OSV-2021-786 Heap-buffer-overflow in jxl::PerformAlphaWeightedAdd

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34518 Crash type: Heap-buffer-overflow WRITE Crash state: jxl::PerformAlphaWeightedAdd jxl::PerformBlending jxl::ImageBlender::RectBlender::DoBlending...

OSV-2021-784 Heap-buffer-overflow in processClientServerHello

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34500 Crash type: Heap-buffer-overflow READ 1 Crash state: processClientServerHello processTLSBlock ndpisearchtlstcp...

OSV-2021-782 Global-buffer-overflow in IsLetterGroup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34494 Crash type: Global-buffer-overflow READ 1 Crash state: IsLetterGroup MatchRule TranslateRules...

OSV-2021-781 UNKNOWN READ in Json::decodePrefixedString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34484 Crash type: UNKNOWN READ Crash state: Json::decodePrefixedString Json::Value::asString perfetto::traceprocessor::json::AddJsonValueToArgs...

OSV-2021-779 Heap-buffer-overflow in _blosc_getitem

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34458 Crash type: Heap-buffer-overflow READ 8 Crash state: bloscgetitem blosc2getitemctx blosc2getitem...

OSV-2021-778 UNKNOWN READ in helper_uc_tracecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34457 Crash type: UNKNOWN READ Crash state: helpeructracecode...

OSV-2021-777 Heap-use-after-free in xmlAddNextSibling

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34461 Crash type: Heap-use-after-free READ 4 Crash state: xmlAddNextSibling xmlXIncludeCopyRange xmlXIncludeCopyXPointer...

OSV-2021-776 UNKNOWN READ in std::__1::__tree<std::__1::__value_type<Json::Value::CZString, Json::Value>, std

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34443 Crash type: UNKNOWN READ Crash state: std::1::tree, std std::1::mapJson::Value::CZString, Json::Value, std::1::lessJson::Value::CZ Json::Value::begin...

OSV-2021-775 Heap-buffer-overflow in _m3d_safestr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34416 Crash type: Heap-buffer-overflow WRITE 1 Crash state: m3dsafestr m3dload Assimp::M3DWrapper::M3DWrapper...

OSV-2021-771 Heap-use-after-free in dwg_free_TABLEGEOMETRY_private

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34377 Crash type: Heap-use-after-free READ 8 Crash state: dwgfreeTABLEGEOMETRYprivate dwgfreeTABLEGEOMETRY dwgfreevariablenoclass...

OSV-2021-769 Stack-buffer-overflow in TranslateClause

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34332 Crash type: Stack-buffer-overflow READ 16 Crash state: TranslateClause SpeakNextClause Synthesize...

OSV-2021-767 Heap-buffer-overflow in string_decoder_getc_utf_8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34299 Crash type: Heap-buffer-overflow READ 1 Crash state: stringdecodergetcutf8 textdecodergetc GetC...

OSV-2021-766 Negative-size-param in frame_get_vlmetalayers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34259 Crash type: Negative-size-param Crash state: framegetvlmetalayers frametoschunk blosc2schunkfrombuffer...

OSV-2021-765 Heap-use-after-free in LookupDict2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34298 Crash type: Heap-use-after-free READ 4 Crash state: LookupDict2 LookupDictList Lookup...

OSV-2021-764 Stack-buffer-overflow in TranslateNumber_1

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34285 Crash type: Stack-buffer-overflow READ 1 Crash state: TranslateNumber1 TranslateNumber TranslateWord3...

OSV-2021-760 Heap-buffer-overflow in std::__1::char_traits<char>::length

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34230 Crash type: Heap-buffer-overflow READ 1 Crash state: std::1::chartraits::length std::1::basicstring, std::1::allocatorch ODDLParser::logInvalidTokenError...

OSV-2021-757 Use-of-uninitialized-value in nn_check_initialized

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34156 Crash type: Use-of-uninitialized-value Crash state: nncheckinitialized nnzero ecgdsasignraw...

OSV-2021-750 Heap-double-free in flb_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34116 Crash type: Heap-double-free Crash state: flbfree flbparserjsondo flbparserdo...

OSV-2021-745 Heap-buffer-overflow in skip_to_next_entry

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34110 Crash type: Heap-buffer-overflow READ 1 Crash state: skiptonextentry getexceptionhandler PyEvalEvalFrameDefault...

OSV-2021-739 Stack-buffer-overflow in flb_sds_cat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34025 Crash type: Stack-buffer-overflow READ Crash state: flbsdscat flbratranslate recordacfuzzer.c...

OSV-2021-736 Stack-use-after-return in zend_fiber_suspend_context

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34013 Crash type: Stack-use-after-return READ 4 Crash state: zendfibersuspendcontext zendfibersuspend zimFibersuspend...

OSV-2021-735 Use-of-uninitialized-value in decode_CABAC_FL_bypass

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34047 Crash type: Use-of-uninitialized-value Crash state: decodeCABACFLbypass decodecoeffabslevelremaining residualcoding...

OSV-2021-732 Heap-buffer-overflow in readstat_convert

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33991 Crash type: Heap-buffer-overflow READ 1 Crash state: readstatconvert savprocessrow savreaduncompresseddata...

OSV-2021-731 Heap-use-after-free in cleanup_live_vars

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33947 Crash type: Heap-use-after-free READ 4 Crash state: cleanuplivevars zendcleanupunfinishedexecution zendgeneratorcleanupunfinishedexecution...

OSV-2021-728 UNKNOWN WRITE in _fini

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33944 Crash type: UNKNOWN WRITE Crash state: fini...

OSV-2021-729 Global-buffer-overflow in libfsext_inode_read_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33940 Crash type: Global-buffer-overflow READ Crash state: libfsextinodereaddata libfsextinodereadelementdata libfdatavectorgetelementvaluebyindex...

OSV-2021-727 UNKNOWN READ in MEM_read32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33956 Crash type: UNKNOWN READ Crash state: MEMread32 ZSTDcompressBlockgreedyextDictrow ZSTDldmblockCompress...

OSV-2021-725 UNKNOWN READ in libfsext_directory_entry_read_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33935 Crash type: UNKNOWN READ Crash state: libfsextdirectoryentryreaddata libfsextdirectoryreadinlinedata libfsextdirectoryreadfileiohandle...

OSV-2021-719 Heap-buffer-overflow in tt_face_get_paint_layers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33855 Crash type: Heap-buffer-overflow READ 1 Crash state: ttfacegetpaintlayers FTGetPaintLayers colrv1traversepaint...

OSV-2021-717 Heap-use-after-free in real_param

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33862 Crash type: Heap-use-after-free READ 1 Crash state: realparam zpdfinkpath interp...

OSV-2021-713 Heap-use-after-free in AK::StringView::StringView

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33852 Crash type: Heap-use-after-free READ 8 Crash state: AK::StringView::StringView void AK::formatvalue AK::vformatimpl...

OSV-2021-710 Heap-use-after-free in iov_from_buf_full

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33785 Crash type: Heap-use-after-free WRITE 2 Crash state: iovfrombuffull iovfrombuf virtionetreceivercu...

OSV-2021-709 Index-out-of-bounds in tsk_img_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33805 Crash type: Index-out-of-bounds Crash state: tskimgread APFSPool::read APFSBlock::APFSBlock...

OSV-2021-703 Container-overflow in unsigned long jsoncons::detail::escape_string<char, jsoncons::string_sink<std::_

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33781 Crash type: Container-overflow READ 1 Crash state: unsigned long jsoncons::detail::escapestring::key...

OSV-2021-702 Heap-double-free in flb_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33750 Crash type: Heap-double-free Crash state: flbfree flbparserjsondo flbparserdo...

OSV-2021-701 Heap-use-after-free in m3_FreeRuntime

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33765 Crash type: Heap-use-after-free READ 8 Crash state: m3FreeRuntime fuzzer.c RuntimeRelease...

OSV-2021-700 UNKNOWN READ in ReadLEB_u32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33749 Crash type: UNKNOWN READ Crash state: ReadLEBu32 InitElements CompileExtendedOpcode...

OSV-2021-699 UNKNOWN WRITE in m3_FreeModule

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33726 Crash type: UNKNOWN WRITE Crash state: m3FreeModule FreeModule CompileExtendedOpcode...

OSV-2021-698 UNKNOWN READ in m3_Realloc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33744 Crash type: UNKNOWN READ Crash state: m3Realloc InitMemory CompileBlockStatements...

OSV-2021-696 UNKNOWN READ in ntlm_decode_type2_target

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33720 Crash type: UNKNOWN READ Crash state: ntlmdecodetype2target Curlauthdecodentlmtype2message Curlsaslcontinue...

OSV-2021-695 Stack-buffer-overflow in XCFImageFormat::loadTileRLE

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33742 Crash type: Stack-buffer-overflow WRITE 1 Crash state: XCFImageFormat::loadTileRLE XCFImageFormat::loadLevel XCFImageFormat::loadHierarchy...

OSV-2021-692 UNKNOWN READ in qpaintengineex_lineTo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33678 Crash type: UNKNOWN READ Crash state: qpaintengineexlineTo bool qtstrokeside QStroker::processCurrentSubpath...

OSV-2021-689 UNKNOWN WRITE in Runtime_Release

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33689 Crash type: UNKNOWN WRITE Crash state: RuntimeRelease EvaluateExpression InitDataSegments...

OSV-2021-688 Segv on unknown address in std::__Fuzzer::basic_string<char, std::__Fuzzer::char_traits<char>, std::__Fuzze

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33682 Crash type: Segv on unknown address Crash state: std::Fuzzer::basicstring, std::Fuzze std::Fuzzer::moneypunctbyname::init...

OSV-2021-687 UNKNOWN WRITE in InitDataSegments

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33663 Crash type: UNKNOWN WRITE Crash state: InitDataSegments CompileBlockStatements CompileBlock...

OSV-2021-679 Heap-buffer-overflow in strlcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33556 Crash type: Heap-buffer-overflow WRITE Crash state: strlcpy parselxcmntopts setconfigrootfsoptions...

OSV-2021-676 Heap-buffer-overflow in op_Const64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33554 Crash type: Heap-buffer-overflow WRITE 8 Crash state: opConst64 EvaluateExpression m3LoadModule...

OSV-2021-678 UNKNOWN WRITE in CompileBlock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33555 Crash type: UNKNOWN WRITE Crash state: CompileBlock CompileLoopOrBlock CompileBlockStatements...

OSV-2021-677 Heap-buffer-overflow in grk::FileFormatDecompress::apply_palette_clr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33544 Crash type: Heap-buffer-overflow WRITE 16 Crash state: grk::FileFormatDecompress::applypaletteclr grk::FileFormatDecompress::applyColour grkdecompressfuzzer.cpp...

OSV-2021-675 Segv on unknown address in lxc_conf_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33551 Crash type: Segv on unknown address Crash state: lxcconffree lxccontainerfree lxccontainerput...