OSV-2022-381 Heap-buffer-overflow in lwan_h2_huffman_decode_for_fuzzing

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46990 Crash type: Heap-buffer-overflow READ 8 Crash state: lwanh2huffmandecodeforfuzzing h2huffmanfuzzer.cc...

OSV-2022-380 Stack-buffer-overflow in sc_asn1_read_tag

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47035 Crash type: Stack-buffer-overflow READ 1 Crash state: scasn1readtag scasn1findtag cardoslistfiles...

OSV-2022-379 Segv on unknown address in bit_write_TV

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47014 Crash type: Segv on unknown address Crash state: bitwriteTV bitwriteT dwgencodeBLOCK...

OSV-2022-378 UNKNOWN READ in fp_cmp_mag

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47009 Crash type: UNKNOWN READ Crash state: fpcmpmag crtmgrtrustlistlookup crtmgradd...

OSV-2022-377 Heap-buffer-overflow in decode_preR13_section_hdr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46983 Crash type: Heap-buffer-overflow WRITE 4 Crash state: decodepreR13sectionhdr decodepreR13 dwgdecode...

OSV-2022-376 Heap-buffer-overflow in ndpi_search_raknet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47000 Crash type: Heap-buffer-overflow READ 2 Crash state: ndpisearchraknet checkndpidetectionfunc ndpicheckflowfunc...

OSV-2022-375 Stack-use-after-return in std::__1::__function::__func<bool grk::WaveletReverse::decompress_partial_tile<i

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46986 Crash type: Stack-use-after-return READ 1 Crash state: std::1::function::funcbool grk::WaveletReverse::decompresspartialtilei tf::Executor::invoke tf::Executor::spawn...

OSV-2022-374 Stack-use-after-scope in RefCopyBytes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47001 Crash type: Stack-use-after-scope READ Crash state: RefCopyBytes dngstream::Put tagdataptr::Put...

OSV-2022-372 Heap-buffer-overflow in dwg_encode_VERTEX_2D

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46994 Crash type: Heap-buffer-overflow READ 8 Crash state: dwgencodeVERTEX2D dwgencodeaddobject dwgencode...

OSV-2022-371 Segv on unknown address in jxl::N_AVX2::WriteToU8Stage::ProcessRow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46963 Crash type: Segv on unknown address Crash state: jxl::NAVX2::WriteToU8Stage::ProcessRow jxl::LowMemoryRenderPipeline::RenderRect jxl::LowMemoryRenderPipeline::ProcessBuffers...

OSV-2022-368 Heap-buffer-overflow in exif_get_long

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46917 Crash type: Heap-buffer-overflow READ 1 Crash state: exifgetlong exifmnotedatafujiload exifmnotedataload...

OSV-2022-367 Segv on unknown address in jxl::N_SSE4::WriteToU8Stage::ProcessRow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46915 Crash type: Segv on unknown address Crash state: jxl::NSSE4::WriteToU8Stage::ProcessRow jxl::LowMemoryRenderPipeline::RenderRect jxl::LowMemoryRenderPipeline::ProcessBuffers...

OSV-2022-363 Heap-use-after-free in dwg_free_TABLEGEOMETRY_private

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46847 Crash type: Heap-use-after-free READ 8 Crash state: dwgfreeTABLEGEOMETRYprivate dwgfreeTABLEGEOMETRY dwgfreevariablenoclass...

OSV-2022-361 UNKNOWN READ in sc_pkcs15_decode_pubkey_ec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46852 Crash type: UNKNOWN READ Crash state: scpkcs15decodepubkeyec scpkcs15decodepubkey fuzzpkcs15decode.c...

OSV-2022-360 Invalid-free in igl::MshLoader::~MshLoader

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46818 Crash type: Invalid-free Crash state: igl::MshLoader::MshLoader iglfuzzer.cpp...

OSV-2022-359 Heap-use-after-free in Segment::write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46788 Crash type: Heap-use-after-free READ 1 Crash state: Segment::write Doublewrite::writepages Doublewrite::flushtodisk...

OSV-2022-354 Segv on unknown address in gs_heap_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46734 Crash type: Segv on unknown address Crash state: gsheapfreeobject chunkfreeobject pdfirepairaddobject...

OSV-2022-351 UNKNOWN READ in ref_stack_counttomark

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46705 Crash type: UNKNOWN READ Crash state: refstackcounttomark zcounttomark gsinterpret...

OSV-2022-349 Heap-buffer-overflow in JS_CallInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46701 Crash type: Heap-buffer-overflow READ 1 Crash state: JSCallInternal JSEvalFunctionInternal JSEvalInternal...

OSV-2022-347 Heap-buffer-overflow in cli_bcomp_freemeta

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46687 Crash type: Heap-buffer-overflow READ 8 Crash state: clibcompfreemeta clibcompaddpatt readdbparseldbsubsignature...

OSV-2022-348 Heap-buffer-overflow in doemit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46692 Crash type: Heap-buffer-overflow WRITE 8 Crash state: doemit doinsert pere...

OSV-2022-346 Heap-buffer-overflow in cli_sigopts_handler

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46680 Crash type: Heap-buffer-overflow READ 1 Crash state: clisigoptshandler readdbparseldbsubsignature loadoneldb...

OSV-2022-345 Stack-buffer-overflow in sc_hsm_list_files

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46679 Crash type: Stack-buffer-overflow READ Crash state: schsmlistfiles sclistfiles fuzzcard.c...

OSV-2022-344 Heap-use-after-free in init_tdb

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46685 Crash type: Heap-use-after-free READ 4 Crash state: inittdb loadoneldb cliloadldb...

OSV-2022-343 Uncaught exception in com.alibaba.fastjson.JSONPath.getPropertyValue

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46696 Crash type: Uncaught exception Crash state: com.alibaba.fastjson.JSONPath.getPropertyValue java.base/jdk.internal.math.FDBigInteger.multByPow52 java.base/jdk.internal.math.FloatingDecimal$ASCIIToBinaryBuffer.floatValue...

OSV-2022-342 Heap-buffer-overflow in sc_pkcs15init_delete_by_path

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46653 Crash type: Heap-buffer-overflow READ 1 Crash state: scpkcs15initdeletebypath scpkcs15initstoredata scpkcs15initstoredataobject...

OSV-2022-341 Heap-buffer-overflow in krb_parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46670 Crash type: Heap-buffer-overflow READ 2 Crash state: krbparse ndpisearchkerberos checkndpidetectionfunc...

OSV-2022-340 Heap-buffer-overflow in cli_ac_addsig

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46646 Crash type: Heap-buffer-overflow READ 2 Crash state: cliacaddsig cliaddcontentmatchpattern readdbparseldbsubsignature...

OSV-2022-339 Heap-use-after-free in gc_trace

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46672 Crash type: Heap-use-after-free READ 2 Crash state: gctrace gsgcreclaim ireclaim...

OSV-2022-337 Heap-double-free in cli_extract_xlm_macros_and_images

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46586 Crash type: Heap-double-free Crash state: cliextractxlmmacrosandimages cliole2scantempdir climagicscan...

OSV-2022-336 Use-of-uninitialized-value in grk::N_SCALAR::DecompressIrrev::vtrans

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46594 Crash type: Use-of-uninitialized-value Crash state: grk::NSCALAR::DecompressIrrev::vtrans unsigned long grk::NSCALAR::vscheduler std::1::function::funcunsigned long grk::NSCALAR::vschedulergrk::NSCAL...

OSV-2022-331 Stack-buffer-overflow in void unwindstack::Symbols::BuildRemapTable<Elf64_Sym>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46546 Crash type: Stack-buffer-overflow READ Crash state: void unwindstack::Symbols::BuildRemapTable bool unwindstack::Symbols::GetName unwindstack::ElfInterfaceImpl::GetFunctionName...

OSV-2022-330 Stack-use-after-return in std::__1::__function::__func<bool grk::WaveletReverse::decompress_partial_tile<i

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46575 Crash type: Stack-use-after-return READ 1 Crash state: std::1::function::funcbool grk::WaveletReverse::decompresspartialtilei tf::Executor::invoke tf::Executor::consumetask...

OSV-2022-327 Stack-use-after-return in QSemaphore::release

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46525 The issue already existed before oss-fuzz could reproduce it. oss-fuzz found it after qdrawhelper routines were made multithreaded. There might be ways to trigger the issue before that. Crash type: Stack-use-after-return...

OSV-2022-325 Heap-buffer-overflow in ndpi_search_tinc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46499 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpisearchtinc checkndpidetectionfunc ndpicheckflowfunc...

OSV-2022-324 Heap-buffer-overflow in resize_packet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46474 Crash type: Heap-buffer-overflow WRITE Crash state: resizepacket FuzzResizePacket fuzzrfc1035.c...

OSV-2022-323 Heap-buffer-overflow in ConvertRGB24ToY_SSE41

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46436 Crash type: Heap-buffer-overflow READ 1 Crash state: ConvertRGB24ToYSSE41 ImportYUVAFromRGBA Import...

OSV-2022-322 Heap-buffer-overflow in frame_get_metalayers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46460 Crash type: Heap-buffer-overflow READ Crash state: framegetmetalayers frametoschunk blosc2schunkfrombuffer...

OSV-2022-321 Stack-use-after-scope in std::__1::__function::__func<bool grk::WaveletReverse::decompress_partial_tile<g

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46468 Crash type: Stack-use-after-scope WRITE 1 Crash state: std::1::function::funcbool grk::WaveletReverse::decompresspartialtileg tf::Executor::invoke tf::Executor::consumetask...

OSV-2022-320 Heap-buffer-overflow in lwan_h2_huffman_decode_for_fuzzing

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46506 Crash type: Heap-buffer-overflow READ 8 Crash state: lwanh2huffmandecodeforfuzzing h2huffmanfuzzer.cc...

OSV-2022-319 Heap-buffer-overflow in LoadPSD

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46437 Crash type: Heap-buffer-overflow WRITE 2 Crash state: LoadPSD PSDHandler::read kimgiofuzzer.cc...

OSV-2022-318 UNKNOWN READ

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46356 Crash type: UNKNOWN READ Crash state: NULL...

OSV-2022-317 Heap-use-after-free in save_marker

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46421 Crash type: Heap-use-after-free WRITE 1 Crash state: savemarker readmarkers consumemarkers...

OSV-2022-315 UNKNOWN READ in start_output_pass

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46396 Crash type: UNKNOWN READ Crash state: startoutputpass prepareforoutputpass outputpasssetup...

OSV-2022-314 UNKNOWN READ in [heap]

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46395 Crash type: UNKNOWN READ Crash state: heap...

OSV-2022-313 Heap-buffer-overflow in generic_unpack

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46432 Crash type: Heap-buffer-overflow READ 2 Crash state: genericunpack exrdecodingrun Imf31::checkCoreFile...

OSV-2022-312 Heap-buffer-overflow in dhcp_reply

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46416 Crash type: Heap-buffer-overflow READ 1 Crash state: dhcpreply dhcppacket FuzzDhcp...

OSV-2022-311 Heap-use-after-free in decode_mcu

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46354 Crash type: Heap-use-after-free READ 4 Crash state: decodemcu decompressonepass processdatasimplemain...

OSV-2022-310 Heap-use-after-free in jpeg_fill_bit_buffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46343 Crash type: Heap-use-after-free WRITE 4 Crash state: jpegfillbitbuffer jpeghuffdecode decodemcu...

OSV-2022-309 UNKNOWN READ in decompress_smooth_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46349 Crash type: UNKNOWN READ Crash state: decompresssmoothdata processdatasimplemain jpegreadscanlines...