OSV-2018-123 Use-of-uninitialized-value in iclip

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11532 Crash type: Use-of-uninitialized-value Crash state: iclip wienerc lrstripe...

OSV-2018-114 Heap-buffer-overflow in BEInt<unsigned int, 4>::operator unsigned int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10933 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned int OT::OffsetTo , OT::IntTypeunsigned i AAT::KerxSubTableFormat2::getkerning...

OSV-2018-83 Heap-buffer-overflow in encode_LEARN

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12328 Crash type: Heap-buffer-overflow READ Crash state: encodeLEARN ofpactsputopenflowactions ofputilencodeflowmod...

OSV-2018-68 Heap-buffer-overflow in read_bits_16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12817 Crash type: Heap-buffer-overflow READ 1 Crash state: readbits16 decodenumber parsetables...

OSV-2018-36 UNKNOWN READ in ebml_parse_chunk

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7887 Crash type: UNKNOWN READ Crash state: ebmlparsechunk matroskatypefind gsttypefindfactorycallfunction...

OSV-2017-9 Use-of-uninitialized-value in QuickOpen::Read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4507 Crash type: Use-of-uninitialized-value Crash state: QuickOpen::Read Archive::Read RawRead::Read...

OSV-2018-33 Heap-buffer-overflow in yr_object_set_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14560 Crash type: Heap-buffer-overflow READ Crash state: yrobjectsetstring dotnetparseus dotnetparsecom...

OSV-2018-31 Heap-buffer-overflow in emu_edge_c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11389 Crash type: Heap-buffer-overflow READ 2 Crash state: emuedgec warpaffine dav1dreconbinter8bpc...

OSV-2021-37 Heap-buffer-overflow in WelsDec::CopyRectBlock4Cols

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29431 Crash type: Heap-buffer-overflow READ 16 Crash state: WelsDec::CopyRectBlock4Cols WelsDec::GetColocatedMb WelsDec::PredMvBDirectSpatial...

OSV-2020-2297 Heap-double-free in WelsCommon::WelsFree

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29073 Crash type: Heap-double-free Crash state: WelsCommon::WelsFree WelsCommon::CMemoryAlign::WelsFree WelsDec::FreePicture...

OSV-2020-2240 Heap-buffer-overflow in process_chunked_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28265 Crash type: Heap-buffer-overflow READ 1 Crash state: processchunkeddata processdata fuzzprocessdata...

OSV-2020-2223 Heap-use-after-free in e1000e_write_packet_to_guest

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28194 Crash type: Heap-use-after-free READ 8 Crash state: e1000ewritepackettoguest e1000ereceiveiov e1000encreceiveiov...

OSV-2020-2165 Use-of-uninitialized-value in isSameGfxColor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27523 Crash type: Use-of-uninitialized-value Crash state: isSameGfxColor Gfx::doAxialShFill Gfx::opShFill...

OSV-2020-2148 Heap-buffer-overflow in flb_gzip_compress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27368 Crash type: Heap-buffer-overflow WRITE 1 Crash state: flbgzipcompress utilsfuzzer.c...

OSV-2020-2133 Heap-buffer-overflow in tdefl_compress_lz_codes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27263 Crash type: Heap-buffer-overflow WRITE 8 Crash state: tdeflcompresslzcodes tdeflcompressblock tdeflflushblock...

OSV-2020-2132 Heap-buffer-overflow in flb_gzip_compress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27261 Crash type: Heap-buffer-overflow WRITE 1 Crash state: flbgzipcompress utilsfuzzer.c...

OSV-2020-2100 Bad-cast to pcpp::IDnsResource from invalid vptr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26669 Crash type: Bad-cast Crash state: Bad-cast to pcpp::IDnsResource from invalid vptr pcpp::DnsLayer::parseResources pcpp::DnsLayer::DnsLayer...

OSV-2020-2083 Heap-buffer-overflow in clean_path

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26424 Crash type: Heap-buffer-overflow READ Crash state: cleanpath ParseScpCommand DoScpRequest...

OSV-2020-2078 Heap-buffer-overflow in WelsDec::UpdateP16x16RefIdx

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26389 Crash type: Heap-buffer-overflow WRITE 2 Crash state: WelsDec::UpdateP16x16RefIdx WelsDec::PredBDirectTemporal WelsDec::ParseInterBInfo...

OSV-2020-2074 UNKNOWN READ in WelsDec::WelsMarkAsRef

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26356 Crash type: UNKNOWN READ Crash state: WelsDec::WelsMarkAsRef WelsDec::MarkECFrameAsRef WelsDec::CheckAndFinishLastPic...

OSV-2020-2064 Heap-buffer-overflow in WelsDec::DoErrorConSliceCopy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26285 Crash type: Heap-buffer-overflow WRITE 8 Crash state: WelsDec::DoErrorConSliceCopy WelsDec::ImplementErrorCon WelsDec::CheckAndFinishLastPic...

OSV-2020-2061 Heap-buffer-overflow in WelsDec::WelsCheckAndRecoverForFutureDecoding

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26301 Crash type: Heap-buffer-overflow WRITE Crash state: WelsDec::WelsCheckAndRecoverForFutureDecoding WelsDec::WelsInitRefList WelsDec::InitRefPicList...

OSV-2020-2002 Heap-buffer-overflow in McChromaWithFragMv_c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26198 Crash type: Heap-buffer-overflow READ 1 Crash state: McChromaWithFragMvc McChromassse3 WelsDec::BaseMC...

OSV-2020-1976 Use-of-uninitialized-value in FLAC::Decoder::FuzzerStream::write_callback

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16503 Crash type: Use-of-uninitialized-value Crash state: FLAC::Decoder::FuzzerStream::writecallback writeaudioframetoclient readframe...

OSV-2020-1945 UNKNOWN READ in helper_uc_tracecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20038 Crash type: UNKNOWN READ Crash state: helpeructracecode...

OSV-2020-1902 Heap-buffer-overflow in asn1_get_next

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15408 Crash type: Heap-buffer-overflow READ 1 Crash state: asn1getnext x509parseextbasicconstraints x509parseextension...

OSV-2020-1886 Use-of-uninitialized-value in gs_scan_token

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21622 Crash type: Use-of-uninitialized-value Crash state: gsscantoken interp gscallinterp...

OSV-2020-1885 Heap-use-after-free in xmlStaticCopyNode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26022 Crash type: Heap-use-after-free READ 4 Crash state: xmlStaticCopyNode xmlCopyNode xmlXIncludeLoadTxt...

OSV-2020-1878 Use-of-uninitialized-value in s_A85D_process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21616 Crash type: Use-of-uninitialized-value Crash state: sA85Dprocess gsscantoken interp...

OSV-2020-1873 Use-of-uninitialized-value in zcheck_r6_password

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23440 Crash type: Use-of-uninitialized-value Crash state: zcheckr6password interp gscallinterp...

OSV-2020-1872 Use-of-uninitialized-value in s_exD_process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21643 Crash type: Use-of-uninitialized-value Crash state: sexDprocess sreadbuf sgets...

OSV-2020-1839 UNKNOWN READ in flb_sds_cat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25904 Crash type: UNKNOWN READ Crash state: flbsdscat flbmsgpackgelfkey flbmsgpackgelfflatten...

OSV-2020-1836 Heap-buffer-overflow in hextoint

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25885 Crash type: Heap-buffer-overflow READ 7 Crash state: hextoint getnamefromEFDatiPersonali itacnsadddatafiles...

OSV-2020-1726 Heap-use-after-free in xmlXPathNodeSetAdd

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25536 Crash type: Heap-use-after-free READ 4 Crash state: xmlXPathNodeSetAdd xmlXPathGetElementsByIds xmlXPathIdFunction...

OSV-2020-1664 Negative-size-param in BaseMemStream<char const>::getChars

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25221 Crash type: Negative-size-param Crash state: BaseMemStream::getChars Stream::doGetChars Stream::fillString...

OSV-2020-1606 UNKNOWN READ in hb_set_digest_lowest_bits_t<unsigned long, 4u>::may_have

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24842 Crash type: UNKNOWN READ Crash state: hbsetdigestlowestbitst::mayhave hbsetdigestcombinert, hbset OT::hbotlayoutlookupacceleratort::mayhave...

OSV-2020-1600 Use-of-uninitialized-value in fuzzing::memory::memory_test_msan

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24786 Crash type: Use-of-uninitialized-value Crash state: fuzzing::memory::memorytestmsan cryptofuzz::ExecutorBasecryptofuzz::component::Ciphertext, cryptofuzz::operatio cryptofuzz::ExecutorBasecryptofuzz::component::Ciphertex...

OSV-2020-1553 UNKNOWN READ in hb_realloc_impl

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24497 Crash type: UNKNOWN READ Crash state: hbreallocimpl hbvectort::alloc hbvectort::resize...

OSV-2020-1525 UNKNOWN in zend_ast_export_ex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24405 Crash type: UNKNOWN Crash state: zendastexportex zendastexportex zendastexportex...

OSV-2020-1507 Index-out-of-bounds in MemoryRemoveTrailingZeros

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23127 Crash type: Index-out-of-bounds Crash state: MemoryRemoveTrailingZeros CheckPWAuthSession CheckAuthSession...

OSV-2020-1489 Segv on unknown address in H5O_chunk_deserialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21315 Crash type: Segv on unknown address Crash state: H5Ochunkdeserialize H5Ocachechkload H5Cprotect...

OSV-2020-1472 Heap-buffer-overflow in stbi__YCbCr_to_RGB_simd

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22605 Crash type: Heap-buffer-overflow READ 8 Crash state: stbiYCbCrtoRGBsimd loadjpegimage stbijpegload...

OSV-2020-1440 Use-of-uninitialized-value in PPrintText

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13014 Crash type: Use-of-uninitialized-value Crash state: PPrintText prvTidyPPrintTree prvTidyPPrintTree...

OSV-2020-1429 Segv on unknown address in clang::OverloadExpr::find

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19972 Crash type: Segv on unknown address Crash state: clang::OverloadExpr::find clang::Sema::ResolveAndFixSingleFunctionTemplateSpecialization clang::Sema::CheckPlaceholderExpr...

OSV-2020-1371 Bad-cast to pcpp::IDnsResource from invalid vptr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23926 Crash type: Bad-cast Crash state: Bad-cast to pcpp::IDnsResource from invalid vptr pcpp::DnsLayer::parseResources pcpp::DnsLayer::DnsLayer...

OSV-2020-1340 Use-of-uninitialized-value in Gfx::fillPatch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15395 Crash type: Use-of-uninitialized-value Crash state: Gfx::fillPatch Gfx::doPatchMeshShFill Gfx::doShadingPatternFill...

OSV-2020-1326 Heap-buffer-overflow in ihevcd_parse_slice_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16804 Crash type: Heap-buffer-overflow READ 4 Crash state: ihevcdparseslicedata ihevcddecode ihevcdcxaapifunction...

OSV-2020-1299 UNKNOWN WRITE in ideint_weave_blk

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17084 Crash type: UNKNOWN WRITE Crash state: ideintweaveblk ideintprocess impeg2ddeinterlace...

OSV-2020-1294 Heap-buffer-overflow in SHA1Update

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18740 Crash type: Heap-buffer-overflow READ Crash state: SHA1Update getSSCertificateFingerprint tlsDetectProtocolFromCertificate...

OSV-2020-1266 UNKNOWN READ in arrow::Array::IsNull

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20139 Crash type: UNKNOWN READ Crash state: arrow::Array::IsNull arrow::Status arrow::VisitArrayInline arrow::internal::ValidateArrayData...