OSV-2020-2274 Heap-buffer-overflow in McCopyWidthEq4_c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28769 Crash type: Heap-buffer-overflow READ 4 Crash state: McCopyWidthEq4c McCopysse2 McChromassse3...

OSV-2020-2161 Heap-buffer-overflow in msix_vector_masked

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27418 Crash type: Heap-buffer-overflow READ 1 Crash state: msixvectormasked msixismasked msixtablemmiowrite...

OSV-2020-2155 Heap-buffer-overflow in wolfSSH_CleanPath

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27436 Crash type: Heap-buffer-overflow READ 16 Crash state: wolfSSHCleanPath ParseScpCommand DoScpRequest...

OSV-2020-2124 UNKNOWN READ in jsoncharutils.h

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26859 Crash type: UNKNOWN READ Crash state: jsoncharutils.h...

OSV-2020-2097 Use-of-uninitialized-value in WelsCommon::CMemoryAlign::~CMemoryAlign

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26612 Crash type: Use-of-uninitialized-value Crash state: WelsCommon::CMemoryAlign::CMemoryAlign WelsCommon::CMemoryAlign::CMemoryAlign WelsDec::CWelsDecoder::UninitDecoderCtx...

OSV-2020-2076 Use-of-uninitialized-value in UpdateDecStatNoFreezingInfo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26346 Crash type: Use-of-uninitialized-value Crash state: UpdateDecStatNoFreezingInfo UpdateDecStat WelsDec::DecodeFrameConstruction...

OSV-2020-2072 Heap-buffer-overflow in _conv_num

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26327 Crash type: Heap-buffer-overflow READ 1 Crash state: convnum flbstrptime flbstrptime...

OSV-2020-2063 Heap-buffer-overflow in WelsDec::WelsDecodeMbCavlcBSlice

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26296 Crash type: Heap-buffer-overflow WRITE 16 Crash state: WelsDec::WelsDecodeMbCavlcBSlice WelsDec::WelsDecodeSlice WelsDec::DecodeCurrentAccessUnit...

OSV-2020-1981 Stack-buffer-overflow in fuzz_reader_transmit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26103 Crash type: Stack-buffer-overflow WRITE Crash state: fuzzreadertransmit scsingletransmit sctransmit...

OSV-2020-1870 Use-of-uninitialized-value in get_fapi_glyph_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22752 Crash type: Use-of-uninitialized-value Crash state: getfapiglyphdata loadtruetypeglyph TTLoadGlyph...

OSV-2020-1840 Heap-use-after-free in avifFileTypeIsCompatible

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25910 Crash type: Heap-use-after-free READ 4 Crash state: avifFileTypeIsCompatible avifDecoderParse avifdecodefuzzer.cc...

OSV-2020-1735 Heap-use-after-free in zend_gc_delref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25526 Crash type: Heap-use-after-free READ 4 Crash state: zendgcdelref izvalptrdtor zvalptrdtor...

OSV-2020-1733 Heap-buffer-overflow in le_to_u32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25533 Crash type: Heap-buffer-overflow READ 4 Crash state: letou32 letoi32 bcfdectypedint1safe...

OSV-2020-1661 Use-of-uninitialized-value in fuzzing::memory::memory_test_msan

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25181 Crash type: Use-of-uninitialized-value Crash state: fuzzing::memory::memorytestmsan cryptofuzz::ExecutorBase::postp cryptofuzz::ExecutorBase::Run...

OSV-2020-1655 Heap-buffer-overflow in zmq_z85_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25167 Crash type: Heap-buffer-overflow READ Crash state: zmqz85decode zmq::optionst::setcurvekey zmq::optionst::setsockopt...

OSV-2020-1559 UNKNOWN WRITE in hb_vector_t<CFF::parsed_cs_op_t>::resize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24532 Crash type: UNKNOWN WRITE Crash state: hbvectort::resize hbvectort::push CFF::parsedvaluest::addop...

OSV-2020-1550 UNKNOWN WRITE in hb_vector_t<CFF::dict_val_t>::resize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24489 Crash type: UNKNOWN WRITE Crash state: hbvectort::resize hbvectort::push CFF::dictvalt hbvectort::push...

OSV-2020-1521 Use-of-uninitialized-value in stbi__jpeg_huff_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22598 Crash type: Use-of-uninitialized-value Crash state: stbijpeghuffdecode stbijpegdecodeblockprogac stbiparseentropycodeddata...

OSV-2020-1516 Use-of-uninitialized-value in ScaleQuantumToChar

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22583 Crash type: Use-of-uninitialized-value Crash state: ScaleQuantumToChar LosslessReduceDepthOK ReadOneMNGImage...

OSV-2020-1448 Global-buffer-overflow in vte_write_debug

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22203 Crash type: Global-buffer-overflow READ 1 Crash state: vtewritedebug sendprimaryda doesc...

OSV-2020-1380 Use-of-uninitialized-value in stbi__jpeg_decode_block_prog_ac

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22589 Crash type: Use-of-uninitialized-value Crash state: stbijpegdecodeblockprogac stbiparseentropycodeddata stbidecodejpegimage...

OSV-2020-1349 Heap-buffer-overflow in mu::ParserBase::ParseCmdCodeBulk

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23410 Crash type: Heap-buffer-overflow READ 8 Crash state: mu::ParserBase::ParseCmdCodeBulk mu::ParserBase::ParseString setevalfuzzer.cc...

OSV-2020-1332 Index-out-of-bounds in xsltSetAttrVTsegment

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14273 Crash type: Index-out-of-bounds Crash state: xsltSetAttrVTsegment xsltCompileAttr xsltParseTemplateContent...

OSV-2020-1325 Global-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21769 Crash type: Global-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int CFF::Charset0::getglyph...

OSV-2020-1272 Heap-buffer-overflow in ASN1_get_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13803 Crash type: Heap-buffer-overflow READ 1 Crash state: ASN1getobject asn1checktlen asn1itemexd2i...

OSV-2020-1231 Heap-buffer-overflow in find_dom

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15284 Crash type: Heap-buffer-overflow WRITE Crash state: finddom optloop bpfoptimize...

OSV-2020-1212 Heap-buffer-overflow in helper_ret_stb_mmu_mips

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13489 Crash type: Heap-buffer-overflow READ 4 Crash state: helperretstbmmumips...

OSV-2020-1194 Heap-buffer-overflow in ndpi_search_mail_smtp_tcp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20563 Crash type: Heap-buffer-overflow READ 4 Crash state: ndpisearchmailsmtptcp checkndpitcpflowfunc ndpidetectionprocesspacket...

OSV-2020-1192 Index-out-of-bounds in decoder_context::has_sps

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13591 Crash type: Index-out-of-bounds Crash state: decodercontext::hassps picparameterset::read decodercontext::readppsNAL...

OSV-2020-1188 Heap-buffer-overflow in pcpp::IPv6Extension::getExtensionLen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22105 Crash type: Heap-buffer-overflow READ 1 Crash state: pcpp::IPv6Extension::getExtensionLen pcpp::IPv6Layer::parseExtensions pcpp::IPv6Layer::IPv6Layer...

OSV-2020-1161 Heap-buffer-overflow in impeg2_fmt_conv_yuv420p_to_yuv420sp_uv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16604 Crash type: Heap-buffer-overflow WRITE 1 Crash state: impeg2fmtconvyuv420ptoyuv420spuv impeg2dformatconvert impeg2ddecpicdatathread...

OSV-2020-1145 Heap-buffer-overflow in ihevcd_sao_shift_ctb

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16817 Crash type: Heap-buffer-overflow WRITE 1 Crash state: ihevcdsaoshiftctb ihevcdprocess ihevcdparseslicedata...

OSV-2020-1130 Heap-buffer-overflow in xsltFormatNumberConversion

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17171 Crash type: Heap-buffer-overflow READ 1 Crash state: xsltFormatNumberConversion xsltFormatNumberFunction xmlXPathCompOpEval...

OSV-2020-1098 Heap-use-after-free in WelsDec::MapColToList0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14060 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::MapColToList0 WelsDec::PredBDirectTemporal WelsDec::ParseInterBInfo...

OSV-2020-1035 UNKNOWN READ in subpixel_ssse3.asm:1165

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14478 Crash type: UNKNOWN READ Crash state: subpixelssse3.asm:1165...

OSV-2020-1006 Use-of-uninitialized-value in decimate_dsd_run

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19928 Crash type: Use-of-uninitialized-value Crash state: decimatedsdrun WavpackUnpackSamples WavpackSeekSample64...

OSV-2020-925 Global-buffer-overflow in draco::MeshEdgebreakerDecoderImpl<draco::MeshEdgebreakerTraversalValenceDecoder>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23419 Crash type: Global-buffer-overflow READ 4 Crash state: draco::MeshEdgebreakerDecoderImpl draco::MeshEdgebreakerDecoderImpl draco::MeshDecoder::DecodeGeometryData...

OSV-2020-912 Use-of-uninitialized-value in ndpi_fill_protocol_category

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21356 Crash type: Use-of-uninitialized-value Crash state: ndpifillprotocolcategory ndpidetectionprocesspacket fuzzprocesspacket.c...

OSV-2020-911 Heap-buffer-overflow in arrow::Status arrow::ConcatenateOffsets<int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23916 Crash type: Heap-buffer-overflow READ 4 Crash state: arrow::Status arrow::ConcatenateOffsets arrow::ConcatenateImpl::Visit arrow::Status arrow::VisitTypeInline...

OSV-2020-881 Heap-buffer-overflow in read_uleb128

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18549 Crash type: Heap-buffer-overflow READ 1 Crash state: readuleb128 walkexports getsymbols...

OSV-2020-783 UNKNOWN READ in wabt::BinaryReaderIR::OnFunctionSymbol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20364 Crash type: UNKNOWN READ Crash state: wabt::BinaryReaderIR::OnFunctionSymbol wabt::BinaryReader::ReadLinkingSection wabt::BinaryReader::ReadCustomSection...

OSV-2020-776 Negative-size-param in arrow::ConcatenateBuffers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24101 Crash type: Negative-size-param Crash state: arrow::ConcatenateBuffers arrow::ConcatenateImpl::Visit arrow::Status arrow::VisitTypeInline...

OSV-2020-751 Heap-buffer-overflow in readcfgfile

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23653 Crash type: Heap-buffer-overflow WRITE 1 Crash state: readcfgfile fuzzcfgparser.c...

OSV-2020-747 Heap-use-after-free in check_content_type_and_change_protocol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23691 Crash type: Heap-use-after-free READ 2 Crash state: checkcontenttypeandchangeprotocol ndpicheckhttptcp ndpisearchhttptcp...

OSV-2020-685 Global-buffer-overflow in backup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18464 Crash type: Global-buffer-overflow READ 1 Crash state: backup peek lexconfig...

OSV-2020-669 Use-of-uninitialized-value in g_date_time_get_week_number

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17648 Crash type: Use-of-uninitialized-value Crash state: gdatetimegetweeknumber gdatetimenewweek parseisoNUMBERdate...

OSV-2020-640 Stack-buffer-overflow in ot::Message::Write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15447 Crash type: Stack-buffer-overflow READ Crash state: ot::Message::Write ot::Message::Append ot::AddressResolver::SendAddressQueryResponse...

OSV-2020-638 Heap-buffer-overflow in OT::UnsizedArrayOf<OT::IntType<unsigned char, 1u> >::copy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14637 Crash type: Heap-buffer-overflow READ 1 Crash state: OT::UnsizedArrayOf ::copy bool OT::OffsetTo , OT::IntTy OT::NameRecord::copy...

OSV-2020-619 UNKNOWN READ in ot::Ip6::Netif::UnsubscribeAllRoutersMulticast

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13353 Crash type: UNKNOWN READ Crash state: ot::Ip6::Netif::UnsubscribeAllRoutersMulticast ot::Mle::MleRouter::HandleDetachStart ot::Mle::Mle::SetStateDetached...

OSV-2020-597 UNKNOWN READ in ot::MessageQueue::GetHead

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13386 Crash type: UNKNOWN READ Crash state: ot::MessageQueue::GetHead ot::Coap::CoapBase::ClearRequestsAndResponses ot::Coap::CoapSecure::Stop...