OSV-2021-1015 Dynamic-stack-buffer-overflow in VP8SetSegmentParams

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36191 Crash type: Dynamic-stack-buffer-overflow WRITE Crash state: VP8SetSegmentParams SetLoopParams OneStatPass...

OSV-2021-1011 Use-of-uninitialized-value in jxl::N_AVX2::AddNoise

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36158 Crash type: Use-of-uninitialized-value Crash state: jxl::NAVX2::AddNoise jxl::FinalizeImageRect jxl::ThreadPool::RunCallStatejxl::FinalizeFrameDecoding...

OSV-2021-1008 Dynamic-stack-buffer-overflow in clear_opt_map_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36155 Crash type: Dynamic-stack-buffer-overflow WRITE Crash state: clearoptmapinfo optimizenodeleft setoptimizeinfofromtree...

OSV-2021-1003 Dynamic-stack-buffer-overflow in mdb_numeric_to_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36187 Crash type: Dynamic-stack-buffer-overflow WRITE 16 Crash state: mdbnumerictostring mdbxferbounddata mdbattemptbind...

OSV-2021-998 Dynamic-stack-buffer-overflow in std::__1::__wrap_iter<char const*>::__wrap_iter

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36137 Crash type: Dynamic-stack-buffer-overflow WRITE 8 Crash state: std::1::wrapiter::wrapiter std::1::basicstring, std::1::allocatorch geos::io::StringTokenizer::StringTokenizer...

OSV-2021-997 Heap-buffer-overflow in ZSTD_createDDict_advanced

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36103 Crash type: Heap-buffer-overflow READ Crash state: ZSTDcreateDDictadvanced ZSTDcreateDDict bloscrundecompressionwithcontext...

OSV-2021-991 Dynamic-stack-buffer-overflow in fmt::v8::detail::dragonbox::umul192_upper64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36110 Crash type: Dynamic-stack-buffer-overflow WRITE 8 Crash state: fmt::v8::detail::dragonbox::umul192upper64 fmt::v8::detail::dragonbox::cacheaccessor::computemul fmt::v8::detail::dragonbox::decimalfp...

OSV-2021-990 Heap-use-after-free in uhci_handle_td

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36117 Crash type: Heap-use-after-free READ 8 Crash state: uhcihandletd uhciprocessframe uhciframetimer...

OSV-2021-987 Use-after-poison in AK::RefPtr<AK::StringImpl, AK::RefPtrTraits<AK::StringImpl> >::RefPtr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36127 Crash type: Use-after-poison WRITE 8 Crash state: AK::RefPtr ::RefPtr AK::String::String JS::abstractrelation...

OSV-2021-979 Heap-buffer-overflow in stbi__convert_16_to_8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36087 Crash type: Heap-buffer-overflow READ 2 Crash state: stbiconvert16to8 stbiloadandpostprocess8bit stbiloadfrommemory...

OSV-2021-977 Dynamic-stack-buffer-overflow in std::__1::pair<unsigned int, unsigned int>::pair<unsigned int, unsigned int, fal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36062 Crash type: Dynamic-stack-buffer-overflow WRITE 4 Crash state: std::1::pair::pair::type, std::1::unw void GFWX::decode...

OSV-2021-975 Dynamic-stack-buffer-overflow in CryptDigestUpdateInt

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36074 Crash type: Dynamic-stack-buffer-overflow WRITE 8 Crash state: CryptDigestUpdateInt ComputeCpHash CheckCommandAudit...

OSV-2021-973 Heap-buffer-overflow in blosc_run_decompression_with_context

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36093 Crash type: Heap-buffer-overflow READ 4 Crash state: bloscrundecompressionwithcontext blosc2decompressctx framedecompresschunk...

OSV-2021-972 UNKNOWN READ in void mc_chroma<unsigned short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36056 Crash type: UNKNOWN READ Crash state: void mcchroma generateinterpredictionsamples decodepredictionunit...

OSV-2021-962 Heap-use-after-free in Segment::write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36050 Crash type: Heap-use-after-free READ 1 Crash state: Segment::write Doublewrite::writepages Doublewrite::flushtodisk...

OSV-2021-958 Dynamic-stack-buffer-overflow in mdb_numeric_to_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35972 Crash type: Dynamic-stack-buffer-overflow WRITE 16 Crash state: mdbnumerictostring mdbxferbounddata mdbattemptbind...

OSV-2021-955 Stack-buffer-overflow in Buffer_AppendIndentUnchecked

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36009 Crash type: Stack-buffer-overflow WRITE 1 Crash state: BufferAppendIndentUnchecked encode encode...

OSV-2021-950 Dynamic-stack-buffer-overflow in std::__1::__wrap_iter<hsql::Expr**>::__wrap_iter

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35944 Crash type: Dynamic-stack-buffer-overflow WRITE 8 Crash state: std::1::wrapiter::wrapiter std::1::vector ::makeiter std::1::vector ::begin...

OSV-2021-947 Dynamic-stack-buffer-overflow in hsql::SQLParserResult::addStatement

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35946 Crash type: Dynamic-stack-buffer-overflow WRITE 8 Crash state: hsql::SQLParserResult::addStatement hsqlparse hsql::SQLParser::parse...

OSV-2021-948 Use-of-uninitialized-value in residual_coding

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35950 Crash type: Use-of-uninitialized-value Crash state: residualcoding readtransformunit readtransformtree...

OSV-2021-940 Heap-buffer-overflow in json_string_unescape

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35925 Crash type: Heap-buffer-overflow WRITE 1 Crash state: jsonstringunescape aftervalue executecallbacks...

OSV-2021-939 Segv on unknown address in helper_uc_tracecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35912 Crash type: Segv on unknown address Crash state: helpeructracecode...

OSV-2021-935 Heap-buffer-overflow in answer_request

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35920 Crash type: Heap-buffer-overflow WRITE 1 Crash state: answerrequest FuzzAnswerTheRequest fuzzrfc1035.c...

OSV-2021-933 Heap-buffer-overflow in print_mac

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35887 Crash type: Heap-buffer-overflow WRITE 4 Crash state: printmac logpacket dhcpreply...

OSV-2021-934 Heap-buffer-overflow in extract_addresses

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35865 Crash type: Heap-buffer-overflow WRITE 1 Crash state: extractaddresses FuzzExtractTheAddress fuzzrfc1035.c...

OSV-2021-932 Heap-buffer-overflow in resize_packet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35898 Crash type: Heap-buffer-overflow WRITE Crash state: resizepacket FuzzResizePacket fuzzrfc1035.c...

OSV-2021-931 Heap-buffer-overflow in extract_name

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35861 Crash type: Heap-buffer-overflow WRITE 1 Crash state: extractname answerauth FuzzAuth...

OSV-2021-930 Heap-use-after-free in dhcp6_no_relay

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35860 Crash type: Heap-use-after-free WRITE 1 Crash state: dhcp6norelay dhcp6mayberelay dhcp6reply...

OSV-2021-929 Heap-buffer-overflow in extract_name

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35858 Crash type: Heap-buffer-overflow WRITE 1 Crash state: extractname hashquestions fuzzutil.c...

OSV-2021-928 UNKNOWN WRITE in g_array_append_vals

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35890 Crash type: UNKNOWN WRITE Crash state: garrayappendvals gbytearrayappend fubytearrayappendbytes...

OSV-2021-927 Heap-buffer-overflow in dhcp_reply

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35870 Crash type: Heap-buffer-overflow WRITE Crash state: dhcpreply dhcppacket FuzzDhcp...

OSV-2021-926 Heap-use-after-free in zend_gc_addref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35876 Crash type: Heap-use-after-free READ 4 Crash state: zendgcaddref ZENDASSIGNOPSPECVARTMPVARHANDLER fuzzerexecuteex...

OSV-2021-925 Stack-buffer-overflow in is_same_net6

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35889 Crash type: Stack-buffer-overflow READ Crash state: issamenet6 dhcp6mayberelay dhcp6mayberelay...

OSV-2021-924 Heap-buffer-overflow in check_bad_address

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35868 Crash type: Heap-buffer-overflow WRITE 1 Crash state: checkbadaddress checkforboguswildcard FuzzCheckForBogusWildcard...

OSV-2021-921 Stack-buffer-overflow in bool re2::DFA::InlinedSearchLoop<true, true, true>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35821 Crash type: Stack-buffer-overflow READ 1 Crash state: bool re2::DFA::InlinedSearchLoop re2::DFA::Search re2::Prog::SearchDFA...

OSV-2021-919 UNKNOWN READ in v_FindFunction

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35801 Crash type: UNKNOWN READ Crash state: vFindFunction m3FindFunction fuzzer.c...

OSV-2021-916 Use-of-uninitialized-value in jxl::ModularFrameDecoder::DecodeAcMetadata

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35778 Crash type: Use-of-uninitialized-value Crash state: jxl::ModularFrameDecoder::DecodeAcMetadata jxl::FrameDecoder::ProcessDCGroup jxl::ThreadPool::RunCallStatejxl::Status...

OSV-2021-915 Stack-buffer-overflow in sc_asn1_read_tag

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35766 Crash type: Stack-buffer-overflow READ 1 Crash state: scasn1readtag scasn1findtag pivcomputesignature...

OSV-2021-914 UNKNOWN READ in mrb_vm_ci_env

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35718 Crash type: UNKNOWN READ Crash state: mrbvmcienv cipop mrbvmexec...

OSV-2021-913 Heap-buffer-overflow in dispatch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35727 Crash type: Heap-buffer-overflow READ 1 Crash state: dispatch dispatchlinked codegen...

OSV-2021-912 Heap-buffer-overflow in mrb_vm_exec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35712 Crash type: Heap-buffer-overflow READ 4 Crash state: mrbvmexec mrbvmrun mrbtoprun...

OSV-2021-909 Heap-buffer-overflow in OT::CPALV1Tail::serialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35672 Crash type: Heap-buffer-overflow READ 2 Crash state: OT::CPALV1Tail::serialize OT::CPAL::subset bool trysubset...

OSV-2021-908 Heap-use-after-free in tsk_fs_attr_set_run

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35684 Crash type: Heap-use-after-free READ 8 Crash state: tskfsattrsetrun fatfsmakedataruns tskfsfileattrcheck...

OSV-2021-907 Heap-buffer-overflow in decode_header_value_literal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35675 Crash type: Heap-buffer-overflow READ 1 Crash state: decodeheadervalueliteral decodeheader h2ohpackparserequest...

OSV-2021-906 Heap-buffer-overflow in orbit_object_utils::ElfFileImpl<llvm::object::ELFType<

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35617 Crash type: Heap-buffer-overflow READ 4 Crash state: orbitobjectutils::ElfFileImplllvm::object::ELFType orbitobjectutils::CreateElfFile orbitobjectutils::CreateElfFileFromBuffer...

OSV-2021-904 UNKNOWN READ in helper_uc_tracecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35567 Crash type: UNKNOWN READ Crash state: helpeructracecode...

OSV-2021-903 UNKNOWN WRITE in QOutlineMapper::convertPath

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35566 Crash type: UNKNOWN WRITE Crash state: QOutlineMapper::convertPath QRasterPaintEngine::fill QPaintEngineEx::stroke...

OSV-2021-902 Heap-buffer-overflow in ebitmap_match_any

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35553 Crash type: Heap-buffer-overflow READ 8 Crash state: ebitmapmatchany avtabmap cilcheckneverallow...

OSV-2021-901 Stack-use-after-return in __readlink

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35565 Crash type: Stack-use-after-return WRITE 8 Crash state: readlink v9fscoreadlink v9fsreadlink...

OSV-2021-900 Negative-size-param in WebPRescalerInit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35583 Crash type: Negative-size-param Crash state: WebPRescalerInit AllocateAndInitRescaler VP8LDecodeImage...