OSV-2021-899 Heap-buffer-overflow in synth_name_to_path

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35548 Crash type: Heap-buffer-overflow READ 8 Crash state: synthnametopath v9fsconametopath v9fscompleterename...

OSV-2021-897 Heap-buffer-overflow in ZSTD_decompressMultiFrame

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35537 Crash type: Heap-buffer-overflow READ Crash state: ZSTDdecompressMultiFrame ZSTDdecompressusingDDict bloscd...

OSV-2021-895 Segv on unknown address in helper_uc_tracecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35514 Crash type: Segv on unknown address Crash state: helpeructracecode...

OSV-2021-892 Heap-buffer-overflow in explicit_bzero

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35485 Crash type: Heap-buffer-overflow WRITE Crash state: explicitbzero cryptofree sshdisconnect...

OSV-2021-891 Heap-buffer-overflow in __cil_cat_expr_range_to_bitmap_helper

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35492 Crash type: Heap-buffer-overflow READ 4 Crash state: cilcatexprrangetobitmaphelper cilexprtobitmap evaluatecatexpression...

OSV-2021-887 Use-after-poison in AK::RefPtr<AK::StringImpl, AK::RefPtrTraits<AK::StringImpl> >::RefPtr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35436 Crash type: Use-after-poison WRITE 8 Crash state: AK::RefPtr ::RefPtr AK::String::String JS::abstractrelation...

OSV-2021-882 Uncaught exception

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35392 Crash type: Uncaught exception Crash state: NULL...

OSV-2021-875 Use-after-poison in AK::RefPtr<AK::StringImpl, AK::RefPtrTraits<AK::StringImpl> >::RefPtr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35337 Crash type: Use-after-poison WRITE 8 Crash state: AK::RefPtr ::RefPtr AK::String::String JS::abstractrelation...

OSV-2021-872 Heap-buffer-overflow in ndpi_set_detected_protocol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35300 Crash type: Heap-buffer-overflow READ 4 Crash state: ndpisetdetectedprotocol ndpiinthttpaddconnection checkcontenttypeandchangeprotocol...

OSV-2021-871 Heap-use-after-free in jxl::ImageBlender::PrepareBlending

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35293 Crash type: Heap-use-after-free READ 8 Crash state: jxl::ImageBlender::PrepareBlending jxl::FinalizeFrameDecoding jxl::FrameDecoder::Flush...

OSV-2021-870 Stack-use-after-return in v9fs_co_lgetxattr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35290 Crash type: Stack-use-after-return READ 8 Crash state: v9fscolgetxattr v9fsxattrwalk coroutinetrampoline...

OSV-2021-868 Heap-buffer-overflow in ndpi_set_detected_protocol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35288 Crash type: Heap-buffer-overflow READ 4 Crash state: ndpisetdetectedprotocol ndpimatchhostnameprotocol processClientServerHello...

OSV-2021-863 Use-after-poison in AK::RefPtr<AK::StringImpl, AK::RefPtrTraits<AK::StringImpl> >::RefPtr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35251 Crash type: Use-after-poison WRITE 8 Crash state: AK::RefPtr ::RefPtr AK::String::String JS::abstractrelation...

OSV-2021-861 Use-of-uninitialized-value in jxl::N_AVX2::FloatToRGBA8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35231 Crash type: Use-of-uninitialized-value Crash state: jxl::NAVX2::FloatToRGBA8 jxl::FinalizeImageRect jxl::ThreadPool::RunCallStatejxl::FinalizeFrameDecoding...

OSV-2021-859 Heap-buffer-overflow in FSE_writeNCount_generic

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35209 Crash type: Heap-buffer-overflow WRITE 1 Crash state: FSEwriteNCountgeneric FSEwriteNCount HUFcompressWeights...

OSV-2021-858 Use-of-uninitialized-value in jxl::N_SCALAR::Epf0Row

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35234 Crash type: Use-of-uninitialized-value Crash state: jxl::NSCALAR::Epf0Row jxl::FilterPipeline::ApplyFiltersRow jxl::FinalizeImageRect...

OSV-2021-857 Heap-buffer-overflow in mk_string_copy_substr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35202 Crash type: Heap-buffer-overflow READ Crash state: mkstringcopysubstr mkrconfmetaadd mkrconfread...

OSV-2021-855 Heap-buffer-overflow in mk_rconf_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35185 Crash type: Heap-buffer-overflow READ 1 Crash state: mkrconfread mkrconfopen flbparserconffile...

OSV-2021-853 Heap-buffer-overflow in jxl::ThreadPool::RunCallState<jxl::ConvertToExternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35172 Crash type: Heap-buffer-overflow WRITE 4 Crash state: jxl::ThreadPool::RunCallStatejxl::ConvertToExternal jpegxl::ThreadParallelRunner::ThreadFunc void std::1::threadproxystd::1::tuplestd::1::uniqueptrstd::1::...

OSV-2021-852 Heap-buffer-overflow in parseInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35153 Crash type: Heap-buffer-overflow READ 1 Crash state: parseInternal JavaExampleFuzzerNativeparse...

OSV-2021-850 Heap-buffer-overflow in proto_item_append_text

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35102 Crash type: Heap-buffer-overflow READ 8 Crash state: protoitemappendtext dissectpfcp3gppenterpriseies calldissectorwork...

OSV-2021-849 Negative-size-param in mrb_str_format

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35109 Crash type: Negative-size-param Crash state: mrbstrformat mrbfsprintf mrbvmexec...

OSV-2021-847 Heap-buffer-overflow in frame_get_vlmetalayers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35086 Crash type: Heap-buffer-overflow READ Crash state: framegetvlmetalayers frametoschunk blosc2schunkfrombuffer...

OSV-2021-843 Use-after-poison in AK::NonnullOwnPtr<JS::IndexedPropertyStorage>::operator->

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35038 Crash type: Use-after-poison READ 8 Crash state: AK::NonnullOwnPtr::operator- JS::IndexedProperties::arraylikesize JS::IndexedProperties::append...

OSV-2021-841 Heap-use-after-free in AK::StringImpl::create

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34973 Crash type: Heap-use-after-free READ Crash state: AK::StringImpl::create AK::String::String AK::URLParser::parsedataurl...

OSV-2021-840 Use-after-poison in AK::RefPtr<AK::StringImpl, AK::RefPtrTraits<AK::StringImpl> >::RefPtr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34971 Crash type: Use-after-poison WRITE 8 Crash state: AK::RefPtr ::RefPtr AK::String::String JS::abstractrelation...

OSV-2021-838 Heap-use-after-free in multiline_parser_conf_file

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34960 Crash type: Heap-use-after-free READ 8 Crash state: multilineparserconffile flbparserconffile configfuzzer.c...

OSV-2021-830 Heap-use-after-free in AK::Utf8CodePointIterator::operator*

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34911 Crash type: Heap-use-after-free READ 1 Crash state: AK::Utf8CodePointIterator::operator AK::URLParser::parse AK::URL::URL...

OSV-2021-823 UNKNOWN READ in FuzzedFileProvider::seek

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34845 Crash type: UNKNOWN READ Crash state: FuzzedFileProvider::seek IOdowrite IOfilecloseit...

OSV-2021-822 Heap-buffer-overflow in AK::Formatter<char const*, void>::format

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34863 Crash type: Heap-buffer-overflow READ 3 Crash state: AK::Formatter::format void AK::formatvalue AK::vformatimpl...

OSV-2021-821 Stack-buffer-overflow in jsoncons::bson::decimal128_to_chars

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34816 Crash type: Stack-buffer-overflow WRITE 6 Crash state: jsoncons::bson::decimal128tochars jsoncons::bson::basicbsonparserjsoncons::binarystreamsource, std::1::allo...

OSV-2021-820 UNKNOWN READ in virtio_gpu_disable_scanout

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34831 Crash type: UNKNOWN READ Crash state: virtiogpudisablescanout virtiogpusetscanout virtiogpusimpleprocesscmd...

OSV-2021-814 UNKNOWN WRITE in dwg_free_BLOCK_private

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34766 Crash type: UNKNOWN WRITE Crash state: dwgfreeBLOCKprivate dwgfreeBLOCK dwgfreeobject...

OSV-2021-813 Use-of-uninitialized-value in StandardSecurityHandler::StandardSecurityHandler

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34778 Crash type: Use-of-uninitialized-value Crash state: StandardSecurityHandler::StandardSecurityHandler SecurityHandler::make PDFDoc::checkEncryption...

OSV-2021-812 Uncaught exception in com.esotericsoftware.kryo.serializers.FieldSerializer.read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34733 Crash type: Uncaught exception Crash state: com.esotericsoftware.kryo.serializers.FieldSerializer.read com.esotericsoftware.kryo.Kryo.readObject DeserializeStringFuzzer.fuzzerTestOneInput...

OSV-2021-811 Segv on unknown address in GetASNHeader_ex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34719 Crash type: Segv on unknown address Crash state: GetASNHeaderex GetASNHeader GetASNInt...

OSV-2021-810 Global-buffer-overflow in SubstitutePhonemes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34747 Crash type: Global-buffer-overflow READ 2 Crash state: SubstitutePhonemes MakePhonemeList TranslateClause...

OSV-2021-808 Global-buffer-overflow in DoEmbedded2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34718 Crash type: Global-buffer-overflow READ 4 Crash state: DoEmbedded2 CalcLengths SpeakNextClause...

OSV-2021-807 Stack-buffer-overflow in DecodeSingleResponse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34713 Crash type: Stack-buffer-overflow WRITE Crash state: DecodeSingleResponse DecodeResponseData DecodeBasicOcspResponse...

OSV-2021-804 Heap-use-after-free in AK::NonnullOwnPtr<JS::IndexedPropertyStorage>::operator->

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34688 Crash type: Heap-use-after-free READ 8 Crash state: AK::NonnullOwnPtr::operator- JS::IndexedProperties::arraylikesize JS::IndexedProperties::append...

OSV-2021-803 Heap-buffer-overflow in sampled_data_finish

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34675 Crash type: Heap-buffer-overflow WRITE 16 Crash state: sampleddatafinish sampleddatacontinue interp...

OSV-2021-802 Stack-buffer-overflow in InterpretCondition

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34692 Crash type: Stack-buffer-overflow READ 1 Crash state: InterpretCondition InterpretPhoneme MakePhonemeList...

OSV-2021-801 UNKNOWN READ in std::__1::__tree<std::__1::__value_type<Json::Value::CZString, Json::Value>, std

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34665 Crash type: UNKNOWN READ Crash state: std::1::tree, std std::1::mapJson::Value::CZString, Json::Value, std::1::lessJson::Value::CZ Json::Value::begin...

OSV-2021-799 UNKNOWN READ in mrb_ary_shift_m

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34691 Crash type: UNKNOWN READ Crash state: mrbaryshiftm mrbvmexec mrbvmrun...

OSV-2021-795 Uncaught exception

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34646 Crash type: Uncaught exception Crash state: NULL...

OSV-2021-794 Heap-buffer-overflow in mrb_format_float

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34652 Crash type: Heap-buffer-overflow WRITE 1 Crash state: mrbformatfloat fmtfloat mrbstrformat...

OSV-2021-793 Heap-use-after-free in AK::RefPtr<AK::StringImpl, AK::RefPtrTraits<AK::StringImpl> >::RefPtr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34584 Crash type: Heap-use-after-free WRITE 8 Crash state: AK::RefPtr ::RefPtr AK::String::String JS::abstractrelation...

OSV-2021-791 UNKNOWN READ in std::__1::__tree<std::__1::__value_type<Json::Value::CZString, Json::Value>, std

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34531 Crash type: UNKNOWN READ Crash state: std::1::tree, std std::1::mapJson::Value::CZString, Json::Value, std::1::lessJson::Value::CZ Json::Value::begin...

OSV-2021-789 UNKNOWN READ in [heap]

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34575 Crash type: UNKNOWN READ Crash state: heap...

OSV-2021-787 Heap-buffer-overflow in string_decoder_getc_utf_8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34533 Crash type: Heap-buffer-overflow READ 1 Crash state: stringdecodergetcutf8 textdecodergetc GetC...