OSV-2021-1216 Global-buffer-overflow in fr_is_base16_nstd

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38283 Crash type: Global-buffer-overflow READ 1 Crash state: frisbase16nstd frbase16decodenstd frvalueboxfromstr...

OSV-2021-1215 Invalid-free in swift_unexpectedError

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38264 Crash type: Invalid-free Crash state: swiftunexpectedError function signature specialization Arg function signature specialization Arg...

OSV-2021-1214 Invalid-free in swift_unexpectedError

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38253 Crash type: Invalid-free Crash state: swiftunexpectedError FuzzJSON.FuzzJSON...

OSV-2021-1213 UNKNOWN WRITE in mrb_vm_exec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38251 Crash type: UNKNOWN WRITE Crash state: mrbvmexec mrbvmrun mrbtoprun...

OSV-2021-1211 Heap-buffer-overflow in MqttDecode_Publish

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38237 Crash type: Heap-buffer-overflow WRITE 8 Crash state: MqttDecodePublish MqttClientDecodePacket MqttClientHandlePacket...

OSV-2021-1206 Stack-use-after-scope in uprv_stricmp_70

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38156 Crash type: Stack-use-after-scope READ 1 Crash state: uprvstricmp70 ulocimpgetLanguage70 canonicalize...

OSV-2021-1205 Heap-buffer-overflow in backup_lpf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38152 Crash type: Heap-buffer-overflow WRITE Crash state: backuplpf dav1dlrcopylpf16bpc dav1dfiltersbrowdeblockrows16bpc...

OSV-2021-1204 Heap-buffer-overflow in MqttClient_DecodePacket

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38146 Crash type: Heap-buffer-overflow WRITE 1 Crash state: MqttClientDecodePacket MqttClientHandlePacket MqttClientWaitType...

OSV-2021-1202 Heap-buffer-overflow in parse_to_param

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38080 Crash type: Heap-buffer-overflow READ 1 Crash state: parsetoparam parseaddrspec parseto...

OSV-2021-1201 Heap-buffer-overflow in q_memchr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38065 Crash type: Heap-buffer-overflow READ 1 Crash state: qmemchr parsequotedparam parseparambody...

OSV-2021-1199 Heap-use-after-free in i_zval_ptr_dtor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38001 Crash type: Heap-use-after-free READ 1 Crash state: izvalptrdtor concatfunction zendbinaryop...

OSV-2021-1198 Heap-buffer-overflow in parse_param_name

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38052 Crash type: Heap-buffer-overflow READ 1 Crash state: parseparamname parseparam2 parseparams2...

OSV-2021-1197 Heap-buffer-overflow in H5O__linfo_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38041 Crash type: Heap-buffer-overflow READ 1 Crash state: H5Olinfodecode H5Omsgreadoh H5Omsgread...

OSV-2021-1196 Heap-buffer-overflow in parse_content_length

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38050 Crash type: Heap-buffer-overflow READ 1 Crash state: parsecontentlength gethdrfield parseheaders...

OSV-2021-1195 Heap-buffer-overflow in trim_leading

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38048 Crash type: Heap-buffer-overflow READ 1 Crash state: trimleading parsecontacts contactparser...

OSV-2021-1194 Heap-use-after-free in zend_string_release

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38014 Crash type: Heap-use-after-free READ 4 Crash state: zendstringrelease zendclosurefreestorage zendobjectsstoredel...

OSV-2021-1192 Segv on unknown address in arrow::DefaultBackend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37927 Crash type: Segv on unknown address Crash state: arrow::DefaultBackend arrow::PoolBuffer::MakeUnique arrow::AllocateBuffer...

OSV-2021-1189 Segv on unknown address in arrow::DefaultBackend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37915 Crash type: Segv on unknown address Crash state: arrow::DefaultBackend arrow::defaultmemorypool arrow::ipc::IpcReadOptions::Defaults...

OSV-2021-1188 Heap-buffer-overflow in MqttDecode_Publish

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37866 Crash type: Heap-buffer-overflow WRITE 4 Crash state: MqttDecodePublish MqttClientDecodePacket MqttClientHandlePacket...

OSV-2021-1186 Segv on unknown address in helper_uc_tracecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37856 Crash type: Segv on unknown address Crash state: helpeructracecode...

OSV-2021-1184 UNKNOWN READ in ucl_array_append

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37885 Crash type: UNKNOWN READ Crash state: uclarrayappend uclobjectcopyinternal uclobjectcopy...

OSV-2021-1183 UNKNOWN WRITE in draco::DepthFirstTraverser<draco::CornerTable, draco::MeshAttributeIndicesEncodi

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37864 Crash type: UNKNOWN WRITE Crash state: draco::DepthFirstTraverserdraco::CornerTable, draco::MeshAttributeIndicesEncodi draco::MeshTraversalSequencerdraco::DepthFirstTraverserdraco::CornerTable, dra...

OSV-2021-1181 Heap-buffer-overflow in draco::MeshPredictionSchemeTexCoordsDecoder<int, draco::PredictionSchemeWrapDeco

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37814 Crash type: Heap-buffer-overflow WRITE 4 Crash state: draco::MeshPredictionSchemeTexCoordsDecoderint, draco::PredictionSchemeWrapDeco draco::MeshPredictionSchemeTexCoordsDecoderint, draco::PredictionSchemeWrapDeco...

OSV-2021-1179 UNKNOWN READ

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37759 Crash type: UNKNOWN READ Crash state: NULL...

OSV-2021-1177 Stack-buffer-overflow in bool draco::FloatPointsTreeDecoder::DecodePointCloud<draco::PointAttributeVector

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37716 Crash type: Stack-buffer-overflow READ Crash state: bool draco::FloatPointsTreeDecoder::DecodePointClouddraco::PointAttributeVector draco::KdTreeAttributesDecoder::DecodeDataNeededByPortableTransforms...

OSV-2021-1176 Index-out-of-bounds in draco::MeshEdgebreakerTraversalValenceDecoder::DecodeSymbol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37705 Crash type: Index-out-of-bounds Crash state: draco::MeshEdgebreakerTraversalValenceDecoder::DecodeSymbol draco::MeshEdgebreakerDecoderImpl draco::MeshEdgebreakerDecoderImpl...

OSV-2021-1174 Heap-use-after-free in zend_string_release

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37695 Crash type: Heap-use-after-free READ 4 Crash state: zendstringrelease zendclosurefreestorage zendobjectsstoredel...

OSV-2021-1173 UNKNOWN READ in luaG_getfuncline

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37678 Crash type: UNKNOWN READ Crash state: luaGgetfuncline luaGrunerror luaDgrowstack...

OSV-2021-1172 UNKNOWN WRITE in snmp_add_var

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37647 Crash type: UNKNOWN WRITE Crash state: snmpaddvar snmpapifuzzer.c...

OSV-2021-1171 Heap-buffer-overflow in luaG_runerror

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37621 Crash type: Heap-buffer-overflow READ 8 Crash state: luaGrunerror luaDpretailcall luaVexecute...

OSV-2021-1170 Heap-buffer-overflow in exif_get_slong

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37581 Crash type: Heap-buffer-overflow READ 1 Crash state: exifgetslong exifgetsrational mnoteappleentrygetvalue...

OSV-2021-1169 UNKNOWN READ in exif_mnote_data_apple_load

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37575 Crash type: UNKNOWN READ Crash state: exifmnotedataappleload exifmnotedataload interpretmakernote...

OSV-2021-1168 Heap-buffer-overflow in exif_get_slong

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37570 Crash type: Heap-buffer-overflow READ 1 Crash state: exifgetslong exifgetlong exifgetrational...

OSV-2021-1167 Heap-buffer-overflow in snmp_add_var

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37564 Crash type: Heap-buffer-overflow READ 1 Crash state: snmpaddvar snmpapifuzzer.c...

OSV-2021-1166 Use-of-uninitialized-value in H5F_addr_decode_len

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37536 Crash type: Use-of-uninitialized-value Crash state: H5Faddrdecodelen H5VLnativetokentoaddr H5VLnativeobjectopen...

OSV-2021-1161 UNKNOWN READ in decode_ise

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37413 Crash type: UNKNOWN READ Crash state: decodeise physicaltosymbolic fuzzastcphysicaltosymbolic.cpp...

OSV-2021-1160 Heap-buffer-overflow in pe_valid_dll_name

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37443 Crash type: Heap-buffer-overflow READ 1 Crash state: pevaliddllname peparsedelayimportdllname peparsedelayedimports...

OSV-2021-1159 UNKNOWN WRITE in hb_bit_set_invertible_t::set

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37425 Crash type: UNKNOWN WRITE Crash state: hbbitsetinvertiblet::set hbsparsesett::set hbsetcopy...

OSV-2021-1157 Heap-use-after-free in TranslateRules

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37410 Crash type: Heap-use-after-free READ 1 Crash state: TranslateRules TranslateWord3 TranslateWord...

OSV-2021-1153 Heap-buffer-overflow in hb_array_t<OT::IntType<unsigned int, 4u> const> hb_array_t<OT::IntType<unsigned

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37348 Crash type: Heap-buffer-overflow READ 4 Crash state: hbarrayt const hbarrayt ::copy hbheadt , decltype...

OSV-2021-1152 UNKNOWN READ in exif_mnote_data_apple_load

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37334 Crash type: UNKNOWN READ Crash state: exifmnotedataappleload exifmnotedataload interpretmakernote...

OSV-2021-1150 Heap-buffer-overflow in H5O__cont_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37318 Crash type: Heap-buffer-overflow READ 1 Crash state: H5Ocontdecode H5Ochunkdeserialize H5Ocachedeserialize...

OSV-2021-1149 Heap-buffer-overflow in JS::Lexer::consume

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37294 Crash type: Heap-buffer-overflow READ 1 Crash state: JS::Lexer::consume JS::Lexer::next JS::Parser::consume...

OSV-2021-1145 Use-after-poison in JS::Reference::put_value

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37312 Crash type: Use-after-poison READ 8 Crash state: JS::Reference::putvalue JS::AssignmentExpression::execute JS::ExpressionStatement::execute...

OSV-2021-1143 UNKNOWN WRITE in QtPrivate::QPodArrayOps<QPainterPath::Element>::copyAppend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37306 This is the same issue as OSV-2021-1121 which it replaced after that one was closed wrongly. Crash type: UNKNOWN WRITE Crash state: QtPrivate::QPodArrayOps::copyAppend QtPrivate::QCommonArrayOps::growAppend QList::append...

OSV-2021-1142 Heap-buffer-overflow in exif_get_slong

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37231 Crash type: Heap-buffer-overflow READ 1 Crash state: exifgetslong mnoteappleentrygetvalue exifmnotedataapplegetvalue...

OSV-2021-1141 Heap-use-after-free in TranslateLetter

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37238 Crash type: Heap-use-after-free READ 4 Crash state: TranslateLetter TranslateWord3 TranslateWord...

OSV-2021-1139 UNKNOWN READ in exif_mnote_data_apple_load

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37234 Crash type: UNKNOWN READ Crash state: exifmnotedataappleload exifmnotedataload interpretmakernote...

OSV-2021-1138 Heap-buffer-overflow in exif_get_sshort

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37226 Crash type: Heap-buffer-overflow READ 1 Crash state: exifgetsshort exifgetshort exifmnotedataappleload...

OSV-2021-1137 Uncaught exception in com.alibaba.fastjson.parser.DefaultJSONParser.parseObject

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37237 Crash type: Uncaught exception Crash state: com.alibaba.fastjson.parser.DefaultJSONParser.parseObject java.base/java.util.HashMap.tableSizeFor java.base/java.util.HashMap...