OSV-2022-48 Heap-buffer-overflow in processClientServerHello

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43664 Crash type: Heap-buffer-overflow READ 2 Crash state: processClientServerHello processTLSBlock ndpisearchtlsudp...

OSV-2022-47 Heap-buffer-overflow in mem_mono_copy_mono

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43621 Crash type: Heap-buffer-overflow READ 2 Crash state: memmonocopymono memmapped4copycolor tileclipcopycolor...

OSV-2021-1802 UNKNOWN READ in pdfi_count_cff_index

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43599 Crash type: UNKNOWN READ Crash state: pdficountcffindex pdfireadcfffont pdfiloadfont...

OSV-2022-42 Heap-buffer-overflow in md_decode_utf8__

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43589 Crash type: Heap-buffer-overflow READ 1 Crash state: mddecodeutf8 mdlinklabelhash mdislinkreference...

OSV-2022-41 Segv on unknown address in zero

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43538 Crash type: Segv on unknown address Crash state: zero zendexecute fuzzerdorequestfrombuffer...

OSV-2022-40 UNKNOWN READ in md_build_attribute

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43587 Crash type: UNKNOWN READ Crash state: mdbuildattribute mdenterleavespana mdprocessnormalblockcontents...

OSV-2022-39 Stack-buffer-overflow in BZ2_decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43564 Crash type: Stack-buffer-overflow READ 1 Crash state: BZ2decompress BZ2bzDecompress ftbzip2filefilloutput...

OSV-2022-37 Heap-buffer-overflow in stringProcess

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43535 Crash type: Heap-buffer-overflow READ 1 Crash state: stringProcess tVariantCreateExt tVariantCreate...

OSV-2022-36 Heap-buffer-overflow in void absl::BytesToHexStringInternal<std::__1::basic_string<char, std::__1::char_

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43553 Crash type: Heap-buffer-overflow READ 1 Crash state: void absl::BytesToHexStringInternalstd::1::basicstringchar, std::1::char absl::BytesToHexString...

OSV-2022-35 Use-after-poison in absl::BytesToHexString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43554 Crash type: Use-after-poison READ 1 Crash state: absl::BytesToHexString...

OSV-2022-34 Heap-buffer-overflow in LZ4_decompress_safe

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43513 Crash type: Heap-buffer-overflow READ 16 Crash state: LZ4decompresssafe bloscd dojob...

OSV-2022-33 Heap-buffer-overflow in ndlz8_decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43519 Crash type: Heap-buffer-overflow READ 8 Crash state: ndlz8decompress bloscd dojob...

OSV-2022-32 Heap-buffer-overflow in _estrdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43484 Crash type: Heap-buffer-overflow READ 11 Crash state: estrdup exifprocessusercomment exifprocessIFDTAGimpl...

OSV-2022-31 Heap-buffer-overflow in md_parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43473 Crash type: Heap-buffer-overflow READ 1 Crash state: mdparse mdhtml fuzz-mdhtml.c...

OSV-2022-24 Null-dereference READ in session_startup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43419 Crash type: Null-dereference READ Crash state: sessionstartup libssh2sessionhandshake ssh2clientfuzzer.cc...

OSV-2022-21 Heap-buffer-overflow in Assimp::IOSystem2Unzip::opendisk

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43414 Crash type: Heap-buffer-overflow READ 1 Crash state: Assimp::IOSystem2Unzip::opendisk callzopendisk64 unzOpenCurrentFile3...

OSV-2022-18 UNKNOWN READ in gx_restrict_Pattern

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43354 Crash type: UNKNOWN READ Crash state: gxrestrictPattern gssetcolor pdfigssetrgbcolor...

OSV-2022-17 Heap-buffer-overflow in ap_is_chunked

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43371 Crash type: Heap-buffer-overflow READ 1 Crash state: apischunked fuzzutils.c...

OSV-2022-16 UNKNOWN READ in MqttProps_Free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43370 Crash type: UNKNOWN READ Crash state: MqttPropsFree MqttClientDecodePacket MqttClientWaitType...

OSV-2022-15 Global-buffer-overflow in ZSTD_compressBlock_opt0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43365 Crash type: Global-buffer-overflow READ 1 Crash state: ZSTDcompressBlockopt0 ZSTDcompressBlockbtopt ZSTDbuildSeqStore...

OSV-2022-13 Heap-use-after-free in read_data_compressed

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43324 Crash type: Heap-use-after-free READ 4 Crash state: readdatacompressed archivereadformatrarreaddata archivereaddatablock...

OSV-2022-12 Heap-buffer-overflow in print_mac

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43304 Crash type: Heap-buffer-overflow WRITE 4 Crash state: printmac logpacket dhcpreply...

OSV-2022-11 Heap-buffer-overflow in dhcp_reply

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43300 Crash type: Heap-buffer-overflow WRITE Crash state: dhcpreply dhcppacket FuzzDhcp...

OSV-2022-10 Heap-buffer-overflow in check_bad_address

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43308 Crash type: Heap-buffer-overflow WRITE 1 Crash state: checkbadaddress checkforboguswildcard FuzzCheckForBogusWildcard...

OSV-2022-6 Heap-buffer-overflow in extract_name

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43299 Crash type: Heap-buffer-overflow WRITE 1 Crash state: extractname hashquestions fuzzutil.c...

OSV-2022-5 Heap-buffer-overflow in pcpp::IPv6AuthenticationHeader::getExtensionLen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43290 Crash type: Heap-buffer-overflow READ 1 Crash state: pcpp::IPv6AuthenticationHeader::getExtensionLen pcpp::IPv6Layer::parseExtensions pcpp::IPv6Layer::IPv6Layer...

OSV-2022-4 Memcpy-param-overlap in ZSTD_createDDict

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43287 Crash type: Memcpy-param-overlap Crash state: ZSTDcreateDDict bloscrundecompressionwithcontext blosc2decompressctx...

OSV-2022-3 UNKNOWN READ in pdfi_free_array

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43255 Crash type: UNKNOWN READ Crash state: pdfifreearray pdfifreeobject pdfifreedict...

OSV-2022-1 Heap-use-after-free in pdfi_dereference

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43268 Crash type: Heap-use-after-free READ 4 Crash state: pdfidereference pdfidictnext pdficheckResources...

OSV-2021-1797 Heap-buffer-overflow in grk::GrkImage::cieLabToRGB

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43161 Crash type: Heap-buffer-overflow WRITE 4 Crash state: grk::GrkImage::cieLabToRGB grk::GrkImage::applyColourManagement grk::CodeStreamDecompress::postProcess...

OSV-2021-1796 Heap-buffer-overflow in Curl_sasl_decode_mech

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43186 Crash type: Heap-buffer-overflow READ 10 Crash state: Curlsasldecodemech Curlsaslparseurlauthoption pop3parseurloptions...

OSV-2021-1795 Negative-size-param in general_endcidrange_func

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43156 Crash type: Negative-size-param Crash state: generalendcidrangefunc cmapendcidrangefunc pdfipscriptinterpret...

OSV-2021-1793 Heap-buffer-overflow in seturl

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43160 Crash type: Heap-buffer-overflow READ Crash state: seturl parseurl curlurlset...

OSV-2021-1791 Heap-buffer-overflow in ZSTD_createDDict

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43110 Crash type: Heap-buffer-overflow READ Crash state: ZSTDcreateDDict bloscrundecompressionwithcontext blosc2decompressctx...

OSV-2021-1788 UNKNOWN READ in pdfi_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43094 Crash type: UNKNOWN READ Crash state: pdfifreeobject pdficreatecolorspacebyarray pdficreateDeviceN...

OSV-2021-1787 Global-buffer-overflow in stbi__jpeg_decode_block

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43113 Crash type: Global-buffer-overflow READ 4 Crash state: stbijpegdecodeblock stbidecodejpegimage stbijpegload...

OSV-2021-1786 Segv on unknown address in r_buf_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43092 Crash type: Segv on unknown address Crash state: rbuffree destroy rbinfilefree...

OSV-2021-1785 Heap-use-after-free in ut_allocator<os_event>::allocate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43059 Crash type: Heap-use-after-free READ 8 Crash state: utallocator::allocate oseventcreate rwlockcreatefunc...

OSV-2021-1781 Heap-buffer-overflow in read_xref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43045 Crash type: Heap-buffer-overflow READ 8 Crash state: readxref pdfireadxref pdfisetinputstream...

OSV-2021-1780 Heap-use-after-free in zend_jit_fetch_dim_r_helper

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43055 Crash type: Heap-use-after-free READ 4 Crash state: zendjitfetchdimrhelper zero zendexecute...

OSV-2021-1779 Heap-use-after-free in Segment::write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42996 Crash type: Heap-use-after-free READ 1 Crash state: Segment::write Doublewrite::writepages Doublewrite::flushtodisk...

OSV-2021-1776 Stack-buffer-underflow in InterpretPhoneme

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43037 Crash type: Stack-buffer-underflow READ 8 Crash state: InterpretPhoneme InterpretPhoneme2 CalcLengths...

OSV-2021-1775 Heap-buffer-overflow in hfs_dir_open_meta_cb

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43040 Crash type: Heap-buffer-overflow READ 1 Crash state: hfsdiropenmetacb hfscattraverse hfsdiropenmeta...

OSV-2021-1774 UNKNOWN READ in pdfi_array_get

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43004 Crash type: UNKNOWN READ Crash state: pdfiarrayget pdfiarraygettype pdficreatecolorspacebyarray...

OSV-2021-1772 UNKNOWN READ in chunk_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42998 Crash type: UNKNOWN READ Crash state: chunkfreeobject gsfontdirfinalize chunkfreeobject...

OSV-2021-1771 Stack-buffer-overflow in fn_ElIn_evaluate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43012 Crash type: Stack-buffer-overflow WRITE 4 Crash state: fnElInevaluate pdfitfusingfunction gsbegintransparencymask...

OSV-2021-1770 UNKNOWN READ in pdfi_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42980 Crash type: UNKNOWN READ Crash state: pdfifreeobject pdficlearcontext pdfifreecontext...

OSV-2021-1768 Heap-buffer-overflow in grk::GrkImage::color_esycc_to_rgb

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42958 Crash type: Heap-buffer-overflow READ 16 Crash state: grk::GrkImage::coloresycctorgb grk::GrkImage::colorConvert grkdecompressfuzzer.cpp...

OSV-2021-1767 Global-buffer-overflow in pdfi_dict_get

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42957 Crash type: Global-buffer-overflow READ 8 Crash state: pdfidictget pdfidictgetint pdfireadbareobject...

OSV-2021-1764 UNKNOWN READ in read_xref_stream_entries

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42927 Crash type: UNKNOWN READ Crash state: readxrefstreamentries pdfiprocessxrefstream pdfireadxrefstreamdict...