OSV-2021-494 Heap-buffer-overflow in AK::ByteBuffer::overwrite

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31698 Crash type: Heap-buffer-overflow READ 1 Crash state: AK::ByteBuffer::overwrite Crypto::PK::RSA::parsersakey FuzzRSAKeyParsing.cpp...

OSV-2021-481 Heap-buffer-overflow in ZSTD_createDDict_advanced

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31586 Crash type: Heap-buffer-overflow READ Crash state: ZSTDcreateDDictadvanced ZSTDcreateDDict bloscrundecompressionwithcontext...

OSV-2021-458 Heap-buffer-overflow in put_epel_8_fallback

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31501 Crash type: Heap-buffer-overflow READ 1 Crash state: putepel8fallback accelerationfunctions::puthevcepel void mcchroma...

OSV-2021-414 Heap-use-after-free in us_socket_close

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31047 Crash type: Heap-use-after-free READ 8 Crash state: ussocketclose wrapepollwait uslooprun...

OSV-2021-401 Segv on unknown address in us_internal_dispatch_ready_poll

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30951 Crash type: Segv on unknown address Crash state: usinternaldispatchreadypoll uslooprun test...

OSV-2021-399 Heap-buffer-overflow in void AK::__format_value<unsigned char>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30914 Crash type: Heap-buffer-overflow READ 1 Crash state: void AK::formatvalue AK::vformatimpl AK::vformatimpl...

OSV-2021-337 Heap-use-after-free in sampled_data_sample

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30715 Crash type: Heap-use-after-free WRITE 4 Crash state: sampleddatasample sampleddatacontinue interp...

OSV-2021-330 Heap-buffer-overflow in bn_sqr_karat_imp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30537 Crash type: Heap-buffer-overflow WRITE 8 Crash state: bnsqrkaratimp bnsqrkarat cryptofuzz::module::relicbignum::Sqr::Run...

OSV-2021-305 Heap-buffer-overflow in rle_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30395 Crash type: Heap-buffer-overflow WRITE Crash state: rledecode ransuncompressto4x16 ransuncompress4x16...

OSV-2021-274 Memcpy-param-overlap in frame_get_metalayers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30253 Crash type: Memcpy-param-overlap Crash state: framegetmetalayers blosc2frametoschunk fuzzdecompressframe.c...

OSV-2021-257 Stack-buffer-overflow in kdf_sshkdf_set_ctx_params

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30037 Crash type: Stack-buffer-overflow READ 1 Crash state: kdfsshkdfsetctxparams EVPKDFCTXsetparams cryptofuzz::module::OpenSSL::OpKDFSSH...

OSV-2021-251 Heap-buffer-overflow in safe_ltf8_get

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30012 Crash type: Heap-buffer-overflow READ 1 Crash state: safeltf8get cramconstdecodeinit cramdecoderinit...

OSV-2021-220 Heap-buffer-overflow in rans_uncompress_to_4x16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29795 Crash type: Heap-buffer-overflow READ 1 Crash state: ransuncompressto4x16 ransuncompress4x16 cramuncompressblock...

OSV-2021-207 Heap-buffer-overflow in blosc_getitem

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29613 Crash type: Heap-buffer-overflow READ 1 Crash state: bloscgetitem getcoffset framegetlazychunk...

OSV-2018-454 Use-of-uninitialized-value in fz_expand_indexed_pixmap

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5645 Crash type: Use-of-uninitialized-value Crash state: fzexpandindexedpixmap fzdecompimagefromstream compressedimagegetpixmap...

OSV-2018-448 Use-of-uninitialized-value in CachedXFORM4to3

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5623 Crash type: Use-of-uninitialized-value Crash state: CachedXFORM4to3 cmsDoTransform fzlcmstransformpixmap...

OSV-2018-413 Use-of-uninitialized-value in fz_adjust_ft_glyph_width

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5596 Crash type: Use-of-uninitialized-value Crash state: fzadjustftglyphwidth doftrenderglyph fzrenderftglyph...

OSV-2018-414 Use-of-uninitialized-value in jbig2_immediate_generic_region

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9680 Crash type: Use-of-uninitialized-value Crash state: jbig2immediategenericregion jbig2parsesegment jbig2datain...

OSV-2018-408 Use-of-uninitialized-value in fz_is_empty_irect

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5865 Crash type: Use-of-uninitialized-value Crash state: fzisemptyirect fzintersectirect fzdrawclippath...

OSV-2018-358 Use-of-uninitialized-value in jbig2_arith_bytein

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9677 Crash type: Use-of-uninitialized-value Crash state: jbig2arithbytein jbig2arithnew jbig2decodepatterndict...

OSV-2018-335 Null-dereference READ

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10888 Crash type: Null-dereference READ Crash state: NULL...

OSV-2017-134 Heap-buffer-overflow in cdf_file_property_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1064 Crash type: Heap-buffer-overflow READ 1 Crash state: cdffilepropertyinfo cdffilesummaryinfo cdfchecksummaryinfo...

OSV-2017-83 Heap-buffer-overflow in idn2_lookup_u8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2262 Crash type: Heap-buffer-overflow READ 4 Crash state: idn2lookupu8 pslidnatoASCII addpunycodeifneeded...

OSV-2017-78 Negative-size-param in UA_SecureChannel_processChunk

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3609 Crash type: Negative-size-param Crash state: UASecureChannelprocessChunk processCompleteChunk UAConnectionprocessChunks...

OSV-2017-71 Use-of-uninitialized-value in wcsncatz

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4350 Crash type: Use-of-uninitialized-value Crash state: wcsncatz Archive::ProcessExtra50 Archive::ReadHeader50...

OSV-2017-67 Heap-buffer-overflow in OSS_FUZZ_png_combine_row

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3608 Crash type: Heap-buffer-overflow WRITE Crash state: OSSFUZZpngcombinerow OSSFUZZpngreadrow start...

OSV-2017-61 Heap-buffer-overflow in opj_mct_decode_real

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3305 Crash type: Heap-buffer-overflow READ 4 Crash state: opjmctdecodereal opjtcdmctdecode opjtcddecodetile...

OSV-2017-59 Heap-buffer-overflow in nlohmann::basic_json<std::__1::map, std::__1::vector, std::__1::basic_string<cha

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=381 Crash type: Heap-buffer-overflow READ 1 Crash state: nlohmann::basicjsonstd::1::map, std::1::vector, std::1::basicstringcha nlohmann::basicjsonstd::1::map, std::1::vector, std::1::basicstringcha...

OSV-2017-35 Heap-buffer-overflow in opj_dwt_decode_partial_tile

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3125 Crash type: Heap-buffer-overflow READ Crash state: opjdwtdecodepartialtile opjtcddwtdecode opjtcddecodetile...

OSV-2017-33 Use-of-uninitialized-value in __cxxabiv1::scan_eh_tab

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4307 Crash type: Use-of-uninitialized-value Crash state: cxxabiv1::scanehtab gxxpersonalityv0 UnwindRaiseException...

OSV-2018-226 Heap-buffer-overflow in pcf_get_encodings

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9561 Crash type: Heap-buffer-overflow READ 1 Crash state: pcfgetencodings pcfloadfont PCFFaceInit...

OSV-2018-196 Use-of-uninitialized-value in _pkcs12_decode_safe_contents

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10216 Crash type: Use-of-uninitialized-value Crash state: pkcs12decodesafecontents parsesafecontents gnutlspkcs12getbag...

OSV-2018-195 Heap-buffer-overflow in gmp_emsa_pkcs1_signature_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10671 Crash type: Heap-buffer-overflow WRITE 1 Crash state: gmpemsapkcs1signaturedata verifyemsapkcs1signature verify...

OSV-2018-188 Use-of-uninitialized-value in _decode_pkcs12_auth_safe

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10138 Crash type: Use-of-uninitialized-value Crash state: decodepkcs12authsafe gnutlspkcs12getbag gnutlspkcs12simpleparse...

OSV-2018-190 Heap-buffer-overflow in OT::Coverage::intersects

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10084 Crash type: Heap-buffer-overflow READ 8 Crash state: OT::Coverage::intersects OT::ContextFormat2::closure hbvoidt const OT::hbclosurecontextt::dispatch...

OSV-2018-186 Use-of-uninitialized-value in decode_complex_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10137 Crash type: Use-of-uninitialized-value Crash state: decodecomplexstring gnutlsx509dntostring appendelements...

OSV-2018-182 Stack-buffer-overflow in cdma2k_message_HANDOFF_DIR

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11633 Crash type: Stack-buffer-overflow READ 2 Crash state: cdma2kmessageHANDOFFDIR cdma2kmessagedecode dissectcdma2k...

OSV-2018-176 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10899 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short AAT::LookupSegmentSingle ::cmp AAT::LookupSegmentSingle const OT::VarSizedBi...

OSV-2018-174 Heap-buffer-overflow in BEInt<unsigned char, 1>::operator unsigned char

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11245 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned char OT::KernSubTableFormat3::getkerning hbkernmachinet::kern...

OSV-2018-143 Global-buffer-overflow in CFF::BlendArg::set_blends

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11714 Crash type: Global-buffer-overflow READ 8 Crash state: CFF::BlendArg::setblends CFF::CFF2CSOpSetCFF2CSOpSetSubrSubset, CFF::SubrSubsetParam, CFF::PathProcsNul CFF2CSOpSetSubrSubset::processop...

OSV-2018-140 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11074 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short AAT::LookupFormat10 ::sanitize AAT::Lookup ::sanitize...

OSV-2018-131 Use-of-uninitialized-value in json_string_unescape

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11473 Crash type: Use-of-uninitialized-value Crash state: jsonstringunescape ofputiltablefromstring parseofpstr...

OSV-2018-117 Heap-buffer-overflow in Envoy::StringUtil::itoa

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10038 Crash type: Heap-buffer-overflow WRITE 1 Crash state: Envoy::StringUtil::itoa Envoy::Http::HeaderString::setInteger Envoy::TestOneProtoInput...

OSV-2018-109 Heap-use-after-free in ssl_get_prev_session

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8241 Crash type: Heap-use-after-free READ 4 Crash state: sslgetprevsession tlsearlypostprocessclienthello tlspostprocessclienthello...

OSV-2018-99 Heap-buffer-overflow in git__strntol64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11173 Crash type: Heap-buffer-overflow READ 1 Crash state: gitstrntol64 gitsignatureparse gitcommitparseraw...

OSV-2018-61 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12312 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::OffsetTo...

OSV-2018-48 Heap-buffer-overflow in PCF_Glyph_Load

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9524 Crash type: Heap-buffer-overflow READ 2 Crash state: PCFGlyphLoad FTLoadGlyph ftfuzzer.cc...

OSV-2018-46 Heap-buffer-overflow in GDAL_LercNS::RLE::readCount

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9282 Crash type: Heap-buffer-overflow READ 2 Crash state: GDALLercNS::RLE::readCount GDALLercNS::RLE::decompress GDALLercNS::Lerc2::ReadMask...

OSV-2021-64 Heap-buffer-overflow in H5MM_memcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29500 Crash type: Heap-buffer-overflow READ 4 Crash state: H5MMmemcpy H5Oattrdecode H5Oattrshareddecode...

OSV-2018-26 UNKNOWN READ in BEInt<unsigned char, 1>::operator unsigned char

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11351 Crash type: UNKNOWN READ Crash state: BEInt::operator unsigned char OT::DeviceRecord::serialize OT::hdmx::serialize...