OSV-2021-1743 Stack-buffer-overflow in strncat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42736 Crash type: Stack-buffer-overflow WRITE Crash state: strncat pdfcmapopenfile pdfireadcmap...

OSV-2021-1726 UNKNOWN READ in pdfi_dereference

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42616 Crash type: UNKNOWN READ Crash state: pdfidereference pdfiderefloopdetect pdfidictget...

OSV-2021-1719 Heap-buffer-overflow in insert_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42560 Crash type: Heap-buffer-overflow WRITE 8 Crash state: insertfree chunkobjalloc chunkallocbytes...

OSV-2021-1717 UNKNOWN READ in pdfi_read_cff_font

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42559 Crash type: UNKNOWN READ Crash state: pdfireadcfffont pdfiloadfont pdfiloaddictfont...

OSV-2021-1712 Heap-buffer-overflow in ndlz8_decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42537 Crash type: Heap-buffer-overflow WRITE Crash state: ndlz8decompress bloscd dojob...

OSV-2021-1711 Heap-buffer-overflow in cmap_endcodespacerange_func

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42541 Crash type: Heap-buffer-overflow WRITE Crash state: cmapendcodespacerangefunc pdfipscriptinterpret pdfireadcmap...

OSV-2021-1709 Stack-buffer-overflow in pdfi_do_image

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42454 Crash type: Stack-buffer-overflow WRITE Crash state: pdfidoimage pdfidoimageorform pdfiDo...

OSV-2021-1703 UNKNOWN in pdfi_fapi_get_gsubr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42485 Crash type: UNKNOWN Crash state: pdfifapigetgsubr gsfapiserializetype2font gsfapiftgetscaledfont...

OSV-2021-1674 Heap-buffer-overflow in find_sdp_line_delimiter

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42238 Crash type: Heap-buffer-overflow READ 1 Crash state: findsdplinedelimiter parsemixedcontent parsesdp...

OSV-2021-1628 Stack-buffer-overflow in sprint_realloc_hinted_integer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41372 Crash type: Stack-buffer-overflow WRITE 1 Crash state: sprintreallochintedinteger sprintreallocinteger snprintinteger...

OSV-2021-1594 Heap-buffer-overflow in llvm::DataLayout::getIndexedOffsetInType

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41144 Crash type: Heap-buffer-overflow READ 4 Crash state: llvm::DataLayout::getIndexedOffsetInType InterpreterStackFrame::ResolveConstantValue InterpreterStackFrame::ResolveConstant...

OSV-2021-1526 Global-buffer-overflow in fr_unix_time_from_tm

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40600 Crash type: Global-buffer-overflow READ 2 Crash state: frunixtimefromtm frunixtimefromstr frvalueboxfromsubstr...

OSV-2021-1452 Heap-buffer-overflow in mrb_funcall_with_block

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39937 Crash type: Heap-buffer-overflow WRITE 8 Crash state: mrbfuncallwithblock mrbinstancenew mrbfuncallwithblock...

OSV-2021-1440 Heap-buffer-overflow in internal_huf_decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39836 Crash type: Heap-buffer-overflow READ 1 Crash state: internalhufdecompress internalexrundopiz defaultdecompresschunk...

OSV-2021-1326 Heap-buffer-overflow in my_ismbchar_utf8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38923 Crash type: Heap-buffer-overflow READ 2 Crash state: myismbcharutf8 checkcolumnname getvariable...

OSV-2021-1262 Heap-buffer-overflow in H5O__chunk_deserialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38686 Crash type: Heap-buffer-overflow READ 1 Crash state: H5Ochunkdeserialize H5Ocachechkdeserialize H5Cprotect...

OSV-2021-1235 Heap-buffer-overflow in ih264d_fill_bs1_16x16mb_pslice

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38387 Crash type: Heap-buffer-overflow READ 4 Crash state: ih264dfillbs116x16mbpslice ih264dcomputebsnonmbaffthread ih264drecondeblkslice...

OSV-2021-1231 Heap-buffer-overflow in padding

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38439 Crash type: Heap-buffer-overflow READ Crash state: padding sgrmixc lrstripe...

OSV-2021-1221 Heap-buffer-overflow in parse_via_param

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38307 Crash type: Heap-buffer-overflow READ 1 Crash state: parseviaparam parsevia gethdrfield...

OSV-2021-1214 Invalid-free in swift_unexpectedError

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38253 Crash type: Invalid-free Crash state: swiftunexpectedError FuzzJSON.FuzzJSON...

OSV-2021-1213 UNKNOWN WRITE in mrb_vm_exec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38251 Crash type: UNKNOWN WRITE Crash state: mrbvmexec mrbvmrun mrbtoprun...

OSV-2021-1211 Heap-buffer-overflow in MqttDecode_Publish

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38237 Crash type: Heap-buffer-overflow WRITE 8 Crash state: MqttDecodePublish MqttClientDecodePacket MqttClientHandlePacket...

OSV-2021-1177 Stack-buffer-overflow in bool draco::FloatPointsTreeDecoder::DecodePointCloud<draco::PointAttributeVector

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37716 Crash type: Stack-buffer-overflow READ Crash state: bool draco::FloatPointsTreeDecoder::DecodePointClouddraco::PointAttributeVector draco::KdTreeAttributesDecoder::DecodeDataNeededByPortableTransforms...

OSV-2021-1161 UNKNOWN READ in decode_ise

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37413 Crash type: UNKNOWN READ Crash state: decodeise physicaltosymbolic fuzzastcphysicaltosymbolic.cpp...

OSV-2021-1142 Heap-buffer-overflow in exif_get_slong

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37231 Crash type: Heap-buffer-overflow READ 1 Crash state: exifgetslong mnoteappleentrygetvalue exifmnotedataapplegetvalue...

OSV-2021-1134 Heap-buffer-overflow in exif_mnote_data_apple_load

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37222 Crash type: Heap-buffer-overflow READ Crash state: exifmnotedataappleload exifmnotedataload interpretmakernote...

OSV-2021-902 Heap-buffer-overflow in ebitmap_match_any

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35553 Crash type: Heap-buffer-overflow READ 8 Crash state: ebitmapmatchany avtabmap cilcheckneverallow...

OSV-2021-895 Segv on unknown address in helper_uc_tracecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35514 Crash type: Segv on unknown address Crash state: helpeructracecode...

OSV-2021-891 Heap-buffer-overflow in __cil_cat_expr_range_to_bitmap_helper

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35492 Crash type: Heap-buffer-overflow READ 4 Crash state: cilcatexprrangetobitmaphelper cilexprtobitmap evaluatecatexpression...

OSV-2021-871 Heap-use-after-free in jxl::ImageBlender::PrepareBlending

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35293 Crash type: Heap-use-after-free READ 8 Crash state: jxl::ImageBlender::PrepareBlending jxl::FinalizeFrameDecoding jxl::FrameDecoder::Flush...

OSV-2021-810 Global-buffer-overflow in SubstitutePhonemes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34747 Crash type: Global-buffer-overflow READ 2 Crash state: SubstitutePhonemes MakePhonemeList TranslateClause...

OSV-2021-802 Stack-buffer-overflow in InterpretCondition

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34692 Crash type: Stack-buffer-overflow READ 1 Crash state: InterpretCondition InterpretPhoneme MakePhonemeList...

OSV-2021-799 UNKNOWN READ in mrb_ary_shift_m

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34691 Crash type: UNKNOWN READ Crash state: mrbaryshiftm mrbvmexec mrbvmrun...

OSV-2021-764 Stack-buffer-overflow in TranslateNumber_1

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34285 Crash type: Stack-buffer-overflow READ 1 Crash state: TranslateNumber1 TranslateNumber TranslateWord3...

OSV-2021-757 Use-of-uninitialized-value in nn_check_initialized

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34156 Crash type: Use-of-uninitialized-value Crash state: nncheckinitialized nnzero ecgdsasignraw...

OSV-2021-750 Heap-double-free in flb_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34116 Crash type: Heap-double-free Crash state: flbfree flbparserjsondo flbparserdo...

OSV-2021-700 UNKNOWN READ in ReadLEB_u32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33749 Crash type: UNKNOWN READ Crash state: ReadLEBu32 InitElements CompileExtendedOpcode...

OSV-2021-699 UNKNOWN WRITE in m3_FreeModule

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33726 Crash type: UNKNOWN WRITE Crash state: m3FreeModule FreeModule CompileExtendedOpcode...

OSV-2021-654 Heap-buffer-overflow in decode_mcu_fast

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33340 Crash type: Heap-buffer-overflow READ 1 Crash state: decodemcufast decodemcu consumedata...

OSV-2021-644 UNKNOWN READ in blosc_d

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33292 Crash type: UNKNOWN READ Crash state: bloscd dojob bloscrundecompressionwithcontext...

OSV-2021-639 Heap-buffer-overflow in blosc_d

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33264 Crash type: Heap-buffer-overflow READ Crash state: bloscd bloscgetitem blosc2getitemctx...

OSV-2021-617 Stack-use-after-return in v9fs_setattr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32995 Crash type: Stack-use-after-return READ 4 Crash state: v9fssetattr coroutinetrampoline...

OSV-2021-616 Heap-buffer-overflow in Camellia_Ekeygen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33028 Crash type: Heap-buffer-overflow READ 1 Crash state: CamelliaEkeygen Camelliasetkey cipherhwcamelliainitkey...

OSV-2021-591 Segv on unknown address

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32767 Crash type: Segv on unknown address Crash state: NULL...

OSV-2021-536 Heap-use-after-free in cil_reset_classpermission

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32177 Crash type: Heap-use-after-free READ 8 Crash state: cilresetclasspermission cilresetclasspermsset cilresetclasspermslist...

OSV-2021-530 UNKNOWN WRITE in g_array_append_vals

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32131 Crash type: UNKNOWN WRITE Crash state: garrayappendvals gbytearrayappend fuefifirmwarefilesystemwrite...

OSV-2021-526 Heap-use-after-free in ZSTD_freeDDict

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32076 Crash type: Heap-use-after-free READ Crash state: ZSTDfreeDDict blosc2freectx blosc2schunkfree...

OSV-2021-514 UNKNOWN READ in _fini

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31953 Crash type: UNKNOWN READ Crash state: fini...

OSV-2021-498 Invalid-free in frame_get_lazychunk

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31705 Crash type: Invalid-free Crash state: framegetlazychunk framedecompresschunk blosc2schunkdecompresschunk...

OSV-2021-487 UNKNOWN READ in blosc_run_decompression_with_context

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31611 Crash type: UNKNOWN READ Crash state: bloscrundecompressionwithcontext blosc2decompressctx framedecompresschunk...