OSV-2022-67 Heap-buffer-overflow in cli_bcomp_freemeta

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43816 Crash type: Heap-buffer-overflow READ 8 Crash state: clibcompfreemeta clibcompaddpatt cliparseadd...

OSV-2021-1781 Heap-buffer-overflow in read_xref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43045 Crash type: Heap-buffer-overflow READ 8 Crash state: readxref pdfireadxref pdfisetinputstream...

OSV-2021-1771 Stack-buffer-overflow in fn_ElIn_evaluate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43012 Crash type: Stack-buffer-overflow WRITE 4 Crash state: fnElInevaluate pdfitfusingfunction gsbegintransparencymask...

OSV-2021-1743 Stack-buffer-overflow in strncat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42736 Crash type: Stack-buffer-overflow WRITE Crash state: strncat pdfcmapopenfile pdfireadcmap...

OSV-2021-1717 UNKNOWN READ in pdfi_read_cff_font

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42559 Crash type: UNKNOWN READ Crash state: pdfireadcfffont pdfiloadfont pdfiloaddictfont...

OSV-2021-1711 Heap-buffer-overflow in cmap_endcodespacerange_func

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42541 Crash type: Heap-buffer-overflow WRITE Crash state: cmapendcodespacerangefunc pdfipscriptinterpret pdfireadcmap...

OSV-2021-1709 Stack-buffer-overflow in pdfi_do_image

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42454 Crash type: Stack-buffer-overflow WRITE Crash state: pdfidoimage pdfidoimageorform pdfiDo...

OSV-2021-1703 UNKNOWN in pdfi_fapi_get_gsubr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42485 Crash type: UNKNOWN Crash state: pdfifapigetgsubr gsfapiserializetype2font gsfapiftgetscaledfont...

OSV-2021-1526 Global-buffer-overflow in fr_unix_time_from_tm

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40600 Crash type: Global-buffer-overflow READ 2 Crash state: frunixtimefromtm frunixtimefromstr frvalueboxfromsubstr...

OSV-2021-1470 Heap-buffer-overflow in hufDecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40091 Crash type: Heap-buffer-overflow READ 1 Crash state: hufDecode internalhufdecompress internalexrundopiz...

OSV-2021-1452 Heap-buffer-overflow in mrb_funcall_with_block

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39937 Crash type: Heap-buffer-overflow WRITE 8 Crash state: mrbfuncallwithblock mrbinstancenew mrbfuncallwithblock...

OSV-2021-1440 Heap-buffer-overflow in internal_huf_decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39836 Crash type: Heap-buffer-overflow READ 1 Crash state: internalhufdecompress internalexrundopiz defaultdecompresschunk...

OSV-2021-1415 Heap-buffer-overflow in Imf_3_1::memstream_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39616 Crash type: Heap-buffer-overflow READ 8 Crash state: Imf31::memstreamread dispatchread exrreadscanlinechunkinfo...

OSV-2021-1370 Heap-buffer-overflow in OT::MathGlyphConstruction::subset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39211 Crash type: Heap-buffer-overflow READ 2 Crash state: OT::MathGlyphConstruction::subset OT::MathVariants::subset OT::MATH::subset...

OSV-2021-1333 Heap-buffer-overflow in pe_get_section_full_name

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38952 Crash type: Heap-buffer-overflow READ 1 Crash state: pegetsectionfullname peload yrmodulesload...

OSV-2021-1326 Heap-buffer-overflow in my_ismbchar_utf8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38923 Crash type: Heap-buffer-overflow READ 2 Crash state: myismbcharutf8 checkcolumnname getvariable...

OSV-2021-1311 Null-dereference READ in unzOpenCurrentFile3

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38873 Crash type: Null-dereference READ Crash state: unzOpenCurrentFile3 unzOpenCurrentFile Assimp::ZipFileInfo::Extract...

OSV-2021-1262 Heap-buffer-overflow in H5O__chunk_deserialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38686 Crash type: Heap-buffer-overflow READ 1 Crash state: H5Ochunkdeserialize H5Ocachechkdeserialize H5Cprotect...

OSV-2021-1241 Heap-buffer-overflow in wabt::string_view::compare

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38404 Crash type: Heap-buffer-overflow READ 6 Crash state: wabt::stringview::compare wabt::ReadBinary wabt::ReadBinaryIr...

OSV-2021-1231 Heap-buffer-overflow in padding

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38439 Crash type: Heap-buffer-overflow READ Crash state: padding sgrmixc lrstripe...

OSV-2021-1214 Invalid-free in swift_unexpectedError

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38253 Crash type: Invalid-free Crash state: swiftunexpectedError FuzzJSON.FuzzJSON...

OSV-2021-1206 Stack-use-after-scope in uprv_stricmp_70

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38156 Crash type: Stack-use-after-scope READ 1 Crash state: uprvstricmp70 ulocimpgetLanguage70 canonicalize...

OSV-2021-1202 Heap-buffer-overflow in parse_to_param

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38080 Crash type: Heap-buffer-overflow READ 1 Crash state: parsetoparam parseaddrspec parseto...

OSV-2021-1189 Segv on unknown address in arrow::DefaultBackend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37915 Crash type: Segv on unknown address Crash state: arrow::DefaultBackend arrow::defaultmemorypool arrow::ipc::IpcReadOptions::Defaults...

OSV-2021-1177 Stack-buffer-overflow in bool draco::FloatPointsTreeDecoder::DecodePointCloud<draco::PointAttributeVector

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37716 Crash type: Stack-buffer-overflow READ Crash state: bool draco::FloatPointsTreeDecoder::DecodePointClouddraco::PointAttributeVector draco::KdTreeAttributesDecoder::DecodeDataNeededByPortableTransforms...

OSV-2021-1152 UNKNOWN READ in exif_mnote_data_apple_load

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37334 Crash type: UNKNOWN READ Crash state: exifmnotedataappleload exifmnotedataload interpretmakernote...

OSV-2021-1142 Heap-buffer-overflow in exif_get_slong

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37231 Crash type: Heap-buffer-overflow READ 1 Crash state: exifgetslong mnoteappleentrygetvalue exifmnotedataapplegetvalue...

OSV-2021-1113 Stack-buffer-overflow in getoid

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36962 Crash type: Stack-buffer-overflow READ 8 Crash state: getoid parseobjectid parseasntype...

OSV-2021-1110 Stack-buffer-overflow in TranslateWord2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36932 Crash type: Stack-buffer-overflow WRITE 1 Crash state: TranslateWord2 TranslateClause SpeakNextClause...

OSV-2021-902 Heap-buffer-overflow in ebitmap_match_any

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35553 Crash type: Heap-buffer-overflow READ 8 Crash state: ebitmapmatchany avtabmap cilcheckneverallow...

OSV-2021-895 Segv on unknown address in helper_uc_tracecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35514 Crash type: Segv on unknown address Crash state: helpeructracecode...

OSV-2021-891 Heap-buffer-overflow in __cil_cat_expr_range_to_bitmap_helper

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35492 Crash type: Heap-buffer-overflow READ 4 Crash state: cilcatexprrangetobitmaphelper cilexprtobitmap evaluatecatexpression...

OSV-2021-871 Heap-use-after-free in jxl::ImageBlender::PrepareBlending

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35293 Crash type: Heap-use-after-free READ 8 Crash state: jxl::ImageBlender::PrepareBlending jxl::FinalizeFrameDecoding jxl::FrameDecoder::Flush...

OSV-2021-802 Stack-buffer-overflow in InterpretCondition

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34692 Crash type: Stack-buffer-overflow READ 1 Crash state: InterpretCondition InterpretPhoneme MakePhonemeList...

OSV-2021-799 UNKNOWN READ in mrb_ary_shift_m

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34691 Crash type: UNKNOWN READ Crash state: mrbaryshiftm mrbvmexec mrbvmrun...

OSV-2021-764 Stack-buffer-overflow in TranslateNumber_1

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34285 Crash type: Stack-buffer-overflow READ 1 Crash state: TranslateNumber1 TranslateNumber TranslateWord3...

OSV-2021-750 Heap-double-free in flb_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34116 Crash type: Heap-double-free Crash state: flbfree flbparserjsondo flbparserdo...

OSV-2021-725 UNKNOWN READ in libfsext_directory_entry_read_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33935 Crash type: UNKNOWN READ Crash state: libfsextdirectoryentryreaddata libfsextdirectoryreadinlinedata libfsextdirectoryreadfileiohandle...

OSV-2021-699 UNKNOWN WRITE in m3_FreeModule

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33726 Crash type: UNKNOWN WRITE Crash state: m3FreeModule FreeModule CompileExtendedOpcode...

OSV-2021-654 Heap-buffer-overflow in decode_mcu_fast

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33340 Crash type: Heap-buffer-overflow READ 1 Crash state: decodemcufast decodemcu consumedata...

OSV-2021-644 UNKNOWN READ in blosc_d

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33292 Crash type: UNKNOWN READ Crash state: bloscd dojob bloscrundecompressionwithcontext...

OSV-2021-617 Stack-use-after-return in v9fs_setattr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32995 Crash type: Stack-use-after-return READ 4 Crash state: v9fssetattr coroutinetrampoline...

OSV-2021-536 Heap-use-after-free in cil_reset_classpermission

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32177 Crash type: Heap-use-after-free READ 8 Crash state: cilresetclasspermission cilresetclasspermsset cilresetclasspermslist...

OSV-2021-487 UNKNOWN READ in blosc_run_decompression_with_context

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31611 Crash type: UNKNOWN READ Crash state: bloscrundecompressionwithcontext blosc2decompressctx framedecompresschunk...

OSV-2021-456 Heap-buffer-overflow in grk::Quantizer::read_SQcd_SQcc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31460 Crash type: Heap-buffer-overflow READ 1 Crash state: grk::Quantizer::readSQcdSQcc grk::CodeStreamDecompress::readqcd grk::CodeStreamDecompress::processmarker...

OSV-2021-414 Heap-use-after-free in us_socket_close

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31047 Crash type: Heap-use-after-free READ 8 Crash state: ussocketclose wrapepollwait uslooprun...

OSV-2021-401 Segv on unknown address in us_internal_dispatch_ready_poll

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30951 Crash type: Segv on unknown address Crash state: usinternaldispatchreadypoll uslooprun test...

OSV-2021-399 Heap-buffer-overflow in void AK::__format_value<unsigned char>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30914 Crash type: Heap-buffer-overflow READ 1 Crash state: void AK::formatvalue AK::vformatimpl AK::vformatimpl...

OSV-2021-337 Heap-use-after-free in sampled_data_sample

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30715 Crash type: Heap-use-after-free WRITE 4 Crash state: sampleddatasample sampleddatacontinue interp...

OSV-2021-330 Heap-buffer-overflow in bn_sqr_karat_imp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30537 Crash type: Heap-buffer-overflow WRITE 8 Crash state: bnsqrkaratimp bnsqrkarat cryptofuzz::module::relicbignum::Sqr::Run...