OSV-2021-671 Heap-buffer-overflow in av1_cdef_init_fb_row_mt

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33511 Crash type: Heap-buffer-overflow READ 8 Crash state: av1cdefinitfbrowmt av1cdeffbrow cdefsbrowworkerhook...

OSV-2021-670 Heap-buffer-overflow in av1_free_cdef_buffers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33480 Crash type: Heap-buffer-overflow READ 8 Crash state: av1freecdefbuffers decoderdestroy aomcodecdestroy...

OSV-2021-669 Heap-buffer-overflow in _estrdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33495 Crash type: Heap-buffer-overflow READ Crash state: estrdup exifprocessusercomment exifprocessIFDTAGimpl...

OSV-2021-668 Stack-use-after-return in pdf14_initialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33529 Crash type: Stack-use-after-return WRITE 8 Crash state: pdf14initialize pdf14procsinitialize pdf14RGBinitialize...

OSV-2021-667 Heap-buffer-overflow in _estrdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33445 Crash type: Heap-buffer-overflow READ 12 Crash state: estrdup exifprocessusercomment exifprocessIFDTAGimpl...

OSV-2021-665 UNKNOWN READ in QOutlineMapper::convertPath

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33438 Crash type: UNKNOWN READ Crash state: QOutlineMapper::convertPath QRasterPaintEngine::fill QPaintEngineEx::stroke...

OSV-2021-664 Heap-use-after-free in module_check_cast

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33444 Crash type: Heap-use-after-free READ 4 Crash state: modulecheckcast serverconnectunref serverunref...

OSV-2021-660 UNKNOWN READ in op_BranchIfPrologue_s

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33397 Crash type: UNKNOWN READ Crash state: opBranchIfPrologues m3CallVL m3CallV...

OSV-2021-658 UNKNOWN WRITE in qpaintengineex_lineTo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33364 Crash type: UNKNOWN WRITE Crash state: qpaintengineexlineTo QStroker::joinPoints bool qtstrokeside...

OSV-2021-654 Heap-buffer-overflow in decode_mcu_fast

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33340 Crash type: Heap-buffer-overflow READ 1 Crash state: decodemcufast decodemcu consumedata...

OSV-2021-652 Heap-use-after-free in ZSTD_freeDDict

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33324 Crash type: Heap-use-after-free READ 4 Crash state: ZSTDfreeDDict blosc2freectx blosc2schunkfree...

OSV-2021-651 Heap-use-after-free in zend_gc_delref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33335 Crash type: Heap-use-after-free READ 4 Crash state: zendgcdelref zvaldelrefp zvalptrdtornogc...

OSV-2021-646 Heap-use-after-free in std::__1::__tree_iterator<std::__1::__value_type<std::__1::basic_string<char, st

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33315 Crash type: Heap-use-after-free READ 8 Crash state: std::1::treeiteratorstd::1::valuetypestd::1::basicstringchar, st draco::Metadata::AddSubMetadata draco::MetadataDecoder::DecodeMetadata...

OSV-2021-644 UNKNOWN READ in blosc_d

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33292 Crash type: UNKNOWN READ Crash state: bloscd dojob bloscrundecompressionwithcontext...

OSV-2021-642 Heap-buffer-overflow in op_Const64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33318 Crash type: Heap-buffer-overflow WRITE 8 Crash state: opConst64 EvaluateExpression InitElements...

OSV-2021-640 Heap-buffer-overflow in frame_get_metalayers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33251 Crash type: Heap-buffer-overflow READ 6 Crash state: framegetmetalayers frametoschunk blosc2schunkfrombuffer...

OSV-2021-639 Heap-buffer-overflow in blosc_d

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33264 Crash type: Heap-buffer-overflow READ Crash state: bloscd bloscgetitem blosc2getitemctx...

OSV-2021-635 Heap-use-after-free in std::__1::__tree_iterator<std::__1::__value_type<std::__1::basic_string<char, st

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33227 Crash type: Heap-use-after-free READ 8 Crash state: std::1::treeiteratorstd::1::valuetypestd::1::basicstringchar, st void draco::Metadata::AddEntrystd::1::vectorunsigned char, std::1::allocat...

OSV-2021-631 Heap-buffer-overflow in ih264d_decode_slice_thread

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33167 Crash type: Heap-buffer-overflow READ 4 Crash state: ih264ddecodeslicethread ih264ddecodepicturethread clone...

OSV-2021-624 Heap-buffer-overflow in load_u32_be

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33039 Crash type: Heap-buffer-overflow READ 1 Crash state: loadu32be osslsm4setkey cipherhwsm4initkey...

OSV-2021-623 Null-dereference READ

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33052 Crash type: Null-dereference READ Crash state: NULL...

OSV-2021-622 Heap-buffer-overflow in frame_get_vlmetalayers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33071 Crash type: Heap-buffer-overflow READ Crash state: framegetvlmetalayers frametoschunk blosc2schunkfrombuffer...

OSV-2021-620 Segv on unknown address in dwg_free_summaryinfo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33059 Crash type: Segv on unknown address Crash state: dwgfreesummaryinfo dwgfree llvmfuzz.c...

OSV-2021-619 UNKNOWN READ in helper_uc_tracecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33017 Crash type: UNKNOWN READ Crash state: helpeructracecode...

OSV-2021-618 Heap-buffer-overflow in OT::AnchorFormat1* hb_serialize_context_t::embed<OT::AnchorFormat1>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33031 Crash type: Heap-buffer-overflow READ 6 Crash state: OT::AnchorFormat1 hbserializecontextt::embed OT::AnchorFormat1::copy OT::Anchor::subset...

OSV-2021-617 Stack-use-after-return in v9fs_setattr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32995 Crash type: Stack-use-after-return READ 4 Crash state: v9fssetattr coroutinetrampoline...

OSV-2021-616 Heap-buffer-overflow in Camellia_Ekeygen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33028 Crash type: Heap-buffer-overflow READ 1 Crash state: CamelliaEkeygen Camelliasetkey cipherhwcamelliainitkey...

OSV-2021-615 Use-of-uninitialized-value in DES_set_key_unchecked

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33023 Crash type: Use-of-uninitialized-value Crash state: DESsetkeyunchecked osslcipherhwtdesede3initkey tdesinit...

OSV-2021-614 Heap-buffer-overflow in ossl_aria_set_encrypt_key

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33022 Crash type: Heap-buffer-overflow READ 1 Crash state: osslariasetencryptkey cipherhwariainitkey ciphergenericinitinternal...

OSV-2021-609 Heap-buffer-overflow in get_word_rgb_row

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32964 Crash type: Heap-buffer-overflow WRITE 1 Crash state: getwordrgbrow tjLoadImage compress.cc...

OSV-2021-607 Heap-buffer-overflow in TextPool::getPool

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32952 Crash type: Heap-buffer-overflow READ 8 Crash state: TextPool::getPool TextPage::coalesce TextOutputDev::endPage...

OSV-2021-602 Heap-buffer-overflow in read_paint

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32913 Crash type: Heap-buffer-overflow READ 1 Crash state: readpaint ttfacegetpaint FTGetPaint...

OSV-2021-600 Heap-buffer-overflow in gif_internal_decode_frame

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32855 Crash type: Heap-buffer-overflow WRITE Crash state: gifinternaldecodeframe gifdecodeframe vipsforeignloadnsgifgenerate...

OSV-2021-597 Stack-buffer-overflow in read_mft_common

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32837 Crash type: Stack-buffer-overflow WRITE 1 Crash state: readmftcommon bool readtagmft1 readb2a...

OSV-2021-594 Global-buffer-overflow in read_coding_unit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32791 Crash type: Global-buffer-overflow READ 1 Crash state: readcodingunit readcodingquadtree readcodingquadtree...

OSV-2021-593 Heap-use-after-free in std::__1::vector<char, std::__1::allocator<char> >::size

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32822 Crash type: Heap-use-after-free READ 8 Crash state: std::1::vector ::size std::1::vector ::resize Assimp::TXmlParser::clear...

OSV-2021-591 Segv on unknown address

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32767 Crash type: Segv on unknown address Crash state: NULL...

OSV-2021-586 Use-of-uninitialized-value in void intra_prediction_angular<unsigned short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32682 Crash type: Use-of-uninitialized-value Crash state: void intrapredictionangular void decodeintrapredictioninternal decodeintraprediction...

OSV-2021-585 Heap-buffer-overflow in ebitmap_match_any

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32675 Crash type: Heap-buffer-overflow READ 8 Crash state: ebitmapmatchany avtabmap cilcheckneverallow...

OSV-2021-581 UNKNOWN READ in unsigned short flatbuffers::ReadScalar<unsigned short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32647 Crash type: UNKNOWN READ Crash state: unsigned short flatbuffers::ReadScalar flatbuffers::Table::GetOptionalFieldOffset flatbuffers::Table::CheckField...

OSV-2021-578 Stack-use-after-return in v9fs_string_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32624 Crash type: Stack-use-after-return READ 8 Crash state: v9fsstringfree v9fsxattrwalk coroutinetrampoline...

OSV-2019-1 ASSERT: bufferRemainingSize() >= length.

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18431 Crash type: ASSERT Crash state: bufferRemainingSize = length. Envoy::Http::Http1::ConnectionImpl::copyToBuffer Envoy::Http::Http1::RequestStreamEncoderImpl::encodeHeaders...

OSV-2021-577 Segv on unknown address in dwg_free_MTEXTATTRIBUTEOBJECTCONTEXTDATA_private

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32604 Crash type: Segv on unknown address Crash state: dwgfreeMTEXTATTRIBUTEOBJECTCONTEXTDATAprivate dwgfreeMTEXTATTRIBUTEOBJECTCONTEXTDATA dwgfreevariablenoclass...

OSV-2021-573 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32555 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::RangeRecord::intersects...

OSV-2021-572 Global-buffer-overflow in mode_sense_page

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32538 Crash type: Global-buffer-overflow READ 4 Crash state: modesensepage scsidiskcheckmodeselect modeselectpages...

OSV-2021-570 Uncaught exception in com.fasterxml.jackson.databind.deser.std.BaseNodeDeserializer.deserializeObject

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32554 Crash type: Uncaught exception Crash state: com.fasterxml.jackson.databind.deser.std.BaseNodeDeserializer.deserializeObject java.base/java.lang.invoke.MethodHandleNatives.refKindIsField...

OSV-2021-564 Uncaught exception in com.fasterxml.jackson.databind.deser.std.BaseNodeDeserializer.deserializeArray

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32514 Crash type: Uncaught exception Crash state: com.fasterxml.jackson.databind.deser.std.BaseNodeDeserializer.deserializeArray java.base/java.lang.Module.isStaticallyExportedOrOpen...

OSV-2021-563 Heap-use-after-free in AK::NonnullOwnPtr<JS::IndexedPropertyStorage>::operator->

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32459 Crash type: Heap-use-after-free READ 8 Crash state: AK::NonnullOwnPtr::operator- JS::IndexedProperties::arraylikesize JS::IndexedProperties::append...

OSV-2021-562 Segv on unknown address in GC_generic_malloc_many

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32453 Crash type: Segv on unknown address Crash state: GCgenericmallocmany GCmallocatomic Strnewsize...

OSV-2021-561 UNKNOWN WRITE in wuffs_base__pixel_swizzler__bgr__bgra_premul__src

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32451 Crash type: UNKNOWN WRITE Crash state: wuffsbasepixelswizzlerbgrbgrapremulsrc wuffsbasepixelswizzlerswizzleinterleavedfromslice fuzz...