OSV-2021-536 Heap-use-after-free in cil_reset_classpermission

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32177 Crash type: Heap-use-after-free READ 8 Crash state: cilresetclasspermission cilresetclasspermsset cilresetclasspermslist...

OSV-2021-530 UNKNOWN WRITE in g_array_append_vals

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32131 Crash type: UNKNOWN WRITE Crash state: garrayappendvals gbytearrayappend fuefifirmwarefilesystemwrite...

OSV-2021-526 Heap-use-after-free in ZSTD_freeDDict

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32076 Crash type: Heap-use-after-free READ Crash state: ZSTDfreeDDict blosc2freectx blosc2schunkfree...

OSV-2021-514 UNKNOWN READ in _fini

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31953 Crash type: UNKNOWN READ Crash state: fini...

OSV-2021-498 Invalid-free in frame_get_lazychunk

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31705 Crash type: Invalid-free Crash state: framegetlazychunk framedecompresschunk blosc2schunkdecompresschunk...

OSV-2021-487 UNKNOWN READ in blosc_run_decompression_with_context

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31611 Crash type: UNKNOWN READ Crash state: bloscrundecompressionwithcontext blosc2decompressctx framedecompresschunk...

OSV-2021-485 Heap-buffer-overflow in blosc_run_decompression_with_context

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31585 Crash type: Heap-buffer-overflow READ 4 Crash state: bloscrundecompressionwithcontext blosc2decompressctx framedecompresschunk...

OSV-2021-474 Heap-buffer-overflow in sc_pkcs15emu_oberthur_add_cert

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31540 Crash type: Heap-buffer-overflow READ Crash state: scpkcs15emuoberthuraddcert scoberthurparsepublicinfo scpkcs15emuoberthurinit...

OSV-2021-456 Heap-buffer-overflow in grk::Quantizer::read_SQcd_SQcc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31460 Crash type: Heap-buffer-overflow READ 1 Crash state: grk::Quantizer::readSQcdSQcc grk::CodeStreamDecompress::readqcd grk::CodeStreamDecompress::processmarker...

OSV-2020-2309 UNKNOWN WRITE in flb_utils_proxy_url_split

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31306 Crash type: UNKNOWN WRITE Crash state: flbutilsproxyurlsplit utilsfuzzer.c...

OSV-2021-445 Global-buffer-overflow in AK::StringView::operator==

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31338 Crash type: Global-buffer-overflow READ 1 Crash state: AK::StringView::operator== = Markdown::Table::parse...

OSV-2021-442 Heap-buffer-overflow in fnv_32a_buf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31301 Crash type: Heap-buffer-overflow READ 1 Crash state: fnv32abuf fonthash asscacheget...

OSV-2021-439 UNKNOWN READ in blosc_d

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31241 Crash type: UNKNOWN READ Crash state: bloscd dojob bloscrundecompressionwithcontext...

OSV-2021-429 Heap-buffer-overflow in blosc_d

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31170 Crash type: Heap-buffer-overflow READ 4 Crash state: bloscd bloscgetitem blosc2getitemctx...

OSV-2021-428 Heap-buffer-overflow in frame_get_lazychunk

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31189 Crash type: Heap-buffer-overflow READ 4 Crash state: framegetlazychunk framedecompresschunk blosc2schunkdecompresschunk...

OSV-2021-426 Use-of-uninitialized-value in std::__1::__packaged_task_func<std::__1::__bind<grk::mct::decompress_irrev

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31180 Crash type: Use-of-uninitialized-value Crash state: std::1::packagedtaskfuncstd::1::bindgrk::mct::decompressirrev std::1::packagedtaskint ThreadPool::ThreadPool...

OSV-2021-414 Heap-use-after-free in us_socket_close

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31047 Crash type: Heap-use-after-free READ 8 Crash state: ussocketclose wrapepollwait uslooprun...

OSV-2021-401 Segv on unknown address in us_internal_dispatch_ready_poll

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30951 Crash type: Segv on unknown address Crash state: usinternaldispatchreadypoll uslooprun test...

OSV-2021-399 Heap-buffer-overflow in void AK::__format_value<unsigned char>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30914 Crash type: Heap-buffer-overflow READ 1 Crash state: void AK::formatvalue AK::vformatimpl AK::vformatimpl...

OSV-2021-397 Heap-buffer-overflow in Crypto::UnsignedBigInteger::UnsignedBigInteger

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30920 Crash type: Heap-buffer-overflow READ 1 Crash state: Crypto::UnsignedBigInteger::UnsignedBigInteger Crypto::UnsignedBigInteger::importdata Crypto::derdecodeinteger...

OSV-2021-382 Heap-buffer-overflow in frame_get_vlmetalayers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30868 Crash type: Heap-buffer-overflow READ 1 Crash state: framegetvlmetalayers frametoschunk blosc2schunkfrombuffer...

OSV-2021-337 Heap-use-after-free in sampled_data_sample

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30715 Crash type: Heap-use-after-free WRITE 4 Crash state: sampleddatasample sampleddatacontinue interp...

OSV-2021-330 Heap-buffer-overflow in bn_sqr_karat_imp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30537 Crash type: Heap-buffer-overflow WRITE 8 Crash state: bnsqrkaratimp bnsqrkarat cryptofuzz::module::relicbignum::Sqr::Run...

OSV-2021-305 Heap-buffer-overflow in rle_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30395 Crash type: Heap-buffer-overflow WRITE Crash state: rledecode ransuncompressto4x16 ransuncompress4x16...

OSV-2021-298 Heap-buffer-overflow in http_process_user_agent

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30389 Crash type: Heap-buffer-overflow READ Crash state: httpprocessuseragent processchlo ndpisearchquic...

OSV-2021-285 Use-of-uninitialized-value in grk::FileFormat::apply_palette_clr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30273 Crash type: Use-of-uninitialized-value Crash state: grk::FileFormat::applypaletteclr grk::FileFormat::decompress grkdecompress...

OSV-2021-276 Global-buffer-overflow in mode_sense_page

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30219 Crash type: Global-buffer-overflow READ 4 Crash state: modesensepage scsidiskcheckmodeselect modeselectpages...

OSV-2021-274 Memcpy-param-overlap in frame_get_metalayers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30253 Crash type: Memcpy-param-overlap Crash state: framegetmetalayers blosc2frametoschunk fuzzdecompressframe.c...

OSV-2021-262 Heap-buffer-overflow in sc_pkcs15emu_oberthur_add_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30112 Crash type: Heap-buffer-overflow READ Crash state: scpkcs15emuoberthuradddata scoberthurparseprivateinfo scpkcs15emuoberthurinit...

OSV-2021-258 Heap-buffer-overflow in unstripe

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30087 Crash type: Heap-buffer-overflow READ 1 Crash state: unstripe arithuncompressto arithdecode...

OSV-2021-247 Heap-buffer-overflow in blosc_getitem

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29976 Crash type: Heap-buffer-overflow READ 1 Crash state: bloscgetitem getcoffset framegetlazychunk...

OSV-2021-228 Heap-buffer-overflow in safe_ltf8_get

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29837 Crash type: Heap-buffer-overflow READ 1 Crash state: safeltf8get cramvarintdecodeinit cramdecoderinit...

OSV-2020-2304 Use-of-uninitialized-value in memory_test

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29731 Crash type: Use-of-uninitialized-value Crash state: memorytest fuzzersend wolfSSHSendPacket...

OSV-2021-212 Heap-buffer-overflow in pdf_get_xref_entry

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29728 Crash type: Heap-buffer-overflow READ 4 Crash state: pdfgetxrefentry pdfcacheobject pdfresolveindirect...

OSV-2021-207 Heap-buffer-overflow in blosc_getitem

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29613 Crash type: Heap-buffer-overflow READ 1 Crash state: bloscgetitem getcoffset framegetlazychunk...

OSV-2017-167 Global-buffer-overflow in vte_write_debug

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=457 Crash type: Global-buffer-overflow READ 1 Crash state: vtewritedebug doaction parsedata...

OSV-2018-454 Use-of-uninitialized-value in fz_expand_indexed_pixmap

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5645 Crash type: Use-of-uninitialized-value Crash state: fzexpandindexedpixmap fzdecompimagefromstream compressedimagegetpixmap...

OSV-2018-408 Use-of-uninitialized-value in fz_is_empty_irect

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5865 Crash type: Use-of-uninitialized-value Crash state: fzisemptyirect fzintersectirect fzdrawclippath...

OSV-2017-140 Heap-buffer-overflow in mprint

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1523 Crash type: Heap-buffer-overflow READ 3 Crash state: mprint match filesoftmagic...

OSV-2018-369 Negative-size-param in get_urls_css

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8032 Crash type: Negative-size-param Crash state: geturlscss wgetcssfuzzer.c...

OSV-2018-358 Use-of-uninitialized-value in jbig2_arith_bytein

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9677 Crash type: Use-of-uninitialized-value Crash state: jbig2arithbytein jbig2arithnew jbig2decodepatterndict...

OSV-2018-335 Null-dereference READ

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10888 Crash type: Null-dereference READ Crash state: NULL...

OSV-2018-310 Use-of-uninitialized-value in jbig2_arith_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5636 Crash type: Use-of-uninitialized-value Crash state: jbig2arithdecode jbig2decodegenerictemplate0unopt jbig2decodegenericregion...

OSV-2018-293 Use-of-uninitialized-value in pdf_load_version

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5496 Crash type: Use-of-uninitialized-value Crash state: pdfloadversion pdfinitdocument pdfopendocumentwithstream...

OSV-2017-134 Heap-buffer-overflow in cdf_file_property_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1064 Crash type: Heap-buffer-overflow READ 1 Crash state: cdffilepropertyinfo cdffilesummaryinfo cdfchecksummaryinfo...

OSV-2018-288 Use-of-uninitialized-value in jbig2_decode_symbol_dict

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9688 Crash type: Use-of-uninitialized-value Crash state: jbig2decodesymboldict jbig2symboldictionary jbig2parsesegment...

OSV-2018-273 Heap-buffer-overflow in ftp_parse_winnt_ls

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7930 Crash type: Heap-buffer-overflow READ 1 Crash state: ftpparsewinntls wgetftplsfuzzer.c...

OSV-2017-126 Bad-cast to const std::__1::__less<unsigned long, unsigned long> *_start

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=606 Crash type: Bad-cast Crash state: Bad-cast to const std::1::less start...

OSV-2017-97 Use-after-poison in rawspeed::unroll_loop_t<void rawspeed::LJpegDecompressor::decodeN<4>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4451 Crash type: Use-after-poison WRITE 2 Crash state: rawspeed::unrollloopt void rawspeed::LJpegDecompressor::decodeN rawspeed::AbstractLJpegDecompressor::decode...

OSV-2017-54 Use-of-uninitialized-value in macho_parse_file_32_be

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4375 Crash type: Use-of-uninitialized-value Crash state: machoparsefile32be machoload yrmodulesload...