OSV-2021-698 UNKNOWN READ in m3_Realloc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33744 Crash type: UNKNOWN READ Crash state: m3Realloc InitMemory CompileBlockStatements...

OSV-2021-664 Heap-use-after-free in module_check_cast

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33444 Crash type: Heap-use-after-free READ 4 Crash state: modulecheckcast serverconnectunref serverunref...

OSV-2021-622 Heap-buffer-overflow in frame_get_vlmetalayers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33071 Crash type: Heap-buffer-overflow READ Crash state: framegetvlmetalayers frametoschunk blosc2schunkfrombuffer...

OSV-2021-620 Segv on unknown address in dwg_free_summaryinfo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33059 Crash type: Segv on unknown address Crash state: dwgfreesummaryinfo dwgfree llvmfuzz.c...

OSV-2021-556 Uncaught exception in java.base/java.util.Arrays.copyOf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32423 Crash type: Uncaught exception Crash state: java.base/java.util.Arrays.copyOf com.fasterxml.jackson.core.util.TextBuffer.expandCurrentSegment com.fasterxml.jackson.core.json.UTF8StreamJsonParser.addName...

OSV-2021-541 Heap-buffer-overflow in flatbuffers::Table* flatbuffers::GetMutableRoot<flatbuffers::Table>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32254 Crash type: Heap-buffer-overflow READ 4 Crash state: flatbuffers::Table flatbuffers::GetMutableRoot flatbuffers::Table const flatbuffers::GetRoot flatbuffers::JsonPrinter::GenFieldOffset...

OSV-2021-510 Heap-use-after-free in grk_object_unref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31874 Crash type: Heap-use-after-free READ 8 Crash state: grkobjectunref grk::GrkObjectImpl::release grk::GrkObject::unref...

OSV-2021-482 Heap-buffer-overflow in draco::MeshPredictionSchemeTexCoordsDecoder<int, draco::PredictionSchemeWrapDeco

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31587 Crash type: Heap-buffer-overflow WRITE 4 Crash state: draco::MeshPredictionSchemeTexCoordsDecoderint, draco::PredictionSchemeWrapDeco draco::MeshPredictionSchemeTexCoordsDecoderint, draco::PredictionSchemeWrapDeco...

OSV-2021-476 Heap-buffer-overflow in blosc_d

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31556 Crash type: Heap-buffer-overflow READ 4 Crash state: bloscd dojob bloscrundecompressionwithcontext...

OSV-2021-460 Heap-buffer-overflow in Op_to_sdr_planes::convert_colorspace

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31495 Crash type: Heap-buffer-overflow READ 2 Crash state: Optosdrplanes::convertcolorspace heif::ColorConversionPipeline::convertimage heif::convertcolorspace...

OSV-2021-421 Heap-use-after-free in __cil_verify_classperms

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31124 Crash type: Heap-use-after-free READ 8 Crash state: cilverifyclassperms verifymappermclassperms hashtabmap...

OSV-2021-417 Heap-use-after-free in __cil_verify_classperms

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31065 Crash type: Heap-use-after-free READ 8 Crash state: cilverifyclassperms cilverifyclasspermission cilpreverifyhelper...

OSV-2021-374 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30817 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::AnchorMatrix::subset...

OSV-2021-369 Segv on unknown address in blosc_read_header

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30761 Crash type: Segv on unknown address Crash state: bloscreadheader blosc2getitemctx bloscgetitem...

OSV-2021-312 Heap-use-after-free in sampled_data_continue

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30487 Crash type: Heap-use-after-free WRITE 4 Crash state: sampleddatacontinue gsinterpret gsmainrunstringwithlength...

OSV-2021-261 Stack-buffer-overflow in flb_sds_cat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30093 Crash type: Stack-buffer-overflow READ Crash state: flbsdscat ratranslatekeymap flbratranslate...

OSV-2021-235 Global-buffer-overflow in QSvgSwitch::draw

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29873 Crash type: Global-buffer-overflow READ 1 Crash state: QSvgSwitch::draw QSvgTinyDocument::draw QSvgTinyDocument::draw...

OSV-2018-367 Use-of-uninitialized-value in cf2_glyphpath_lineTo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8323 Crash type: Use-of-uninitialized-value Crash state: cf2glyphpathlineTo cf2glyphpathcloseOpenPath cf2glyphpathmoveTo...

OSV-2018-347 Heap-use-after-free in fz_drop_key_storable

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5521 Crash type: Heap-use-after-free READ 4 Crash state: fzdropkeystorable fzdropdefaultcolorspaces fzdrawdropdevice...

OSV-2018-256 Use-of-uninitialized-value in cf2_glyphpath_lineTo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5782 Crash type: Use-of-uninitialized-value Crash state: cf2glyphpathlineTo cf2interpT2CharString cf2getGlyphOutline...

OSV-2017-116 Use-after-poison in rawspeed::OrfDecoder::decodeCompressed

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3012 Crash type: Use-after-poison WRITE 2 Crash state: rawspeed::OrfDecoder::decodeCompressed rawspeed::OrfDecoder::decodeRawInternal rawspeed::RawDecoder::decodeRaw...

OSV-2017-108 Heap-use-after-free in nl::wpantund::SpinelNCPInstance::should_filter_address

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4459 Crash type: Heap-use-after-free READ 6 Crash state: nl::wpantund::SpinelNCPInstance::shouldfilteraddress nl::wpantund::SpinelNCPInstance::handlencpspinelvalueinserted nl::wpantund::SpinelNCPInstance::handlencpspinelcallba...

OSV-2017-113 Use-of-uninitialized-value in CommandData::IsProcessFile

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4411 Crash type: Use-of-uninitialized-value Crash state: CommandData::IsProcessFile CmdExtract::ExtractCurrentFile CmdExtract::ExtractArchive...

OSV-2017-90 Use-of-uninitialized-value in ComprDataIO::UnpRead

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4283 Crash type: Use-of-uninitialized-value Crash state: ComprDataIO::UnpRead Unpack::UnpReadBuf Unpack::Unpack15...

OSV-2017-79 Heap-buffer-overflow in fuzz_read_callback

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4785 Crash type: Heap-buffer-overflow WRITE Crash state: fuzzreadcallback Curlfillreadbuffer readwriteupload...

OSV-2017-62 Use-of-uninitialized-value in gnutls_memset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1493 Crash type: Use-of-uninitialized-value Crash state: gnutlsmemset deinitkeys gnutlshandshakeinternalstateclear...

OSV-2018-175 Heap-buffer-overflow in rawspeed::VC5Decompressor::Wavelet::HighPassBand::decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11429 Crash type: Heap-buffer-overflow WRITE 2 Crash state: rawspeed::VC5Decompressor::Wavelet::HighPassBand::decode rawspeed::VC5Decompressor::decode VC5Decompressor.cpp...

OSV-2018-127 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10341 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short OT::Offset, true::isnull OT::OffsetToOT::ArrayOfM1OT::ResourceTypeRecord, OT::IntTypeunsigned short, 2...

OSV-2018-123 Use-of-uninitialized-value in iclip

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11532 Crash type: Use-of-uninitialized-value Crash state: iclip wienerc lrstripe...

OSV-2018-114 Heap-buffer-overflow in BEInt<unsigned int, 4>::operator unsigned int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10933 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned int OT::OffsetTo , OT::IntTypeunsigned i AAT::KerxSubTableFormat2::getkerning...

OSV-2018-83 Heap-buffer-overflow in encode_LEARN

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12328 Crash type: Heap-buffer-overflow READ Crash state: encodeLEARN ofpactsputopenflowactions ofputilencodeflowmod...

OSV-2018-68 Heap-buffer-overflow in read_bits_16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12817 Crash type: Heap-buffer-overflow READ 1 Crash state: readbits16 decodenumber parsetables...

OSV-2018-36 UNKNOWN READ in ebml_parse_chunk

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7887 Crash type: UNKNOWN READ Crash state: ebmlparsechunk matroskatypefind gsttypefindfactorycallfunction...

OSV-2017-9 Use-of-uninitialized-value in QuickOpen::Read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4507 Crash type: Use-of-uninitialized-value Crash state: QuickOpen::Read Archive::Read RawRead::Read...

OSV-2018-31 Heap-buffer-overflow in emu_edge_c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11389 Crash type: Heap-buffer-overflow READ 2 Crash state: emuedgec warpaffine dav1dreconbinter8bpc...

OSV-2017-1 Index-out-of-bounds in fuzz_send_next_response

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3956 Crash type: Index-out-of-bounds Crash state: fuzzsendnextresponse fuzzhandletransfer start...

OSV-2021-37 Heap-buffer-overflow in WelsDec::CopyRectBlock4Cols

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29431 Crash type: Heap-buffer-overflow READ 16 Crash state: WelsDec::CopyRectBlock4Cols WelsDec::GetColocatedMb WelsDec::PredMvBDirectSpatial...

OSV-2020-2297 Heap-double-free in WelsCommon::WelsFree

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29073 Crash type: Heap-double-free Crash state: WelsCommon::WelsFree WelsCommon::CMemoryAlign::WelsFree WelsDec::FreePicture...

OSV-2020-2240 Heap-buffer-overflow in process_chunked_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28265 Crash type: Heap-buffer-overflow READ 1 Crash state: processchunkeddata processdata fuzzprocessdata...

OSV-2020-2223 Heap-use-after-free in e1000e_write_packet_to_guest

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28194 Crash type: Heap-use-after-free READ 8 Crash state: e1000ewritepackettoguest e1000ereceiveiov e1000encreceiveiov...

OSV-2020-2165 Use-of-uninitialized-value in isSameGfxColor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27523 Crash type: Use-of-uninitialized-value Crash state: isSameGfxColor Gfx::doAxialShFill Gfx::opShFill...

OSV-2020-2148 Heap-buffer-overflow in flb_gzip_compress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27368 Crash type: Heap-buffer-overflow WRITE 1 Crash state: flbgzipcompress utilsfuzzer.c...

OSV-2020-2133 Heap-buffer-overflow in tdefl_compress_lz_codes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27263 Crash type: Heap-buffer-overflow WRITE 8 Crash state: tdeflcompresslzcodes tdeflcompressblock tdeflflushblock...

OSV-2020-2132 Heap-buffer-overflow in flb_gzip_compress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27261 Crash type: Heap-buffer-overflow WRITE 1 Crash state: flbgzipcompress utilsfuzzer.c...

OSV-2020-2100 Bad-cast to pcpp::IDnsResource from invalid vptr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26669 Crash type: Bad-cast Crash state: Bad-cast to pcpp::IDnsResource from invalid vptr pcpp::DnsLayer::parseResources pcpp::DnsLayer::DnsLayer...

OSV-2020-2083 Heap-buffer-overflow in clean_path

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26424 Crash type: Heap-buffer-overflow READ Crash state: cleanpath ParseScpCommand DoScpRequest...

OSV-2020-2078 Heap-buffer-overflow in WelsDec::UpdateP16x16RefIdx

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26389 Crash type: Heap-buffer-overflow WRITE 2 Crash state: WelsDec::UpdateP16x16RefIdx WelsDec::PredBDirectTemporal WelsDec::ParseInterBInfo...

OSV-2020-2074 UNKNOWN READ in WelsDec::WelsMarkAsRef

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26356 Crash type: UNKNOWN READ Crash state: WelsDec::WelsMarkAsRef WelsDec::MarkECFrameAsRef WelsDec::CheckAndFinishLastPic...

OSV-2020-2064 Heap-buffer-overflow in WelsDec::DoErrorConSliceCopy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26285 Crash type: Heap-buffer-overflow WRITE 8 Crash state: WelsDec::DoErrorConSliceCopy WelsDec::ImplementErrorCon WelsDec::CheckAndFinishLastPic...

OSV-2020-2061 Heap-buffer-overflow in WelsDec::WelsCheckAndRecoverForFutureDecoding

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26301 Crash type: Heap-buffer-overflow WRITE Crash state: WelsDec::WelsCheckAndRecoverForFutureDecoding WelsDec::WelsInitRefList WelsDec::InitRefPicList...