OSV-2018-170 Heap-use-after-free in yr_re_ast_split_at_chaining_point

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11752 Crash type: Heap-use-after-free READ 4 Crash state: yrreastsplitatchainingpoint yrparserreducestringdeclaration yarayyparse...

OSV-2018-41 Heap-buffer-overflow in Botan::bigint_monty_redc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6581 Crash type: Heap-buffer-overflow READ 8 Crash state: Botan::bigintmontyredc Botan::CurveGFpMontgomery::curvemul Botan::CurveGFpMontgomery::tocurverep...

OSV-2020-2250 Heap-buffer-overflow in grk::t1_part1::T1Part1::decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28415 Crash type: Heap-buffer-overflow READ 12 Crash state: grk::t1part1::T1Part1::decompress grk::DecompressBlockExec::open grk::T1DecompressScheduler::decompressBlock...

OSV-2020-2228 Heap-buffer-overflow in grk::t1_part1::T1Part1::decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28227 Crash type: Heap-buffer-overflow READ Crash state: grk::t1part1::T1Part1::decompress grk::DecompressBlockExec::open grk::T1DecompressScheduler::decompressBlock...

OSV-2020-2201 Heap-buffer-overflow in String::append

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27912 Crash type: Heap-buffer-overflow READ 3 Crash state: String::append appendidentifier Itemfuncgetuservar::print...

OSV-2020-2167 Heap-buffer-overflow in ojph::local::ojph_decode_codeblock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27533 Crash type: Heap-buffer-overflow WRITE 4 Crash state: ojph::local::ojphdecodecodeblock grk::t1ht::T1HT::decompress grk::DecompressBlockExec::open...

OSV-2020-2166 Heap-buffer-overflow in get_32aligned_be64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27524 Crash type: Heap-buffer-overflow READ 4 Crash state: get32alignedbe64 nlattrgetbe64 formatodptunattr...

OSV-2020-2080 Heap-buffer-overflow in coap_opt_length

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26371 Crash type: Heap-buffer-overflow READ 1 Crash state: coapoptlength coappduparseopt coappduparse...

OSV-2020-2005 UNKNOWN READ in grk::param_qcd::set_irrev_quant

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26207 Crash type: UNKNOWN READ Crash state: grk::paramqcd::setirrevquant grk::j2kreadSPCodSPCoc grk::j2kreadcod...

OSV-2020-1991 Use-of-uninitialized-value in RenderMVGContent

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26148 Crash type: Use-of-uninitialized-value Crash state: RenderMVGContent DrawImage ReadMVGImage...

OSV-2020-1834 Stack-buffer-overflow in onigenc_unicode_get_case_fold_codes_by_str

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25893 Crash type: Stack-buffer-overflow WRITE 4 Crash state: onigencunicodegetcasefoldcodesbystr utf16begetcasefoldcodesbystr unravelcasefoldstring...

OSV-2020-1833 Heap-buffer-overflow in avifROStreamRead

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25903 Crash type: Heap-buffer-overflow READ 4 Crash state: avifROStreamRead avifROStreamReadU32 avifROStreamReadBoxHeader...

OSV-2020-1816 Heap-buffer-overflow in encoded_to_buf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25785 Crash type: Heap-buffer-overflow WRITE 1 Crash state: encodedtobuf flbutilswritestr msgpack2json...

OSV-2020-1762 Heap-use-after-free in gc_mark_grey

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23350 Crash type: Heap-use-after-free READ 4 Crash state: gcmarkgrey gcmarkroots zendgccollectcycles...

OSV-2020-1702 Heap-buffer-overflow in mem_src_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25388 Crash type: Heap-buffer-overflow READ Crash state: memsrcread srcpeek srceof...

OSV-2020-1558 Stack-buffer-overflow in dst_print_s2k

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24538 Crash type: Stack-buffer-overflow READ 1 Crash state: dstprints2k streamdumppacketsraw streamdumppackets...

OSV-2020-1527 Use-of-uninitialized-value in ConstantString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21159 Crash type: Use-of-uninitialized-value Crash state: ConstantString SetImageProperty TIFFGetProperties...

OSV-2020-1523 UNKNOWN READ in Mat_H5ReadFieldNames

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23456 Crash type: UNKNOWN READ Crash state: MatH5ReadFieldNames MatH5ReadGroupInfo MatVarReadNextInfoIterate...

OSV-2020-1506 Invalid-free in llvm_ks::SmallVectorImpl<llvm_ks::MCFixup>::~SmallVectorImpl

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22371 Crash type: Invalid-free Crash state: llvmks::SmallVectorImpl::SmallVectorImpl llvmks::MCEncodedFragmentWithFixups::MCEncodedFragmentWithFixups llvmks::MCFragment::destroy...

OSV-2020-1493 Heap-buffer-overflow in yr_object_set_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6402 Crash type: Heap-buffer-overflow READ 7 Crash state: yrobjectsetstring dexparse dexload...

OSV-2020-1478 Heap-buffer-overflow in load_jpeg_image

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23153 Crash type: Heap-buffer-overflow READ 1 Crash state: loadjpegimage stbijpegload stbiloadmain...

OSV-2020-1476 Heap-buffer-overflow in read_uleb128

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6402 Crash type: Heap-buffer-overflow READ 1 Crash state: readuleb128 dexparse dexload...

OSV-2020-1474 Heap-buffer-overflow in dotnet_parse_com

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8901 Crash type: Heap-buffer-overflow READ 8 Crash state: dotnetparsecom dotnetload yrmodulesload...

OSV-2020-1441 Heap-buffer-overflow in void apply_sao_internal<unsigned short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21935 Crash type: Heap-buffer-overflow READ 1 Crash state: void applysaointernal void applysao threadtasksao::work...

OSV-2020-1442 Segv on unknown address in clang::CXXRecordDecl::data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19228 Crash type: Segv on unknown address Crash state: clang::CXXRecordDecl::data getDefaultInitValue EvaluateVarDecl...

OSV-2020-1438 Use-of-uninitialized-value in PerceptibleReciprocal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21803 Crash type: Use-of-uninitialized-value Crash state: PerceptibleReciprocal CompositeImage MergeImageLayers...

OSV-2020-1426 Segv on unknown address in clang::CXXRecordDecl::data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19132 Crash type: Segv on unknown address Crash state: clang::CXXRecordDecl::data clang::Sema::FinalizeVarWithDestructor clang::Sema::ActOnBlockStmtExpr...

OSV-2020-1430 Segv on unknown address in clang::Parser::ParseCXXAmbiguousParenExpression

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19617 Crash type: Segv on unknown address Crash state: clang::Parser::ParseCXXAmbiguousParenExpression clang::Parser::ParseParenExpression clang::Parser::ParseCastExpression...

OSV-2020-1401 Use-of-uninitialized-value in LibRaw::parse_makernote_ADDRESS

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16377 Crash type: Use-of-uninitialized-value Crash state: LibRaw::parsemakernoteADDRESS LibRaw::parsemakernoteADDRESS LibRaw::parsetiffifd...

OSV-2020-1399 Segv on unknown address in clang::StmtVisitorBase<llvm::make_const_ptr, RecordExprEvaluator, bool>::Visit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19152 Crash type: Segv on unknown address Crash state: clang::StmtVisitorBase::Visit clang::StmtVisitorBase::Visit EvaluateInPlace...

OSV-2020-1351 Heap-use-after-free in sc_pkcs15_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17170 Crash type: Heap-use-after-free READ 4 Crash state: scpkcs15freeobject fuzzpkcs15decode.c fuzzpkcs15decode.c...

OSV-2020-1288 Heap-buffer-overflow in asn1_decode_entry

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16620 Crash type: Heap-buffer-overflow READ 1 Crash state: asn1decodeentry asn1decode asn1decodeentry...

OSV-2020-1242 Heap-buffer-overflow in ih264d_cavlc_parse4x4coeff_n8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16587 Crash type: Heap-buffer-overflow READ 4 Crash state: ih264dcavlcparse4x4coeffn8 ih264dcavlcparse8x8blockbothavailable ih264dparseresidual4x4cavlc...

OSV-2020-1210 UNKNOWN READ in xmlXPathCompileExpr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16288 Crash type: UNKNOWN READ Crash state: xmlXPathCompileExpr xmlXPathCompPrimaryExpr xmlXPathCompFilterExpr...

OSV-2020-1131 Heap-buffer-overflow in ndpi_search_oscar_tcp_connect

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21000 Crash type: Heap-buffer-overflow READ 4 Crash state: ndpisearchoscartcpconnect checkndpitcpflowfunc ndpidetectionprocesspacket...

OSV-2020-1015 Heap-buffer-overflow in ndpi_search_memcached

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19324 Crash type: Heap-buffer-overflow READ 13 Crash state: ndpisearchmemcached checkndpiudpflowfunc ndpidetectionprocesspacket...

OSV-2020-969 Stack-buffer-overflow in pgp_parse_algo_attr_blob

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19548 Crash type: Stack-buffer-overflow WRITE 4 Crash state: pgpparsealgoattrblob pgpgetcardfeatures pgpinit...

OSV-2020-940 Heap-use-after-free in surround51_to_stereo_downmix_mtx

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21113 Crash type: Heap-use-after-free WRITE 4 Crash state: surround51tostereodownmixmtx crasfmtconvcreate configformatconverter...

OSV-2020-906 Heap-buffer-overflow in rasteropGeneralLow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24076 Crash type: Heap-buffer-overflow READ 4 Crash state: rasteropGeneralLow rasteropLow pixRasterop...

OSV-2020-907 Heap-buffer-overflow in rasteropGeneralLow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22512 Crash type: Heap-buffer-overflow READ 4 Crash state: rasteropGeneralLow rasteropLow pixRasterop...

OSV-2020-901 UNKNOWN WRITE in sarrayAddString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23379 Crash type: UNKNOWN WRITE Crash state: sarrayAddString gplotAddPlot numaQuantizeCrossingsByWidth...

OSV-2020-894 Heap-buffer-overflow in rasteropGeneralLow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23761 Crash type: Heap-buffer-overflow READ 4 Crash state: rasteropGeneralLow rasteropLow pixRasterop...

OSV-2020-891 Heap-buffer-overflow in ccr_handle_message_from_client

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23965 Crash type: Heap-buffer-overflow READ 4 Crash state: ccrhandlemessagefromclient crasrclientbufferfromclient rclientmessage.cc...

OSV-2020-790 Use-of-uninitialized-value in clang::tok::isAnnotation

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18444 Crash type: Use-of-uninitialized-value Crash state: clang::tok::isAnnotation clang::TokenLexer::Lex clang::Preprocessor::Lex...

OSV-2020-758 Heap-buffer-overflow in void arrow::internal::TransferBitmap<

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23868 Crash type: Heap-buffer-overflow READ 8 Crash state: void arrow::internal::TransferBitmap arrow::ConcatenateBitmaps arrow::ConcatenateImpl::Concatenate...

OSV-2020-718 UNKNOWN READ in double_from_wkb_state

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18153 Crash type: UNKNOWN READ Crash state: doublefromwkbstate ptarrayfromwkbstate lwlinefromwkbstate...

OSV-2020-691 UNKNOWN WRITE in ZSTD_decodeLiteralsBlock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16541 Crash type: UNKNOWN WRITE Crash state: ZSTDdecodeLiteralsBlock ZSTDdecompressBlock ZSTDdecompressDCtx...

OSV-2020-680 Bad-free in sc_pkcs15_decode_prkdf_entry

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18482 Crash type: Bad-free Crash state: scpkcs15decodeprkdfentry fuzzpkcs15decode.c...

OSV-2020-682 Heap-use-after-free in condition_free_list_type

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13878 Crash type: Heap-use-after-free READ 8 Crash state: conditionfreelisttype linkconfigfree linkloadone...

OSV-2020-584 Heap-buffer-overflow in collator_compare_fuzzer.cpp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15499 Crash type: Heap-buffer-overflow WRITE 3 Crash state: collatorcomparefuzzer.cpp...