OSV-2021-159 UNKNOWN READ in htp_connp_RES_FINALIZE

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29551 Crash type: UNKNOWN READ Crash state: htpconnpRESFINALIZE htpconnpresdata fuzzhtp.c...

OSV-2018-209 Heap-buffer-overflow in loop

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5251 Crash type: Heap-buffer-overflow READ 1 Crash state: loop loop ftpplinsertfinfo...

OSV-2018-170 Heap-use-after-free in yr_re_ast_split_at_chaining_point

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11752 Crash type: Heap-use-after-free READ 4 Crash state: yrreastsplitatchainingpoint yrparserreducestringdeclaration yarayyparse...

OSV-2018-145 Heap-buffer-overflow in cras_rclient_message_from_client

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9242 Crash type: Heap-buffer-overflow READ 4 Crash state: crasrclientmessagefromclient crasrclientbufferfromclient rclientmessage.cc...

OSV-2018-136 Heap-buffer-overflow in fast_validate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10319 Crash type: Heap-buffer-overflow READ 1 Crash state: fastvalidate gutf8validate gvariantserialiserisstring...

OSV-2018-125 Heap-buffer-overflow in read_bits_16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11196 Crash type: Heap-buffer-overflow READ 1 Crash state: readbits16 decodenumber douncompressblock...

OSV-2018-90 Heap-buffer-overflow in wireguard_done

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11279 Crash type: Heap-buffer-overflow READ 8 Crash state: wireguarddone netdevfree netdevunref...

OSV-2018-41 Heap-buffer-overflow in Botan::bigint_monty_redc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6581 Crash type: Heap-buffer-overflow READ 8 Crash state: Botan::bigintmontyredc Botan::CurveGFpMontgomery::curvemul Botan::CurveGFpMontgomery::tocurverep...

OSV-2021-60 Heap-buffer-overflow in H5O__sdspace_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29517 Crash type: Heap-buffer-overflow READ 1 Crash state: H5Osdspacedecode H5Osdspaceshareddecode H5Oattrdecode...

OSV-2017-5 Heap-buffer-overflow in opj_dwt_interleave_partial_v

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3115 Crash type: Heap-buffer-overflow READ 4 Crash state: opjdwtinterleavepartialv opjdwtdecodepartialtile opjtcddwtdecode...

OSV-2021-32 Heap-use-after-free in igraph_vector_ptr_size

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29408 Crash type: Heap-use-after-free READ 8 Crash state: igraphvectorptrsize igraphgmltreedestroy igraphigmlparsedatadestroy...

OSV-2021-21 Segv on unknown address in frame_get_lazychunk

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29295 Crash type: Segv on unknown address Crash state: framegetlazychunk framedecompresschunk blosc2schunkdecompresschunk...

OSV-2021-10 Heap-buffer-overflow in sp_tohex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29185 Crash type: Heap-buffer-overflow WRITE 1 Crash state: sptohex sptoradix cryptofuzz::module::wolfCryptbignum::Bignum::baseConversion...

OSV-2020-2250 Heap-buffer-overflow in grk::t1_part1::T1Part1::decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28415 Crash type: Heap-buffer-overflow READ 12 Crash state: grk::t1part1::T1Part1::decompress grk::DecompressBlockExec::open grk::T1DecompressScheduler::decompressBlock...

OSV-2020-2246 Heap-use-after-free in check_connection

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28254 Crash type: Heap-use-after-free READ 6 Crash state: checkconnection fuzzcheckconnection httpfuzzer.c...

OSV-2020-2228 Heap-buffer-overflow in grk::t1_part1::T1Part1::decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28227 Crash type: Heap-buffer-overflow READ Crash state: grk::t1part1::T1Part1::decompress grk::DecompressBlockExec::open grk::T1DecompressScheduler::decompressBlock...

OSV-2020-2216 Heap-buffer-overflow in ojph::local::ojph_decode_codeblock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28103 Crash type: Heap-buffer-overflow WRITE 4 Crash state: ojph::local::ojphdecodecodeblock grk::t1ht::T1HT::decompress grk::DecompressBlockExec::open...

OSV-2020-2201 Heap-buffer-overflow in String::append

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27912 Crash type: Heap-buffer-overflow READ 3 Crash state: String::append appendidentifier Itemfuncgetuservar::print...

OSV-2020-2167 Heap-buffer-overflow in ojph::local::ojph_decode_codeblock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27533 Crash type: Heap-buffer-overflow WRITE 4 Crash state: ojph::local::ojphdecodecodeblock grk::t1ht::T1HT::decompress grk::DecompressBlockExec::open...

OSV-2020-2166 Heap-buffer-overflow in get_32aligned_be64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27524 Crash type: Heap-buffer-overflow READ 4 Crash state: get32alignedbe64 nlattrgetbe64 formatodptunattr...

OSV-2020-2080 Heap-buffer-overflow in coap_opt_length

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26371 Crash type: Heap-buffer-overflow READ 1 Crash state: coapoptlength coappduparseopt coappduparse...

OSV-2020-2077 UNKNOWN READ in WelsCommon::WelsFree

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26347 Crash type: UNKNOWN READ Crash state: WelsCommon::WelsFree WelsCommon::CMemoryAlign::WelsFree WelsDec::FreePicture...

OSV-2020-2056 Heap-use-after-free in destroy_op_array

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24567 Crash type: Heap-use-after-free READ 4 Crash state: destroyoparray fuzzerdorequest fuzzerdorequestfrombuffer...

OSV-2020-2024 Heap-buffer-overflow in pixFindHorizontalRuns

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26268 Crash type: Heap-buffer-overflow WRITE 4 Crash state: pixFindHorizontalRuns pixFillPolygon graphicsfuzzer.cc...

OSV-2020-2005 UNKNOWN READ in grk::param_qcd::set_irrev_quant

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26207 Crash type: UNKNOWN READ Crash state: grk::paramqcd::setirrevquant grk::j2kreadSPCodSPCoc grk::j2kreadcod...

OSV-2020-1991 Use-of-uninitialized-value in RenderMVGContent

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26148 Crash type: Use-of-uninitialized-value Crash state: RenderMVGContent DrawImage ReadMVGImage...

OSV-2020-1946 Heap-buffer-overflow in x509_parse_ext_basic_constraints

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15451 Crash type: Heap-buffer-overflow READ 1 Crash state: x509parseextbasicconstraints x509parseextension x509parseextensions...

OSV-2020-1834 Stack-buffer-overflow in onigenc_unicode_get_case_fold_codes_by_str

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25893 Crash type: Stack-buffer-overflow WRITE 4 Crash state: onigencunicodegetcasefoldcodesbystr utf16begetcasefoldcodesbystr unravelcasefoldstring...

OSV-2020-1833 Heap-buffer-overflow in avifROStreamRead

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25903 Crash type: Heap-buffer-overflow READ 4 Crash state: avifROStreamRead avifROStreamReadU32 avifROStreamReadBoxHeader...

OSV-2020-1830 Heap-use-after-free in grk::TileProcessor::~TileProcessor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25873 Crash type: Heap-use-after-free READ 8 Crash state: grk::TileProcessor::TileProcessor grk::CodeStream::decompresstiles grk::CodeStream::dodecompress...

OSV-2020-1816 Heap-buffer-overflow in encoded_to_buf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25785 Crash type: Heap-buffer-overflow WRITE 1 Crash state: encodedtobuf flbutilswritestr msgpack2json...

OSV-2020-1762 Heap-use-after-free in gc_mark_grey

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23350 Crash type: Heap-use-after-free READ 4 Crash state: gcmarkgrey gcmarkroots zendgccollectcycles...

OSV-2020-1702 Heap-buffer-overflow in mem_src_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25388 Crash type: Heap-buffer-overflow READ Crash state: memsrcread srcpeek srceof...

OSV-2020-1558 Stack-buffer-overflow in dst_print_s2k

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24538 Crash type: Stack-buffer-overflow READ 1 Crash state: dstprints2k streamdumppacketsraw streamdumppackets...

OSV-2020-1527 Use-of-uninitialized-value in ConstantString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21159 Crash type: Use-of-uninitialized-value Crash state: ConstantString SetImageProperty TIFFGetProperties...

OSV-2020-1523 UNKNOWN READ in Mat_H5ReadFieldNames

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23456 Crash type: UNKNOWN READ Crash state: MatH5ReadFieldNames MatH5ReadGroupInfo MatVarReadNextInfoIterate...

OSV-2020-1506 Invalid-free in llvm_ks::SmallVectorImpl<llvm_ks::MCFixup>::~SmallVectorImpl

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22371 Crash type: Invalid-free Crash state: llvmks::SmallVectorImpl::SmallVectorImpl llvmks::MCEncodedFragmentWithFixups::MCEncodedFragmentWithFixups llvmks::MCFragment::destroy...

OSV-2020-1498 Segv on unknown address in llvm::llvm_unreachable_internal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21075 Crash type: Segv on unknown address Crash state: llvm::llvmunreachableinternal clang::Sema::CheckAbsoluteValueFunction clang::Sema::CheckFunctionCall...

OSV-2020-1493 Heap-buffer-overflow in yr_object_set_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6402 Crash type: Heap-buffer-overflow READ 7 Crash state: yrobjectsetstring dexparse dexload...

OSV-2020-1479 Segv on unknown address in clang::Preprocessor::AnnotatePreviousCachedTokens

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19064 Crash type: Segv on unknown address Crash state: clang::Preprocessor::AnnotatePreviousCachedTokens clang::Parser::TryAnnotateTypeOrScopeTokenAfterScopeSpec clang::Parser::TryAnnotateTypeOrScopeToken...

OSV-2020-1478 Heap-buffer-overflow in load_jpeg_image

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23153 Crash type: Heap-buffer-overflow READ 1 Crash state: loadjpegimage stbijpegload stbiloadmain...

OSV-2020-1476 Heap-buffer-overflow in read_uleb128

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6402 Crash type: Heap-buffer-overflow READ 1 Crash state: readuleb128 dexparse dexload...

OSV-2020-1465 Segv on unknown address in clang::Parser::parseObjCTypeArgsAndProtocolQualifiers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23785 Crash type: Segv on unknown address Crash state: clang::Parser::parseObjCTypeArgsAndProtocolQualifiers clang::Parser::parseObjCTypeArgsAndProtocolQualifiers clang::Parser::TryAnnotateTypeOrScopeTokenAfterScopeSpec...

OSV-2020-1455 Segv on unknown address in clang::Parser::ParseObjCInterfaceDeclList

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19088 Crash type: Segv on unknown address Crash state: clang::Parser::ParseObjCInterfaceDeclList clang::Parser::ParseObjCAtInterfaceDeclaration clang::Parser::ParseObjCAtDirectives...

OSV-2020-1441 Heap-buffer-overflow in void apply_sao_internal<unsigned short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21935 Crash type: Heap-buffer-overflow READ 1 Crash state: void applysaointernal void applysao threadtasksao::work...

OSV-2020-1442 Segv on unknown address in clang::CXXRecordDecl::data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19228 Crash type: Segv on unknown address Crash state: clang::CXXRecordDecl::data getDefaultInitValue EvaluateVarDecl...

OSV-2020-1438 Use-of-uninitialized-value in PerceptibleReciprocal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21803 Crash type: Use-of-uninitialized-value Crash state: PerceptibleReciprocal CompositeImage MergeImageLayers...

OSV-2020-1426 Segv on unknown address in clang::CXXRecordDecl::data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19132 Crash type: Segv on unknown address Crash state: clang::CXXRecordDecl::data clang::Sema::FinalizeVarWithDestructor clang::Sema::ActOnBlockStmtExpr...

OSV-2020-1401 Use-of-uninitialized-value in LibRaw::parse_makernote_ADDRESS

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16377 Crash type: Use-of-uninitialized-value Crash state: LibRaw::parsemakernoteADDRESS LibRaw::parsemakernoteADDRESS LibRaw::parsetiffifd...

OSV-2020-1399 Segv on unknown address in clang::StmtVisitorBase<llvm::make_const_ptr, RecordExprEvaluator, bool>::Visit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19152 Crash type: Segv on unknown address Crash state: clang::StmtVisitorBase::Visit clang::StmtVisitorBase::Visit EvaluateInPlace...