OSV-2021-764 Stack-buffer-overflow in TranslateNumber_1

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34285 Crash type: Stack-buffer-overflow READ 1 Crash state: TranslateNumber1 TranslateNumber TranslateWord3...

OSV-2021-745 Heap-buffer-overflow in skip_to_next_entry

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34110 Crash type: Heap-buffer-overflow READ 1 Crash state: skiptonextentry getexceptionhandler PyEvalEvalFrameDefault...

OSV-2021-725 UNKNOWN READ in libfsext_directory_entry_read_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33935 Crash type: UNKNOWN READ Crash state: libfsextdirectoryentryreaddata libfsextdirectoryreadinlinedata libfsextdirectoryreadfileiohandle...

OSV-2021-709 Index-out-of-bounds in tsk_img_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33805 Crash type: Index-out-of-bounds Crash state: tskimgread APFSPool::read APFSBlock::APFSBlock...

OSV-2021-669 Heap-buffer-overflow in _estrdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33495 Crash type: Heap-buffer-overflow READ Crash state: estrdup exifprocessusercomment exifprocessIFDTAGimpl...

OSV-2021-670 Heap-buffer-overflow in av1_free_cdef_buffers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33480 Crash type: Heap-buffer-overflow READ 8 Crash state: av1freecdefbuffers decoderdestroy aomcodecdestroy...

OSV-2021-651 Heap-use-after-free in zend_gc_delref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33335 Crash type: Heap-use-after-free READ 4 Crash state: zendgcdelref zvaldelrefp zvalptrdtornogc...

OSV-2021-624 Heap-buffer-overflow in load_u32_be

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33039 Crash type: Heap-buffer-overflow READ 1 Crash state: loadu32be osslsm4setkey cipherhwsm4initkey...

OSV-2021-623 Null-dereference READ

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33052 Crash type: Null-dereference READ Crash state: NULL...

OSV-2021-578 Stack-use-after-return in v9fs_string_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32624 Crash type: Stack-use-after-return READ 8 Crash state: v9fsstringfree v9fsxattrwalk coroutinetrampoline...

OSV-2021-540 Heap-buffer-overflow in g_array_append_vals

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32249 Crash type: Heap-buffer-overflow READ Crash state: garrayappendvals gbytearrayappend fuefifirmwarevolumewrite...

OSV-2021-535 Heap-buffer-overflow in encode_3dsolid

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32165 Crash type: Heap-buffer-overflow READ 4 Crash state: encode3dsolid dwgencodeBODYprivate dwgencodeBODY...

OSV-2021-455 Heap-use-after-free in zend_hash_iterator_pos_ex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31423 Crash type: Heap-use-after-free READ 1 Crash state: zendhashiteratorposex ZENDFEFETCHRWSPECVARHANDLER fuzzerexecuteex...

OSV-2021-437 Heap-use-after-free in ofats::any_detail::handler_traits<void>::handler_base<ofats::any_detail::handler

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31209 Crash type: Heap-use-after-free WRITE 8 Crash state: ofats::anydetail::handlertraits::handlerbaseofats::anydetail::handler uWS::Loop::wakeupCb usinternaldispatchreadypoll...

OSV-2021-427 Heap-buffer-overflow in LibRaw::kodak_c330_load_raw

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31181 Crash type: Heap-buffer-overflow READ 1 Crash state: LibRaw::kodakc330loadraw LibRaw::unpack librawfuzzer.cc...

OSV-2021-423 Heap-buffer-overflow in dissect_vjc_uncomp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31121 Crash type: Heap-buffer-overflow READ 1 Crash state: dissectvjcuncomp calldissectorwork dissectortryuint...

OSV-2021-380 Heap-buffer-overflow in ih264d_fill_bs1_16x16mb_pslice

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30801 Crash type: Heap-buffer-overflow READ 8 Crash state: ih264dfillbs116x16mbpslice ih264dcomputebsnonmbaffthread ih264drecondeblkslice...

OSV-2021-345 UNKNOWN READ in cpu_arm_exec_arm

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30636 Crash type: UNKNOWN READ Crash state: cpuarmexecarm tcgcpuexecarm tcgexecallarm...

OSV-2021-257 Stack-buffer-overflow in kdf_sshkdf_set_ctx_params

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30037 Crash type: Stack-buffer-overflow READ 1 Crash state: kdfsshkdfsetctxparams EVPKDFCTXsetparams cryptofuzz::module::OpenSSL::OpKDFSSH...

OSV-2021-218 Heap-buffer-overflow in H5F_addr_decode_len

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29776 Crash type: Heap-buffer-overflow READ 1 Crash state: H5Faddrdecodelen H5Faddrdecode H5Gentdecode...

OSV-2021-213 Heap-use-after-free in ZSTD_freeDDict

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29705 Crash type: Heap-use-after-free READ Crash state: ZSTDfreeDDict blosc2freectx blosc2schunkfree...

OSV-2018-279 Use-of-uninitialized-value in fz_drop_hash_table

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5609 Crash type: Use-of-uninitialized-value Crash state: fzdrophashtable fzfincachedcolorconverter fzpaintshade...

OSV-2017-53 Stack-buffer-overflow in _psl_idna_toASCII

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2600 Crash type: Stack-buffer-overflow READ Crash state: pslidnatoASCII addpunycodeifneeded pslloadfp...

OSV-2017-29 Heap-use-after-free in UInt32_encodeBinary

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4764 Crash type: Heap-use-after-free WRITE 4 Crash state: UInt32encodeBinary UAencodeBinaryInternal UAencodeBinary...

OSV-2017-24 Heap-buffer-overflow in pnm_type_find

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4039 Crash type: Heap-buffer-overflow READ 1 Crash state: pnmtypefind gsttypefindfactorycallfunction gsttypefindhelperfordata...

OSV-2018-198 Heap-buffer-overflow in r_read_le32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11308 Crash type: Heap-buffer-overflow READ 1 Crash state: rreadle32 rreadle64 rbinfilegetstrings...

OSV-2018-158 Heap-buffer-overflow in ofpbuf_insert

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11253 Crash type: Heap-buffer-overflow WRITE Crash state: ofpbufinsert nxputraw nxputmatch...

OSV-2018-152 Heap-buffer-overflow in dhcp6_option_parse_status

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10746 Crash type: Heap-buffer-overflow READ 2 Crash state: dhcp6optionparsestatus dhcp6optionparsepdprefix dhcp6optionparseia...

OSV-2020-2251 Heap-buffer-overflow in blosc_run_decompression_with_context

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28392 Crash type: Heap-buffer-overflow READ 1 Crash state: bloscrundecompressionwithcontext blosc2decompressctx framedecompresschunk...

OSV-2020-2227 Heap-buffer-overflow in ieeeNUMBER_fragment_hash

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28191 Crash type: Heap-buffer-overflow READ 6 Crash state: ieeeNUMBERfragmenthash ghashtableinsertinternal fragmentaddseqcommon...

OSV-2020-2205 Heap-buffer-overflow in ojph::local::ojph_decode_codeblock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27924 Crash type: Heap-buffer-overflow WRITE 4 Crash state: ojph::local::ojphdecodecodeblock grk::t1ht::T1HT::decompress grk::DecompressBlockExec::open...

OSV-2020-2154 Heap-buffer-overflow in void arrow::internal::TransferBitmap<

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27474 Crash type: Heap-buffer-overflow READ 8 Crash state: void arrow::internal::TransferBitmap arrow::ConcatenateBitmaps arrow::ConcatenateImpl::Concatenate...

OSV-2020-2141 Use-of-uninitialized-value in WelsDec::WelsDeblockingMb

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27306 Crash type: Use-of-uninitialized-value Crash state: WelsDec::WelsDeblockingMb WelsDec::WelsDeblockingFilterSlice WelsDec::WelsTargetSliceConstruction...

OSV-2020-2117 Heap-buffer-overflow in flb_msgpack_gelf_value_ext

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26851 Crash type: Heap-buffer-overflow READ 1 Crash state: flbmsgpackgelfvalueext flbmsgpacktogelf flbmsgpackrawtogelf...

OSV-2020-2004 Use-of-uninitialized-value in grk::t1_ht::T1HT::postDecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26206 Crash type: Use-of-uninitialized-value Crash state: grk::t1ht::T1HT::postDecode grk::T1Decoder::decompressBlock grk::T1Decoder::decompress...

OSV-2020-1990 Heap-buffer-overflow in sc_oberthur_parse_privateinfo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26116 Crash type: Heap-buffer-overflow READ 1 Crash state: scoberthurparseprivateinfo scpkcs15emuoberthurinit scpkcs15emuoberthurinitex...

OSV-2020-1877 Use-of-uninitialized-value in FAPI_FF_get_glyph

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23115 Crash type: Use-of-uninitialized-value Crash state: FAPIFFgetglyph getfapiglyphdata loadtruetypeglyph...

OSV-2020-1869 Use-of-uninitialized-value in gs_scan_token

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21625 Crash type: Use-of-uninitialized-value Crash state: gsscantoken tokenexeccontinue interp...

OSV-2020-1818 Use-of-uninitialized-value in grk::TileProcessor::prepare_sod_decoding

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25798 Crash type: Use-of-uninitialized-value Crash state: grk::TileProcessor::preparesoddecoding grk::CodeStream::parsemarkers grk::CodeStream::decompresstiles...

OSV-2020-1782 Heap-buffer-overflow in cli_codepage_to_utf8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23499 Crash type: Heap-buffer-overflow READ Crash state: clicodepagetoutf8 clivbareaddirnew clivbascandirnew...

OSV-2020-1752 Heap-buffer-overflow in void mc_chroma<unsigned short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25620 Crash type: Heap-buffer-overflow READ 2 Crash state: void mcchroma generateinterpredictionsamples decodepredictionunit...

OSV-2020-1682 Heap-buffer-overflow in void arrow::internal::TransferBitmap<

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25332 Crash type: Heap-buffer-overflow READ 8 Crash state: void arrow::internal::TransferBitmap arrow::ConcatenateBitmaps arrow::ConcatenateImpl::Concatenate...

OSV-2020-1659 Use-of-uninitialized-value in LibRaw::parse_sinar_ia

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25188 Crash type: Use-of-uninitialized-value Crash state: LibRaw::parsesinaria LibRaw::identify LibRaw::opendatastream...

OSV-2020-1647 UNKNOWN READ in aiTexture::~aiTexture

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25108 Crash type: UNKNOWN READ Crash state: aiTexture::aiTexture Assimp::MDLImporter::SkipSkinLump3DGSMDL7 Assimp::HMPImporter::ReadFirstSkin...

OSV-2020-1611 Heap-buffer-overflow in yaml_emitter_emit_flow_mapping_key

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24869 Crash type: Heap-buffer-overflow READ 4 Crash state: yamlemitteremitflowmappingkey yamlemitterstatemachine yamlemitteremit...

OSV-2020-1534 Use-of-uninitialized-value in void transform_idct_add<unsigned short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23918 Crash type: Use-of-uninitialized-value Crash state: void transformidctadd transform8x8add16fallback void accelerationfunctions::transformadd...

OSV-2020-1466 Segv on unknown address in clang::Sema::PushDeclContext

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19062 Crash type: Segv on unknown address Crash state: clang::Sema::PushDeclContext clang::Sema::ActOnStartOfObjCMethodDef clang::Parser::ParseLexedObjCMethodDefs...

OSV-2020-1461 Heap-buffer-overflow in yr_object_set_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6402 Crash type: Heap-buffer-overflow READ 6 Crash state: yrobjectsetstring dexparse dexload...

OSV-2020-1457 Segv on unknown address in llvm::APInt::udiv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19180 Crash type: Segv on unknown address Crash state: llvm::APInt::udiv ComplexExprEvaluator::VisitBinaryOperator clang::StmtVisitorBase::Visit...

OSV-2020-1452 Heap-buffer-overflow in yr_object_set_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6402 Crash type: Heap-buffer-overflow READ 12 Crash state: yrobjectsetstring dexparse dexload...