OSV-2021-676 Heap-buffer-overflow in op_Const64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33554 Crash type: Heap-buffer-overflow WRITE 8 Crash state: opConst64 EvaluateExpression m3LoadModule...

OSV-2021-668 Stack-use-after-return in pdf14_initialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33529 Crash type: Stack-use-after-return WRITE 8 Crash state: pdf14initialize pdf14procsinitialize pdf14RGBinitialize...

OSV-2021-640 Heap-buffer-overflow in frame_get_metalayers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33251 Crash type: Heap-buffer-overflow READ 6 Crash state: framegetmetalayers frametoschunk blosc2schunkfrombuffer...

OSV-2021-451 Heap-buffer-overflow in void apply_sao_internal<unsigned short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31485 Crash type: Heap-buffer-overflow READ 1 Crash state: void applysaointernal void applysao threadtasksao::work...

OSV-2020-2309 UNKNOWN WRITE in flb_utils_proxy_url_split

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31306 Crash type: UNKNOWN WRITE Crash state: flbutilsproxyurlsplit utilsfuzzer.c...

OSV-2021-411 UNKNOWN READ in ot::Cli::Interpreter::OutputFormatV

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31002 Crash type: UNKNOWN READ Crash state: ot::Cli::Interpreter::OutputFormatV ot::Cli::Interpreter::OutputLine ot::Cli::SrpServer::ProcessDomain...

OSV-2021-398 Segv on unknown address in llvm_ks::StringRef::operator

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30932 Crash type: Segv on unknown address Crash state: llvmks::StringRef::operator llvmks::HashString llvmks::StringMapImpl::LookupBucketFor...

OSV-2021-373 Global-buffer-overflow in wabt::GetRelocTypeName

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30792 Crash type: Global-buffer-overflow READ 8 Crash state: wabt::GetRelocTypeName wabt::BinaryReader::ReadRelocSection wabt::BinaryReader::ReadCustomSection...

OSV-2021-365 Global-buffer-overflow in llvm_ks::StringRef::find_last_not_of

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30790 Crash type: Global-buffer-overflow READ 1 Crash state: llvmks::StringRef::findlastnotof llvmks::StringRef::rtrim llvmks::StringRef::trim...

OSV-2021-308 Heap-buffer-overflow in flatbuffers::JsonPrinter::GenFieldOffset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30468 Crash type: Heap-buffer-overflow READ 4 Crash state: flatbuffers::JsonPrinter::GenFieldOffset flatbuffers::JsonPrinter::GenStruct flatbuffers::GenerateText...

OSV-2021-307 UNKNOWN READ in cpu_arm_exec_armeb

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30444 Crash type: UNKNOWN READ Crash state: cpuarmexecarmeb resumeallvcpusarmeb vmstartarmeb...

OSV-2021-271 Heap-buffer-overflow in blosc_run_decompression_with_context

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30193 Crash type: Heap-buffer-overflow READ 1 Crash state: bloscrundecompressionwithcontext blosc2decompress fuzzdecompresschunk.c...

OSV-2021-246 Memcpy-param-overlap in frame_get_usermeta

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29973 Crash type: Memcpy-param-overlap Crash state: framegetusermeta blosc2frametoschunk blosc2schunkopensframe...

OSV-2018-459 Use-of-uninitialized-value in lex_white

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5632 Crash type: Use-of-uninitialized-value Crash state: lexwhite pdflex pdfprocessstream...

OSV-2018-451 Use-of-uninitialized-value in jbig2_huffman_get

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9682 Crash type: Use-of-uninitialized-value Crash state: jbig2huffmanget jbig2decodesymboldict jbig2symboldictionary...

OSV-2017-144 Global-buffer-overflow in csnStreamDissector

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1436 Crash type: Global-buffer-overflow READ 2 Crash state: csnStreamDissector csnStreamDissector csnStreamDissector...

OSV-2018-368 Use-of-uninitialized-value in evict

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5666 Crash type: Use-of-uninitialized-value Crash state: evict fzemptystore fzdropstorecontext...

OSV-2017-108 Heap-use-after-free in nl::wpantund::SpinelNCPInstance::should_filter_address

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4459 Crash type: Heap-use-after-free READ 6 Crash state: nl::wpantund::SpinelNCPInstance::shouldfilteraddress nl::wpantund::SpinelNCPInstance::handlencpspinelvalueinserted nl::wpantund::SpinelNCPInstance::handlencpspinelcallba...

OSV-2017-113 Use-of-uninitialized-value in CommandData::IsProcessFile

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4411 Crash type: Use-of-uninitialized-value Crash state: CommandData::IsProcessFile CmdExtract::ExtractCurrentFile CmdExtract::ExtractArchive...

OSV-2017-90 Use-of-uninitialized-value in ComprDataIO::UnpRead

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4283 Crash type: Use-of-uninitialized-value Crash state: ComprDataIO::UnpRead Unpack::UnpReadBuf Unpack::Unpack15...

OSV-2017-79 Heap-buffer-overflow in fuzz_read_callback

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4785 Crash type: Heap-buffer-overflow WRITE Crash state: fuzzreadcallback Curlfillreadbuffer readwriteupload...

OSV-2017-62 Use-of-uninitialized-value in gnutls_memset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1493 Crash type: Use-of-uninitialized-value Crash state: gnutlsmemset deinitkeys gnutlshandshakeinternalstateclear...

OSV-2018-175 Heap-buffer-overflow in rawspeed::VC5Decompressor::Wavelet::HighPassBand::decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11429 Crash type: Heap-buffer-overflow WRITE 2 Crash state: rawspeed::VC5Decompressor::Wavelet::HighPassBand::decode rawspeed::VC5Decompressor::decode VC5Decompressor.cpp...

OSV-2018-123 Use-of-uninitialized-value in iclip

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11532 Crash type: Use-of-uninitialized-value Crash state: iclip wienerc lrstripe...

OSV-2018-114 Heap-buffer-overflow in BEInt<unsigned int, 4>::operator unsigned int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10933 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned int OT::OffsetTo , OT::IntTypeunsigned i AAT::KerxSubTableFormat2::getkerning...

OSV-2018-83 Heap-buffer-overflow in encode_LEARN

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12328 Crash type: Heap-buffer-overflow READ Crash state: encodeLEARN ofpactsputopenflowactions ofputilencodeflowmod...

OSV-2018-75 Heap-buffer-overflow in ref_oneandzero_unpad

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10628 Crash type: Heap-buffer-overflow READ 1 Crash state: refoneandzerounpad fuzz fuzzers.h...

OSV-2018-68 Heap-buffer-overflow in read_bits_16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12817 Crash type: Heap-buffer-overflow READ 1 Crash state: readbits16 decodenumber parsetables...

OSV-2018-36 UNKNOWN READ in ebml_parse_chunk

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7887 Crash type: UNKNOWN READ Crash state: ebmlparsechunk matroskatypefind gsttypefindfactorycallfunction...

OSV-2018-33 Heap-buffer-overflow in yr_object_set_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14560 Crash type: Heap-buffer-overflow READ Crash state: yrobjectsetstring dotnetparseus dotnetparsecom...

OSV-2017-9 Use-of-uninitialized-value in QuickOpen::Read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4507 Crash type: Use-of-uninitialized-value Crash state: QuickOpen::Read Archive::Read RawRead::Read...

OSV-2018-31 Heap-buffer-overflow in emu_edge_c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11389 Crash type: Heap-buffer-overflow READ 2 Crash state: emuedgec warpaffine dav1dreconbinter8bpc...

OSV-2021-37 Heap-buffer-overflow in WelsDec::CopyRectBlock4Cols

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29431 Crash type: Heap-buffer-overflow READ 16 Crash state: WelsDec::CopyRectBlock4Cols WelsDec::GetColocatedMb WelsDec::PredMvBDirectSpatial...

OSV-2020-2297 Heap-double-free in WelsCommon::WelsFree

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29073 Crash type: Heap-double-free Crash state: WelsCommon::WelsFree WelsCommon::CMemoryAlign::WelsFree WelsDec::FreePicture...

OSV-2020-2240 Heap-buffer-overflow in process_chunked_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28265 Crash type: Heap-buffer-overflow READ 1 Crash state: processchunkeddata processdata fuzzprocessdata...

OSV-2020-2223 Heap-use-after-free in e1000e_write_packet_to_guest

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28194 Crash type: Heap-use-after-free READ 8 Crash state: e1000ewritepackettoguest e1000ereceiveiov e1000encreceiveiov...

OSV-2020-2165 Use-of-uninitialized-value in isSameGfxColor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27523 Crash type: Use-of-uninitialized-value Crash state: isSameGfxColor Gfx::doAxialShFill Gfx::opShFill...

OSV-2020-2148 Heap-buffer-overflow in flb_gzip_compress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27368 Crash type: Heap-buffer-overflow WRITE 1 Crash state: flbgzipcompress utilsfuzzer.c...

OSV-2020-2133 Heap-buffer-overflow in tdefl_compress_lz_codes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27263 Crash type: Heap-buffer-overflow WRITE 8 Crash state: tdeflcompresslzcodes tdeflcompressblock tdeflflushblock...

OSV-2020-2132 Heap-buffer-overflow in flb_gzip_compress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27261 Crash type: Heap-buffer-overflow WRITE 1 Crash state: flbgzipcompress utilsfuzzer.c...

OSV-2020-2100 Bad-cast to pcpp::IDnsResource from invalid vptr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26669 Crash type: Bad-cast Crash state: Bad-cast to pcpp::IDnsResource from invalid vptr pcpp::DnsLayer::parseResources pcpp::DnsLayer::DnsLayer...

OSV-2020-2083 Heap-buffer-overflow in clean_path

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26424 Crash type: Heap-buffer-overflow READ Crash state: cleanpath ParseScpCommand DoScpRequest...

OSV-2020-2078 Heap-buffer-overflow in WelsDec::UpdateP16x16RefIdx

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26389 Crash type: Heap-buffer-overflow WRITE 2 Crash state: WelsDec::UpdateP16x16RefIdx WelsDec::PredBDirectTemporal WelsDec::ParseInterBInfo...

OSV-2020-2074 UNKNOWN READ in WelsDec::WelsMarkAsRef

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26356 Crash type: UNKNOWN READ Crash state: WelsDec::WelsMarkAsRef WelsDec::MarkECFrameAsRef WelsDec::CheckAndFinishLastPic...

OSV-2020-2061 Heap-buffer-overflow in WelsDec::WelsCheckAndRecoverForFutureDecoding

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26301 Crash type: Heap-buffer-overflow WRITE Crash state: WelsDec::WelsCheckAndRecoverForFutureDecoding WelsDec::WelsInitRefList WelsDec::InitRefPicList...

OSV-2020-1976 Use-of-uninitialized-value in FLAC::Decoder::FuzzerStream::write_callback

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16503 Crash type: Use-of-uninitialized-value Crash state: FLAC::Decoder::FuzzerStream::writecallback writeaudioframetoclient readframe...

OSV-2020-1945 UNKNOWN READ in helper_uc_tracecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20038 Crash type: UNKNOWN READ Crash state: helpeructracecode...

OSV-2020-1902 Heap-buffer-overflow in asn1_get_next

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15408 Crash type: Heap-buffer-overflow READ 1 Crash state: asn1getnext x509parseextbasicconstraints x509parseextension...

OSV-2020-1886 Use-of-uninitialized-value in gs_scan_token

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21622 Crash type: Use-of-uninitialized-value Crash state: gsscantoken interp gscallinterp...

OSV-2020-1885 Heap-use-after-free in xmlStaticCopyNode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26022 Crash type: Heap-use-after-free READ 4 Crash state: xmlStaticCopyNode xmlCopyNode xmlXIncludeLoadTxt...