OSV-2018-428 UNKNOWN READ in jbig2_decode_mmr_init

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9681 Crash type: UNKNOWN READ Crash state: jbig2decodemmrinit jbig2decodegenericmmr jbig2decodesymboldict...

OSV-2018-303 UNKNOWN READ in _gcry_aes_cbc_enc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6336 Crash type: UNKNOWN READ Crash state: gcryaescbcenc cmacwrite gcryciphercmacauthenticate...

OSV-2018-279 Use-of-uninitialized-value in fz_drop_hash_table

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5609 Crash type: Use-of-uninitialized-value Crash state: fzdrophashtable fzfincachedcolorconverter fzpaintshade...

OSV-2017-53 Stack-buffer-overflow in _psl_idna_toASCII

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2600 Crash type: Stack-buffer-overflow READ Crash state: pslidnatoASCII addpunycodeifneeded pslloadfp...

OSV-2017-52 Use-of-uninitialized-value in mcopy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2242 Crash type: Use-of-uninitialized-value Crash state: mcopy mget match...

OSV-2018-230 Heap-buffer-overflow in rtsp_rtp_readwrite

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7105 Crash type: Heap-buffer-overflow READ 1 Crash state: rtsprtpreadwrite readwritedata Curlreadwrite...

OSV-2017-29 Heap-use-after-free in UInt32_encodeBinary

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4764 Crash type: Heap-use-after-free WRITE 4 Crash state: UInt32encodeBinary UAencodeBinaryInternal UAencodeBinary...

OSV-2017-24 Heap-buffer-overflow in pnm_type_find

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4039 Crash type: Heap-buffer-overflow READ 1 Crash state: pnmtypefind gsttypefindfactorycallfunction gsttypefindhelperfordata...

OSV-2018-206 Heap-buffer-overflow in parse_sigalgs_list

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9808 Crash type: Heap-buffer-overflow READ 1 Crash state: parsesigalgslist SSLCTXset1sigalgslist std::1::functionvoid...

OSV-2018-198 Heap-buffer-overflow in r_read_le32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11308 Crash type: Heap-buffer-overflow READ 1 Crash state: rreadle32 rreadle64 rbinfilegetstrings...

OSV-2018-185 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11001 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short OT::IndexSubtable::getextents OT::IndexSubtableRecord::getextents...

OSV-2018-172 UNKNOWN READ in _hb_ot_shape_fallback_kern

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10762 Crash type: UNKNOWN READ Crash state: hbotshapefallbackkern hbotposition hbotshapeinternal...

OSV-2018-167 Heap-buffer-overflow in cff_parser_run

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9967 Crash type: Heap-buffer-overflow WRITE 1 Crash state: cffparserrun cffsubfontload cfffontload...

OSV-2018-158 Heap-buffer-overflow in ofpbuf_insert

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11253 Crash type: Heap-buffer-overflow WRITE Crash state: ofpbufinsert nxputraw nxputmatch...

OSV-2018-152 Heap-buffer-overflow in dhcp6_option_parse_status

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10746 Crash type: Heap-buffer-overflow READ 2 Crash state: dhcp6optionparsestatus dhcp6optionparsepdprefix dhcp6optionparseia...

OSV-2018-148 Heap-buffer-overflow in r_bin_filter_sections

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11272 Crash type: Heap-buffer-overflow WRITE 3 Crash state: rbinfiltersections rbinobjectsetitems rbinobjectnew...

OSV-2018-126 UNKNOWN READ in BEInt<int, 4>::operator int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10900 Crash type: UNKNOWN READ Crash state: BEInt::operator int AAT::KerxSubTableFormat6::getkerning hbkernmachinet::kern...

OSV-2018-82 Heap-buffer-overflow in OT::LigatureSubstFormat1::closure

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10081 Crash type: Heap-buffer-overflow READ 8 Crash state: OT::LigatureSubstFormat1::closure hbvoidt const OT::hbclosurecontextt::dispatch OT::hbclosurecontextt::returnt OT::LigatureSubst::dispatchOT::hbclosureco...

OSV-2020-2251 Heap-buffer-overflow in blosc_run_decompression_with_context

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28392 Crash type: Heap-buffer-overflow READ 1 Crash state: bloscrundecompressionwithcontext blosc2decompressctx framedecompresschunk...

OSV-2020-2249 Heap-buffer-overflow in grk::t1_part1::T1Part1::decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28328 Crash type: Heap-buffer-overflow READ Crash state: grk::t1part1::T1Part1::decompress grk::DecompressBlockExec::open grk::T1DecompressScheduler::decompressBlock...

OSV-2020-2244 UNKNOWN READ in cras_system_state_stream_added

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28261 Crash type: UNKNOWN READ Crash state: crassystemstatestreamadded crasrstreamcreate streamlistadd...

OSV-2020-2227 Heap-buffer-overflow in ieeeNUMBER_fragment_hash

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28191 Crash type: Heap-buffer-overflow READ 6 Crash state: ieeeNUMBERfragmenthash ghashtableinsertinternal fragmentaddseqcommon...

OSV-2020-2221 UNKNOWN READ in std::__1::pair<unsigned int, void*> uWS::HttpParser::fenceAndConsumePostPadded<0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28216 Crash type: UNKNOWN READ Crash state: std::1::pair uWS::HttpParser::fenceAndConsumePostPadded0 uWS::HttpParser::consumePostPadded std::1::function::funcLLVMFuzzerTestOneInput::$0, std::1::allocatorLL...

OSV-2020-2220 Heap-buffer-overflow in mk_rconf_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28241 Crash type: Heap-buffer-overflow READ 1 Crash state: mkrconfread mkrconfopen flbparserconffile...

OSV-2020-2212 Heap-buffer-overflow in ih264d_fill_bs1_16x16mb_pslice

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28039 Crash type: Heap-buffer-overflow READ 8 Crash state: ih264dfillbs116x16mbpslice ih264dcomputebsnonmbaffthread ih264drecondeblkslice...

OSV-2020-2206 Segv on unknown address in ndpi_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27988 Crash type: Segv on unknown address Crash state: ndpifree ndpifreeflow fuzzprocesspacket.c...

OSV-2020-2205 Heap-buffer-overflow in ojph::local::ojph_decode_codeblock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27924 Crash type: Heap-buffer-overflow WRITE 4 Crash state: ojph::local::ojphdecodecodeblock grk::t1ht::T1HT::decompress grk::DecompressBlockExec::open...

OSV-2020-2179 Heap-buffer-overflow in arrow::internal::ValidateUTF8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27731 Crash type: Heap-buffer-overflow READ 8 Crash state: arrow::internal::ValidateUTF8 arrow::internal::ValidateArrayFullImpl::ValidateWithType arrow::internal::ValidateArrayFullImpl::Visit...

OSV-2020-2141 Use-of-uninitialized-value in WelsDec::WelsDeblockingMb

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27306 Crash type: Use-of-uninitialized-value Crash state: WelsDec::WelsDeblockingMb WelsDec::WelsDeblockingFilterSlice WelsDec::WelsTargetSliceConstruction...

OSV-2020-2117 Heap-buffer-overflow in flb_msgpack_gelf_value_ext

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26851 Crash type: Heap-buffer-overflow READ 1 Crash state: flbmsgpackgelfvalueext flbmsgpacktogelf flbmsgpackrawtogelf...

OSV-2020-2101 Heap-buffer-overflow in lduw_he_p

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26691 Crash type: Heap-buffer-overflow READ 2 Crash state: lduwhep ldnhep flatviewwritecontinue...

OSV-2020-2087 Heap-buffer-overflow in blosc_c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26442 Crash type: Heap-buffer-overflow WRITE 1 Crash state: bloscc dojob blosccompresscontext...

OSV-2020-2069 UNKNOWN READ in grk::SparseBuffer<6u, 6u>::read_or_write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26322 Crash type: UNKNOWN READ Crash state: grk::SparseBuffer::readorwrite grk::SparseBuffer::read bool grk::decodepartialtile...

OSV-2020-2068 Heap-buffer-overflow in WelsDec::Update8x8RefIdx

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26328 Crash type: Heap-buffer-overflow WRITE 1 Crash state: WelsDec::Update8x8RefIdx WelsDec::ParseInterBMotionInfoCabac WelsDec::WelsDecodeMbCabacBSliceBaseMode0...

OSV-2020-2004 Use-of-uninitialized-value in grk::t1_ht::T1HT::postDecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26206 Crash type: Use-of-uninitialized-value Crash state: grk::t1ht::T1HT::postDecode grk::T1Decoder::decompressBlock grk::T1Decoder::decompress...

OSV-2020-1995 Index-out-of-bounds in fp_read_radix_16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26163 Crash type: Index-out-of-bounds Crash state: fpreadradix16 fpreadradix mpreadradix...

OSV-2020-1990 Heap-buffer-overflow in sc_oberthur_parse_privateinfo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26116 Crash type: Heap-buffer-overflow READ 1 Crash state: scoberthurparseprivateinfo scpkcs15emuoberthurinit scpkcs15emuoberthurinitex...

OSV-2020-1928 UNKNOWN READ in net_field_length_size

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19830 Crash type: UNKNOWN READ Crash state: netfieldlengthsize netfieldlengthllsafe readokex...

OSV-2020-1869 Use-of-uninitialized-value in gs_scan_token

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21625 Crash type: Use-of-uninitialized-value Crash state: gsscantoken tokenexeccontinue interp...

OSV-2020-1827 Heap-buffer-overflow in http_process_user_agent

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25845 Crash type: Heap-buffer-overflow READ Crash state: httpprocessuseragent processchlo ndpisearchquic...

OSV-2020-1816 Heap-buffer-overflow in encoded_to_buf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25785 Crash type: Heap-buffer-overflow WRITE 1 Crash state: encodedtobuf flbutilswritestr msgpack2json...

OSV-2020-1687 Bad-cast to pcpp::Layer from invalid vptr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25340 Crash type: Bad-cast Crash state: Bad-cast to pcpp::Layer from invalid vptr pcpp::IDnsResource::getRawData pcpp::DnsResource::getDataLength...

OSV-2020-1682 Heap-buffer-overflow in void arrow::internal::TransferBitmap<

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25332 Crash type: Heap-buffer-overflow READ 8 Crash state: void arrow::internal::TransferBitmap arrow::ConcatenateBitmaps arrow::ConcatenateImpl::Concatenate...

OSV-2020-1659 Use-of-uninitialized-value in LibRaw::parse_sinar_ia

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25188 Crash type: Use-of-uninitialized-value Crash state: LibRaw::parsesinaria LibRaw::identify LibRaw::opendatastream...

OSV-2020-1623 Heap-use-after-free in xmlXIncludeIncludeNode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24925 Crash type: Heap-use-after-free READ 4 Crash state: xmlXIncludeIncludeNode xmlXIncludeDoProcess xmlXIncludeLoadFallback...

OSV-2020-1599 Use-of-uninitialized-value in slide_hash

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24820 Crash type: Use-of-uninitialized-value Crash state: slidehash fillwindow deflatefast...

OSV-2020-1538 Use-of-uninitialized-value in cmsMLUgetASCII

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19724 Crash type: Use-of-uninitialized-value Crash state: cmsMLUgetASCII cmsGetProfileInfoASCII GetICCProperty...

OSV-2020-1485 Segv on unknown address in clang::Sema::ActOnStartOfFunctionDef

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19623 Crash type: Segv on unknown address Crash state: clang::Sema::ActOnStartOfFunctionDef clang::Parser::ParseFunctionDefinition clang::Parser::ParseDeclGroup...

OSV-2020-1439 Segv on unknown address in LocaleCompare

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21163 Crash type: Segv on unknown address Crash state: LocaleCompare CompareSplayTreeString Splay...

OSV-2020-1432 Segv on unknown address in EvaluateObjectArgument

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19880 Crash type: Segv on unknown address Crash state: EvaluateObjectArgument ExprEvaluatorBase::handleCallExpr clang::StmtVisitorBase::Visit...