OSV-2024-1205 Memcpy-param-overlap in repeat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=372515088 Crash type: Memcpy-param-overlap Crash state: repeat repeat pere...

OSV-2024-1203 Global-buffer-overflow in AnnouncePunctuation

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=372298920 Crash type: Global-buffer-overflow WRITE Crash state: AnnouncePunctuation ReadClause TranslateClause...

OSV-2024-1201 Heap-buffer-overflow in polygonToCellsExperimental

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=372515086 Crash type: Heap-buffer-overflow WRITE 8 Crash state: polygonToCellsExperimental fuzzerPolygonToCellsExperimental.c...

OSV-2024-1200 UNKNOWN READ in eat_line

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=372515100 Crash type: UNKNOWN READ Crash state: eatline extractfield parsesdpsession...

OSV-2024-1199 Security exception in java.base/java.lang.Short.valueOf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=372547195 Crash type: Security exception Crash state: java.base/java.lang.Short.valueOf org.apache.poi.ddf.EscherRecordTypes.forTypeID org.apache.poi.ddf.DefaultEscherRecordFactory.getConstructor...

OSV-2024-1194 Heap-buffer-overflow in llvm::DataLayout::getIndexedOffsetInType

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=372093894 Crash type: Heap-buffer-overflow READ 4 Crash state: llvm::DataLayout::getIndexedOffsetInType InterpreterStackFrame::ResolveConstantValue InterpreterStackFrame::ResolveConstant...

OSV-2024-1191 Security exception in org.apache.lucene.analysis.miscellaneous.ASCIIFoldingFilter.foldToASCII

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=371931330 Crash type: Security exception Crash state: org.apache.lucene.analysis.miscellaneous.ASCIIFoldingFilter.foldToASCII org.apache.lucene.analysis.miscellaneous.ASCIIFoldingFilter.foldToASCII...

OSV-2024-1186 UNKNOWN READ in cfl_sds_len

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=371659893 Crash type: UNKNOWN READ Crash state: cflsdslen unpackmetaopts cmtmpackunpackmap...

OSV-2024-1182 Security exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=371233025 Crash type: Security exception Crash state: com.ctc.wstx.dtd.FullDTDReader.readContentSpec com.ctc.wstx.dtd.FullDTDReader.skipDtdWs com.ctc.wstx.dtd.FullDTDReader.readContentSpec...

OSV-2024-1181 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=371233781 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr java.base/java.lang.Exception. java.base/java.lang.RuntimeException...

OSV-2024-1179 UNKNOWN READ in __dynamic_cast

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=371239171 Crash type: UNKNOWN READ Crash state: dynamiccast HandleDynamicTypeCacheMiss CallbackToLogRedirector...

OSV-2024-1175 Use-of-uninitialized-value in mark_context

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=370775021 Crash type: Use-of-uninitialized-value Crash state: markcontext incrementalgc mrbincrementalgc...

OSV-2024-1164 Use-of-uninitialized-value in format_message

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=369652826 Crash type: Use-of-uninitialized-value Crash state: formatmessage ultrahdr::JpegEncoderHelper::encode ultrahdr::JpegEncoderHelper::compressImage...

OSV-2024-1161 Security exception in java.base/java.util.Arrays.copyOfRange

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=370272563 Crash type: Security exception Crash state: java.base/java.util.Arrays.copyOfRange java.base/java.lang.StringUTF16.newString java.base/java.lang.String.substring...

OSV-2024-1159 Use-of-uninitialized-value in decompress_yuv.cc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=369974248 Crash type: Use-of-uninitialized-value Crash state: decompressyuv.cc...

OSV-2024-1158 Use-of-uninitialized-value in format_message

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=370032374 Crash type: Use-of-uninitialized-value Crash state: formatmessage ultrahdr::JpegDecoderHelper::decode ultrahdr::JpegDecoderHelper::decompressImage...

OSV-2024-1154 Security exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=369974237 Crash type: Security exception Crash state: com.ctc.wstx.dtd.FullDTDReader.readContentSpec java.base/java.lang.ClassLoader.defineClass0 java.base/java.lang.System$2.defineClass...

OSV-2024-1150 Heap-buffer-overflow in extract_mr_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=369236552 Crash type: Heap-buffer-overflow READ Crash state: extractmrdata parsemrstring readstatparsesav...

OSV-2024-1149 Use-of-uninitialized-value in ultrahdr::uhdr_gainmap_metadata_frac::encodeGainmapMetadata

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=369652657 Crash type: Use-of-uninitialized-value Crash state: ultrahdr::uhdrgainmapmetadatafrac::encodeGainmapMetadata ultrahdr::JpegR::appendGainMap ultrahdr::JpegR::encodeJPEGR...

OSV-2024-1145 Heap-buffer-overflow in ultrahdr::getYuv444Pixel

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538160 Crash type: Heap-buffer-overflow READ 1 Crash state: ultrahdr::getYuv444Pixel std::1::function::funcultrahdr::JpegR::applyGainMap ultrahdr::JpegR::applyGainMap...

OSV-2024-1144 Security exception in graphql.schema.GraphQLTypeUtil.simplePrint

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=368729570 Crash type: Security exception Crash state: graphql.schema.GraphQLTypeUtil.simplePrint graphql.schema.GraphQLTypeUtil.simplePrint graphql.schema.GraphQLTypeUtil.simplePrint...

OSV-2024-1140 Security exception in java.base/java.util.Arrays.copyOfRange

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=368729567 Crash type: Security exception Crash state: java.base/java.util.Arrays.copyOfRange java.base/java.lang.StringUTF16.newString java.base/java.lang.StringBuilder.toString...

OSV-2024-1133 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=368657262 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr java.base/java.lang.Exception. java.base/java.lang.RuntimeException...

OSV-2024-1131 UNKNOWN READ in glslang::TInfoSinkBase::location

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=368512278 Crash type: UNKNOWN READ Crash state: glslang::TInfoSinkBase::location glslang::TParseContextBase::outputMessage glslang::TParseContextBase::error...

OSV-2024-1128 Segv on unknown address in udiv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=368076871 Crash type: Segv on unknown address Crash state: udiv mrbbintmod mrbvmexec...

OSV-2024-1124 Heap-buffer-overflow in ih264d_read_coeff4x4_cabac

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538616 Crash type: Heap-buffer-overflow READ 4 Crash state: ih264dreadcoeff4x4cabac ih264dcabacparse8x8block ih264dparseresidual4x4cabac...

OSV-2024-1102 Security exception in java.xml/com.sun.org.apache.xalan.internal.xsltc.trax.DOM2TO.parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538549 Crash type: Security exception Crash state: java.xml/com.sun.org.apache.xalan.internal.xsltc.trax.DOM2TO.parse java.xml/com.sun.org.apache.xerces.internal.dom.ElementNSImpl...

OSV-2024-1090 UNKNOWN READ in ggml_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538517 Crash type: UNKNOWN READ Crash state: ggmlfree llamamodel::llamamodel llamaloadmodelfromfile...

OSV-2024-1076 Heap-buffer-overflow in readBytes48

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538426 Crash type: Heap-buffer-overflow READ 1 Crash state: readBytes48 SystemZLLVMgetInstruction SystemZgetInstruction...

OSV-2024-1071 Use-of-uninitialized-value in Poco::Dynamic::Var::~Var

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538385 Crash type: Use-of-uninitialized-value Crash state: Poco::Dynamic::Var::Var void Poco::JSON::Object::doStringifystd::1::mapstd::1::basicstringchar, Poco::JWT::Serializer::serialize...

OSV-2024-1066 Heap-buffer-overflow in StrLen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=71496 Crash type: Heap-buffer-overflow READ 2 Crash state: StrLen MangleFileName ToolChainHarnessLib.c...

OSV-2024-1062 UNKNOWN WRITE in std::__1::recursive_mutex::lock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538230 Crash type: UNKNOWN WRITE Crash state: std::1::recursivemutex::lock Catalog::getForm Page::getAnnots...

OSV-2024-1059 UNKNOWN READ in chunk_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538184 Crash type: UNKNOWN READ Crash state: chunkfreeobject fileclosefile sclose...

OSV-2024-1056 UNKNOWN WRITE in bfd_elf_get_str_section

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538161 Crash type: UNKNOWN WRITE Crash state: bfdelfgetstrsection bfdelfstringfromelfsection bfdelfsymname...

OSV-2024-1054 Bad-cast to Assimp::LogStream from invalid vptr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538150 Crash type: Bad-cast Crash state: Bad-cast to Assimp::LogStream from invalid vptr CallbackToLogRedirector Assimp::DefaultLogger::WriteToStreams...

OSV-2024-1053 Heap-buffer-overflow in gguf_get_tensor_offset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538148 Crash type: Heap-buffer-overflow READ 8 Crash state: ggufgettensoroffset llamamodelloader::llamatensorweight::llamatensorweight void std::1::vectorllamamodelloader::llamatensorweight, std::1::allocat...

OSV-2024-1045 UNKNOWN READ in glslang::TInfoSinkBase::location

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=71345 Crash type: UNKNOWN READ Crash state: glslang::TInfoSinkBase::location glslang::TParseContextBase::outputMessage glslang::TParseContextBase::error...

OSV-2024-1044 UNKNOWN READ in H5FL_reg_malloc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538113 Crash type: UNKNOWN READ Crash state: H5FLregmalloc H5FLregcalloc H5Ocachechkdeserialize...

OSV-2024-1043 Heap-buffer-overflow in simdutf::haswell::implementation::convert_utf8_to_latin1

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=71307 Crash type: Heap-buffer-overflow WRITE Crash state: simdutf::haswell::implementation::convertutf8tolatin1 Conversion Conversion...

OSV-2024-1042 UNKNOWN READ in chunk_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538085 Crash type: UNKNOWN READ Crash state: chunkfreeobject streamdctfinalize chunkfreeobject...

OSV-2024-1041 UNKNOWN READ in chunk_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=71296 Crash type: UNKNOWN READ Crash state: chunkfreeobject sfclose pdficlosefile...

OSV-2024-1036 UNKNOWN READ in chunk_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=71250 Crash type: UNKNOWN READ Crash state: chunkfreeobject fileclosefile sclose...

OSV-2024-1034 Heap-buffer-overflow in simdutf::haswell::implementation::convert_utf8_to_utf16be

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=71218 Crash type: Heap-buffer-overflow WRITE Crash state: simdutf::haswell::implementation::convertutf8toutf16be Conversion Conversion...

OSV-2024-1031 Use-of-uninitialized-value in Http3FrameFactory::create

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42537939 Crash type: Use-of-uninitialized-value Crash state: Http3FrameFactory::create Http3FrameFactory::fastcreate fuzzhttp3frame.cc...

OSV-2024-1029 Stack-buffer-overflow in gf_hevc_parse_nalu_bs

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=71146 Crash type: Stack-buffer-overflow WRITE 4 Crash state: gfhevcparsenalubs gfinspectdumpnaluinternal inspectprocess...

OSV-2024-1023 Use-of-uninitialized-value in pcpp::SomeIpLayer::parseSomeIpLayer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=69526 Crash type: Use-of-uninitialized-value Crash state: pcpp::SomeIpLayer::parseSomeIpLayer pcpp::SomeIpLayer::parseNextLayer pcpp::Packet::setRawPacket...

OSV-2024-1018 Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67071 Crash type: Security exception Crash state: org.springframework.expression.spel.ast.OpPlus.getValueInternal org.springframework.util.ConcurrentReferenceHashMap$Segment.restructureIfNecessa...

OSV-2024-1010 UNKNOWN READ in H5SL_first

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=69169 Crash type: UNKNOWN READ Crash state: H5SLfirst H5FSsectfind H5MFfindsect...

OSV-2024-1009 Heap-buffer-overflow in pcpp::Layer::shortenLayer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66778 Crash type: Heap-buffer-overflow WRITE 9 Crash state: pcpp::Layer::shortenLayer pcpp::TextBasedProtocolMessage::removeField readParsedPacket...

OSV-2024-1003 Security exception in org.json.JSONStringer.value

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66272 Crash type: Security exception Crash state: org.json.JSONStringer.value org.json.JSONArray.writeTo org.json.JSONStringer.beforeValue...