OSV-2020-2144 Heap-buffer-overflow in wolfSSH_accept

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27298 Crash type: Heap-buffer-overflow READ 5 Crash state: wolfSSHaccept server.c...

OSV-2020-2106 UNKNOWN READ in grk::SparseBuffer<6u, 6u>::read_or_write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26702 Crash type: UNKNOWN READ Crash state: grk::SparseBuffer::readorwrite grk::SparseBuffer::read bool grk::decompresspartialtile...

OSV-2020-2062 Heap-buffer-overflow in WelsDec::WelsDecodeMbCabacISliceBaseMode0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26303 Crash type: Heap-buffer-overflow WRITE 4 Crash state: WelsDec::WelsDecodeMbCabacISliceBaseMode0 WelsDec::WelsDecodeMbCabacISlice WelsDec::WelsDecodeSlice...

OSV-2020-2018 Heap-use-after-free in fpixChangeRefcount

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26260 Crash type: Heap-use-after-free READ 4 Crash state: fpixChangeRefcount fpixDestroy fpix2fuzzer.cc...

OSV-2020-2008 UNKNOWN WRITE in wolfCrypt_custom_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26214 Crash type: UNKNOWN WRITE Crash state: wolfCryptcustomfree wolfSSLFree GetDhPublicKey...

OSV-2020-1899 Heap-buffer-overflow in DeblockChromaLt42_c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26068 Crash type: Heap-buffer-overflow READ 1 Crash state: DeblockChromaLt42c DeblockChromaLt4H2c WelsDec::FilteringEdgeChromaHV...

OSV-2020-1898 Heap-buffer-overflow in WelsDec::UpdateP16x16RefIdx

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26078 Crash type: Heap-buffer-overflow WRITE 2 Crash state: WelsDec::UpdateP16x16RefIdx WelsDec::PredBDirectTemporal WelsDec::ParseInterBInfo...

OSV-2020-1853 Heap-buffer-overflow in WelsDec::DoErrorConSliceCopy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25932 Crash type: Heap-buffer-overflow READ 1 Crash state: WelsDec::DoErrorConSliceCopy WelsDec::ImplementErrorCon WelsDec::CheckAndFinishLastPic...

OSV-2020-1845 Stack-buffer-overflow in void put_epel_hv_fallback<unsigned short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25937 Crash type: Stack-buffer-overflow READ 2 Crash state: void putepelhvfallback accelerationfunctions::puthevcepelv void mcchroma...

OSV-2020-1816 Heap-buffer-overflow in encoded_to_buf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25785 Crash type: Heap-buffer-overflow WRITE 1 Crash state: encodedtobuf flbutilswritestr msgpack2json...

OSV-2020-1787 Use-of-uninitialized-value in zend_generator_search_multi_children_node

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25678 Crash type: Use-of-uninitialized-value Crash state: zendgeneratorsearchmultichildrennode zendgeneratoraddchild zendgeneratoryieldfrom...

OSV-2020-1735 Heap-use-after-free in zend_gc_delref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25526 Crash type: Heap-use-after-free READ 4 Crash state: zendgcdelref izvalptrdtor zvalptrdtor...

OSV-2020-1698 Heap-buffer-overflow in macho_handle_segment

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25385 Crash type: Heap-buffer-overflow READ Crash state: machohandlesegment machoparsefile machoload...

OSV-2020-1695 Stack-buffer-overflow in uWS::TopicTree::trimTree

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25381 Crash type: Stack-buffer-overflow WRITE 8 Crash state: uWS::TopicTree::trimTree uWS::TopicTree::unsubscribeAll TopicTree.cpp...

OSV-2020-1683 UNKNOWN READ in zend_gc_delref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25321 Crash type: UNKNOWN READ Crash state: zendgcdelref zvaldelrefp zvalptrdtornogc...

OSV-2020-1656 Heap-buffer-overflow in macho_is_32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25134 Crash type: Heap-buffer-overflow READ 1 Crash state: machois32 machoparsefile machoparsefatfile...

OSV-2020-1623 Heap-use-after-free in xmlXIncludeIncludeNode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24925 Crash type: Heap-use-after-free READ 4 Crash state: xmlXIncludeIncludeNode xmlXIncludeDoProcess xmlXIncludeLoadFallback...

OSV-2020-1577 Heap-buffer-overflow in QPointF::x

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24615 Crash type: Heap-buffer-overflow READ 8 Crash state: QPointF::x QBezier::fromPoints QOutlineMapper::curveTo...

OSV-2020-1570 Heap-buffer-overflow in x265::PicYuv::copyFromPicture

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24590 Crash type: Heap-buffer-overflow READ Crash state: x265::PicYuv::copyFromPicture x265::Encoder::encode x265encoderencode...

OSV-2020-1531 Segv on unknown address in clang::Sema::PerformImplicitConversion

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19621 Crash type: Segv on unknown address Crash state: clang::Sema::PerformImplicitConversion clang::Sema::PerformImplicitConversion clang::Sema::PerformContextuallyConvertToBool...

OSV-2020-1356 Segv on unknown address in vips_XYZ2Lab_line

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24290 Crash type: Segv on unknown address Crash state: vipsXYZ2Labline vipscolourgen vipsregiongenerate...

OSV-2020-1311 Use-of-uninitialized-value in Sass::Prelexer::quoted_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Use-of-uninitialized-value Crash state: Sass::Prelexer::quotedstring Sass::Prelexer::staticcomponent char const Sass::Prelexer::zeroplus&...

OSV-2020-1250 Heap-use-after-free in WelsDec::MapColToList0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13185 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::MapColToList0 WelsDec::ParseInterBMotionInfoCabac WelsDec::WelsDecodeMbCabacBSliceBaseMode0...

OSV-2020-1234 Use-of-uninitialized-value in ihevc_recon_32x32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17072 Crash type: Use-of-uninitialized-value Crash state: ihevcrecon32x32 ihevcdiquantitransreconctb ihevcdprocess...

OSV-2020-1222 UNKNOWN READ in hpeek

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20473 Crash type: UNKNOWN READ Crash state: hpeek samhdrcreate viewsam...

OSV-2020-1216 Heap-buffer-overflow in ihevcd_ctb_boundary_strength_islice

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16842 Crash type: Heap-buffer-overflow WRITE 1 Crash state: ihevcdctbboundarystrengthislice ihevcdparseslicedata ihevcdnalunit...

OSV-2020-1173 Use-of-uninitialized-value in psscan

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21670 Crash type: Use-of-uninitialized-value Crash state: psscan documentload spectrereadfuzzer.c...

OSV-2020-1163 Heap-buffer-overflow in readstat_convert

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12566 Crash type: Heap-buffer-overflow READ 1 Crash state: readstatconvert sas7bcatparsevaluelabels sas7bcatparseblock...

OSV-2020-1158 Use-of-uninitialized-value in JBIG2HuffmanDecoder::buildTable

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18802 Crash type: Use-of-uninitialized-value Crash state: JBIG2HuffmanDecoder::buildTable JBIG2Stream::readTextRegionSeg JBIG2Stream::readSegments...

OSV-2020-1156 Heap-buffer-overflow in mu::Parser::Sum

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22927 Crash type: Heap-buffer-overflow READ 8 Crash state: mu::Parser::Sum mu::ParserBase::ParseCmdCodeBulk mu::ParserBase::ParseString...

OSV-2020-1151 Heap-buffer-overflow in sas_read2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12774 Crash type: Heap-buffer-overflow READ 2 Crash state: sasread2 sas7bdatparsecolumnnamesubheader sas7bdatparsepagepass2...

OSV-2020-1076 Stack-buffer-overflow in string_scan_range

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15467 Crash type: Stack-buffer-overflow WRITE 1 Crash state: stringscanrange getstringsrange rbinfilegetstrings...

OSV-2020-1012 Heap-buffer-overflow in sas_read8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12723 Crash type: Heap-buffer-overflow READ 8 Crash state: sasread8 sas7bdatparsecolumnsizesubheader sas7bdatparsepagepass2...

OSV-2020-910 Use-of-uninitialized-value in zmq::stream_engine_base_t::out_event

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24200 Crash type: Use-of-uninitialized-value Crash state: zmq::streamenginebaset::outevent zmq::epollt::loop zmq::workerpollerbaset::workerroutine...

OSV-2020-858 Heap-buffer-overflow in H5O_fill_new_shared_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18810 Crash type: Heap-buffer-overflow READ Crash state: H5Ofillnewshareddecode H5Omsgreadoh H5Omsgread...

OSV-2020-843 Heap-buffer-overflow in uni_utf8_get_char_n

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23513 Crash type: Heap-buffer-overflow READ 1 Crash state: uniutf8getcharn smtpcommandparseparameters smtpcommandparseline...

OSV-2020-833 Heap-buffer-overflow in Hacl_Chacha20PolyNUMBER_256_aead_decrypt

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23934 Crash type: Heap-buffer-overflow READ 1 Crash state: HaclChacha20PolyNUMBER256aeaddecrypt ChaCha20PolyNUMBEROpen sftkChaCha20PolyNUMBERDecrypt...

OSV-2020-791 UNKNOWN READ in BZ2_decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15639 Crash type: UNKNOWN READ Crash state: BZ2decompress BZ2bzDecompress ftbzip2filefilloutput...

OSV-2020-756 Use-of-uninitialized-value in spng_read_fuzzer.c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23936 Crash type: Use-of-uninitialized-value Crash state: spngreadfuzzer.c spngreadfuzzer.c...

OSV-2020-744 Heap-double-free in mrb_default_allocf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23801 Crash type: Heap-double-free Crash state: mrbdefaultallocf mrbfree objfree...

OSV-2020-718 UNKNOWN READ in double_from_wkb_state

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18153 Crash type: UNKNOWN READ Crash state: doublefromwkbstate ptarrayfromwkbstate lwlinefromwkbstate...

OSV-2020-658 Heap-buffer-overflow in inflate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15495 Crash type: Heap-buffer-overflow READ 1 Crash state: inflate perfetto::traceprocessor::GzipTraceParser::Parse perfetto::traceprocessor::TraceProcessorImpl::Parse...

OSV-2020-625 Heap-buffer-overflow in r_read_le32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13945 Crash type: Heap-buffer-overflow READ 1 Crash state: rreadle32 rreadle64 iskernelcache...

OSV-2020-543 Heap-buffer-overflow in circular_memcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14574 Crash type: Heap-buffer-overflow READ 8 Crash state: circularmemcpy runarmfilter runfilter...

OSV-2020-514 UNKNOWN READ in asn1_item_print_ctx

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14546 Crash type: UNKNOWN READ Crash state: asn1itemprintctx asn1templateprintctx asn1itemprintctx...

OSV-2020-433 UNKNOWN READ in icu_64::UCharsTrie::branchNext

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15580 Crash type: UNKNOWN READ Crash state: icu64::UCharsTrie::branchNext icu64::CollationIterator::nextCE32FromContraction icu64::CollationIterator::appendCEsFromCE32...

OSV-2020-434 Heap-buffer-overflow in format_generic_odp_key

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14429 Crash type: Heap-buffer-overflow READ 1 Crash state: formatgenericodpkey checkattrlen formatodpkeyattr...

OSV-2020-379 Heap-buffer-overflow in UA_unbase64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14621 Crash type: Heap-buffer-overflow WRITE 1 Crash state: UAunbase64 ByteStringdecodeJson decodeFields...

OSV-2020-335 Global-buffer-overflow in template_fuzzer.cc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18988 Crash type: Global-buffer-overflow WRITE 1 Crash state: templatefuzzer.cc...

OSV-2020-290 Use-of-uninitialized-value in rawspeed::RawImageData::checkMemIsInitialized

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18877 Crash type: Use-of-uninitialized-value Crash state: rawspeed::RawImageData::checkMemIsInitialized PhaseOneDecompressor.cpp posixmemalign...