitialized-value in ZSTD_createDDict_advanced

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23732 Crash type: Use-of-uninitialized-value Crash state: ZSTDcreateDDictadvanced ZSTDcreateDDict bloscrundecompressionwithcontext...

OSV-2020-1049 Heap-use-after-free in WelsDec::WelsReorderRefList

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14027 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::WelsReorderRefList WelsDec::InitRefPicList WelsDec::DecodeCurrentAccessUnit...

OSV-2020-1007 Heap-use-after-free in DetectParseDupSigCompareFunc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22715 Crash type: Heap-use-after-free READ 4 Crash state: DetectParseDupSigCompareFunc HashListTableLookup DetectEngineSignatureIsDuplicate...

OSV-2020-974 Heap-buffer-overflow in arrow::Status arrow::VisitArrayInline<arrow::internal::ValidateArrayDataVisitor>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20113 Crash type: Heap-buffer-overflow READ 4 Crash state: arrow::Status arrow::VisitArrayInline arrow::internal::ValidateArrayData arrow::RecordBatch::ValidateFull...