OSV-2022-468 Heap-buffer-overflow in json_parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47961 Crash type: Heap-buffer-overflow READ 1 Crash state: jsonparse fileisjson filebuffer...

OSV-2022-463 Uncaught exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47865 Crash type: Uncaught exception Crash state: com.ctc.wstx.dtd.FullDTDReader.readContentSpec com.ctc.wstx.util.PrefixedName.hashCode java.base/java.util.HashMap.hash...

OSV-2022-429 Heap-buffer-overflow in pdfi_dict_get_no_store_R_inner

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47601 Crash type: Heap-buffer-overflow READ Crash state: pdfidictgetnostoreRinner pdfidictgetnostoreRkey pdfifindresource...

OSV-2022-421 Stack-buffer-overflow in cardos_list_files

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47512 Crash type: Stack-buffer-overflow READ 1 Crash state: cardoslistfiles sclistfiles fuzzcard.c...

OSV-2022-416 Heap-buffer-overflow in opj_t1_allocate_buffers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47500 Crash type: Heap-buffer-overflow WRITE Crash state: opjt1allocatebuffers opjt1clbldecodeprocessor opjthreadpoolsubmitjob...

OSV-2022-380 Stack-buffer-overflow in sc_asn1_read_tag

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47035 Crash type: Stack-buffer-overflow READ 1 Crash state: scasn1readtag scasn1findtag cardoslistfiles...

OSV-2022-351 UNKNOWN READ in ref_stack_counttomark

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46705 Crash type: UNKNOWN READ Crash state: refstackcounttomark zcounttomark gsinterpret...

OSV-2022-252 Heap-buffer-overflow in grk::PacketLengthMarkers::readPLM

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45622 Crash type: Heap-buffer-overflow READ 1 Crash state: grk::PacketLengthMarkers::readPLM grk::CodeStreamDecompress::processmarker grk::CodeStreamDecompress::readHeaderProcedureImpl...

OSV-2022-223 Container-overflow in Exiv2::Photoshop::locateIrb

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45302 Crash type: Container-overflow READ 4 Crash state: Exiv2::Photoshop::locateIrb Exiv2::Photoshop::setIptcIrb Exiv2::JpegBase::doWriteMetadata...

OSV-2022-193 UNKNOWN READ in GC_generic_malloc_many

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44961 Crash type: UNKNOWN READ Crash state: GCgenericmallocmany GCmallockind Strnewsize...

OSV-2022-144 Segv on unknown address in onig_free_body

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44603 Crash type: Segv on unknown address Crash state: onigfreebody onignew flbregexcreate...

OSV-2022-141 Heap-use-after-free in nghttp2_hd_deflate_hd_bufs

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44517 Crash type: Heap-use-after-free READ 3 Crash state: nghttp2hddeflatehdbufs nghttp2framepackheaders nghttp2sessionmemsendinternal...

OSV-2022-115 UNKNOWN READ in unescape_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44300 Crash type: UNKNOWN READ Crash state: unescapestring parsestring parseobject...

OSV-2022-100 Stack-buffer-overflow in sgets

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44160 Crash type: Stack-buffer-overflow WRITE 1 Crash state: sgets pdfireadbytes readxrefentryslow...

OSV-2022-82 Heap-buffer-overflow in generic_unpack

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43961 Crash type: Heap-buffer-overflow READ 2 Crash state: genericunpack exrdecodingrun Imf31::checkCoreFile...

OSV-2022-79 Segv on unknown address in gp_semaphore_close

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43984 Crash type: Segv on unknown address Crash state: gpsemaphoreclose gxsemaphorefree icclinkcachefinalize...

OSV-2022-67 Heap-buffer-overflow in cli_bcomp_freemeta

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43816 Crash type: Heap-buffer-overflow READ 8 Crash state: clibcompfreemeta clibcompaddpatt cliparseadd...

OSV-2022-39 Stack-buffer-overflow in BZ2_decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43564 Crash type: Stack-buffer-overflow READ 1 Crash state: BZ2decompress BZ2bzDecompress ftbzip2filefilloutput...

OSV-2022-24 Null-dereference READ in session_startup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43419 Crash type: Null-dereference READ Crash state: sessionstartup libssh2sessionhandshake ssh2clientfuzzer.cc...

OSV-2021-1772 UNKNOWN READ in chunk_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42998 Crash type: UNKNOWN READ Crash state: chunkfreeobject gsfontdirfinalize chunkfreeobject...

OSV-2021-1764 UNKNOWN READ in read_xref_stream_entries

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42927 Crash type: UNKNOWN READ Crash state: readxrefstreamentries pdfiprocessxrefstream pdfireadxrefstreamdict...

OSV-2021-1755 Heap-buffer-overflow in ndlz4_decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42924 Crash type: Heap-buffer-overflow READ 4 Crash state: ndlz4decompress ndlzdecompress bloscd...

OSV-2021-1743 Stack-buffer-overflow in strncat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42736 Crash type: Stack-buffer-overflow WRITE Crash state: strncat pdfcmapopenfile pdfireadcmap...

OSV-2021-1737 Heap-buffer-overflow in Curl_sasl_decode_mech

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42727 Crash type: Heap-buffer-overflow READ 10 Crash state: Curlsasldecodemech Curlsaslparseurlauthoption pop3parseurloptions...

OSV-2021-1724 Segv on unknown address in chunk_obj_alloc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42633 Crash type: Segv on unknown address Crash state: chunkobjalloc chunkallocbytes pdfipscriptinterpret...

OSV-2021-1717 UNKNOWN READ in pdfi_read_cff_font

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42559 Crash type: UNKNOWN READ Crash state: pdfireadcfffont pdfiloadfont pdfiloaddictfont...

OSV-2021-1711 Heap-buffer-overflow in cmap_endcodespacerange_func

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42541 Crash type: Heap-buffer-overflow WRITE Crash state: cmapendcodespacerangefunc pdfipscriptinterpret pdfireadcmap...

OSV-2021-1709 Stack-buffer-overflow in pdfi_do_image

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42454 Crash type: Stack-buffer-overflow WRITE Crash state: pdfidoimage pdfidoimageorform pdfiDo...

OSV-2021-1707 Negative-size-param in general_endcidrange_func

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42479 Crash type: Negative-size-param Crash state: generalendcidrangefunc cmapendcidrangefunc pdfipscriptinterpret...

OSV-2021-1703 UNKNOWN in pdfi_fapi_get_gsubr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42485 Crash type: UNKNOWN Crash state: pdfifapigetgsubr gsfapiserializetype2font gsfapiftgetscaledfont...

OSV-2021-1698 Heap-buffer-overflow in chunk_obj_alloc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42356 Crash type: Heap-buffer-overflow READ 8 Crash state: chunkobjalloc chunkallocbytes pdfiobjectalloc...

OSV-2021-1693 Global-buffer-overflow in pdfi_fapi_get_glyph

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42310 Crash type: Global-buffer-overflow READ Crash state: pdfifapigetglyph getfapiglyphdata cffslotload...

OSV-2021-1580 Heap-buffer-overflow in H5G__node_found

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41011 Crash type: Heap-buffer-overflow READ 15 Crash state: H5Gnodefound H5Bfind H5Gstablookup...

OSV-2021-1527 UNKNOWN READ in exif_mnote_data_canon_load

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40623 Crash type: UNKNOWN READ Crash state: exifmnotedatacanonload exifmnotedataload interpretmakernote...

OSV-2021-1526 Global-buffer-overflow in fr_unix_time_from_tm

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40600 Crash type: Global-buffer-overflow READ 2 Crash state: frunixtimefromtm frunixtimefromstr frvalueboxfromsubstr...

OSV-2021-1470 Heap-buffer-overflow in hufDecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40091 Crash type: Heap-buffer-overflow READ 1 Crash state: hufDecode internalhufdecompress internalexrundopiz...

OSV-2021-1452 Heap-buffer-overflow in mrb_funcall_with_block

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39937 Crash type: Heap-buffer-overflow WRITE 8 Crash state: mrbfuncallwithblock mrbinstancenew mrbfuncallwithblock...

OSV-2021-1440 Heap-buffer-overflow in internal_huf_decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39836 Crash type: Heap-buffer-overflow READ 1 Crash state: internalhufdecompress internalexrundopiz defaultdecompresschunk...

OSV-2021-1415 Heap-buffer-overflow in Imf_3_1::memstream_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39616 Crash type: Heap-buffer-overflow READ 8 Crash state: Imf31::memstreamread dispatchread exrreadscanlinechunkinfo...

OSV-2021-1370 Heap-buffer-overflow in OT::MathGlyphConstruction::subset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39211 Crash type: Heap-buffer-overflow READ 2 Crash state: OT::MathGlyphConstruction::subset OT::MathVariants::subset OT::MATH::subset...

OSV-2021-1333 Heap-buffer-overflow in pe_get_section_full_name

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38952 Crash type: Heap-buffer-overflow READ 1 Crash state: pegetsectionfullname peload yrmodulesload...

OSV-2021-1330 Heap-buffer-overflow in parse_content_length

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38909 Crash type: Heap-buffer-overflow READ 1 Crash state: parsecontentlength gethdrfield parseheaders...

OSV-2021-1326 Heap-buffer-overflow in my_ismbchar_utf8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38923 Crash type: Heap-buffer-overflow READ 2 Crash state: myismbcharutf8 checkcolumnname getvariable...

OSV-2021-1262 Heap-buffer-overflow in H5O__chunk_deserialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38686 Crash type: Heap-buffer-overflow READ 1 Crash state: H5Ochunkdeserialize H5Ocachechkdeserialize H5Cprotect...

OSV-2021-1241 Heap-buffer-overflow in wabt::string_view::compare

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38404 Crash type: Heap-buffer-overflow READ 6 Crash state: wabt::stringview::compare wabt::ReadBinary wabt::ReadBinaryIr...

OSV-2021-1231 Heap-buffer-overflow in padding

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38439 Crash type: Heap-buffer-overflow READ Crash state: padding sgrmixc lrstripe...

OSV-2021-1214 Invalid-free in swift_unexpectedError

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38253 Crash type: Invalid-free Crash state: swiftunexpectedError FuzzJSON.FuzzJSON...

OSV-2021-1206 Stack-use-after-scope in uprv_stricmp_70

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38156 Crash type: Stack-use-after-scope READ 1 Crash state: uprvstricmp70 ulocimpgetLanguage70 canonicalize...

OSV-2021-1202 Heap-buffer-overflow in parse_to_param

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38080 Crash type: Heap-buffer-overflow READ 1 Crash state: parsetoparam parseaddrspec parseto...

OSV-2021-1189 Segv on unknown address in arrow::DefaultBackend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37915 Crash type: Segv on unknown address Crash state: arrow::DefaultBackend arrow::defaultmemorypool arrow::ipc::IpcReadOptions::Defaults...