OSV-2021-455 Heap-use-after-free in zend_hash_iterator_pos_ex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31423 Crash type: Heap-use-after-free READ 1 Crash state: zendhashiteratorposex ZENDFEFETCHRWSPECVARHANDLER fuzzerexecuteex...

OSV-2021-454 Heap-buffer-overflow in irc_parse_message_tags

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31443 Crash type: Heap-buffer-overflow READ 8 Crash state: ircparsemessagetags ircservereventtags signalemitreal...

OSV-2021-453 UNKNOWN WRITE in std::__1::pair<unsigned int, void*> uWS::HttpParser::fenceAndConsumePostPadded<0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31457 Crash type: UNKNOWN WRITE Crash state: std::1::pair uWS::HttpParser::fenceAndConsumePostPadded0 uWS::HttpParser::consumePostPadded std::1::function::funcLLVMFuzzerTestOneInput::$0, std::1::allocatorLL...

OSV-2021-451 Heap-buffer-overflow in void apply_sao_internal<unsigned short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31485 Crash type: Heap-buffer-overflow READ 1 Crash state: void applysaointernal void applysao threadtasksao::work...

OSV-2021-450 Global-buffer-overflow in coap_pdu_parse_opt

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31479 Crash type: Global-buffer-overflow WRITE 1 Crash state: coappduparseopt coappduparse...

OSV-2021-449 UNKNOWN READ in std::pair<absl::lts_NUMBER_02_25::container_internal::raw_hash_set<absl::lts_NUM

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31393 Crash type: UNKNOWN READ Crash state: std::pair::Compute tensorflow::KernelAndDeviceOp::Run...

OSV-2021-448 Use-of-uninitialized-value in std::__1::__packaged_task_func<std::__1::__bind<grk::mct::decompress_irrev

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31365 Crash type: Use-of-uninitialized-value Crash state: std::1::packagedtaskfuncstd::1::bindgrk::mct::decompressirrev std::1::packagedtaskint ThreadPool::ThreadPool...

OSV-2021-447 Heap-buffer-overflow in luaG_runerror

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31331 Crash type: Heap-buffer-overflow READ 8 Crash state: luaGrunerror luaDpretailcall luaVexecute...

OSV-2020-2309 UNKNOWN WRITE in flb_utils_proxy_url_split

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31306 Crash type: UNKNOWN WRITE Crash state: flbutilsproxyurlsplit utilsfuzzer.c...

OSV-2021-446 Global-buffer-overflow in AK::StringView::operator==

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31351 Crash type: Global-buffer-overflow READ 1 Crash state: AK::StringView::operator== Markdown::CodeBlock::parse bool Markdown::helper...

OSV-2021-445 Global-buffer-overflow in AK::StringView::operator==

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31338 Crash type: Global-buffer-overflow READ 1 Crash state: AK::StringView::operator== = Markdown::Table::parse...

OSV-2021-443 Segv on unknown address in Imf_2_5::copyIntoFrameBuffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31293 Crash type: Segv on unknown address Crash state: Imf25::copyIntoFrameBuffer Imf25::LineBufferTask::execute IlmThread::NullThreadPoolProvider::addTask...

OSV-2021-442 Heap-buffer-overflow in fnv_32a_buf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31301 Crash type: Heap-buffer-overflow READ 1 Crash state: fnv32abuf fonthash asscacheget...

OSV-2021-441 UNKNOWN WRITE in sudoers_lookup_check

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31250 Crash type: UNKNOWN WRITE Crash state: sudoerslookupcheck sudoerslookup fuzzsudoers.c...

OSV-2021-440 Heap-buffer-overflow in H5MM_memcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31265 Crash type: Heap-buffer-overflow WRITE 4 Crash state: H5MMmemcpy H5MMmalloc H5Cloadentry...

OSV-2021-439 UNKNOWN READ in blosc_d

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31241 Crash type: UNKNOWN READ Crash state: bloscd dojob bloscrundecompressionwithcontext...

OSV-2021-437 Heap-use-after-free in ofats::any_detail::handler_traits<void>::handler_base<ofats::any_detail::handler

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31209 Crash type: Heap-use-after-free WRITE 8 Crash state: ofats::anydetail::handlertraits::handlerbaseofats::anydetail::handler uWS::Loop::wakeupCb usinternaldispatchreadypoll...

OSV-2021-435 Stack-buffer-overflow in ot::Cli::Interpreter::OutputFormatV

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31232 Crash type: Stack-buffer-overflow READ Crash state: ot::Cli::Interpreter::OutputFormatV ot::Cli::Interpreter::OutputLine ot::Cli::Interpreter::HandleDnsServiceResponse...

OSV-2021-430 Stack-buffer-overflow in tvb_memcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31198 Crash type: Stack-buffer-overflow WRITE Crash state: tvbmemcpy compositememcpy tvbgetnstringz...

OSV-2021-429 Heap-buffer-overflow in blosc_d

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31170 Crash type: Heap-buffer-overflow READ 4 Crash state: bloscd bloscgetitem blosc2getitemctx...

OSV-2021-428 Heap-buffer-overflow in frame_get_lazychunk

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31189 Crash type: Heap-buffer-overflow READ 4 Crash state: framegetlazychunk framedecompresschunk blosc2schunkdecompresschunk...

OSV-2021-427 Heap-buffer-overflow in LibRaw::kodak_c330_load_raw

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31181 Crash type: Heap-buffer-overflow READ 1 Crash state: LibRaw::kodakc330loadraw LibRaw::unpack librawfuzzer.cc...

OSV-2021-426 Use-of-uninitialized-value in std::__1::__packaged_task_func<std::__1::__bind<grk::mct::decompress_irrev

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31180 Crash type: Use-of-uninitialized-value Crash state: std::1::packagedtaskfuncstd::1::bindgrk::mct::decompressirrev std::1::packagedtaskint ThreadPool::ThreadPool...

OSV-2021-423 Heap-buffer-overflow in dissect_vjc_uncomp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31121 Crash type: Heap-buffer-overflow READ 1 Crash state: dissectvjcuncomp calldissectorwork dissectortryuint...

OSV-2021-422 Heap-use-after-free in frame_get_lazychunk

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31120 Crash type: Heap-use-after-free READ 4 Crash state: framegetlazychunk framedecompresschunk blosc2schunkdecompresschunk...

OSV-2021-421 Heap-use-after-free in __cil_verify_classperms

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31124 Crash type: Heap-use-after-free READ 8 Crash state: cilverifyclassperms verifymappermclassperms hashtabmap...

OSV-2021-419 Heap-buffer-overflow in input_osc_parse_colour

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31106 Crash type: Heap-buffer-overflow READ 1 Crash state: inputoscparsecolour inputosc11 inputexitosc...

OSV-2021-418 Heap-double-free in mfree

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31055 Crash type: Heap-double-free Crash state: mfree parsepathargument systemctlparseargv...

OSV-2021-417 Heap-use-after-free in __cil_verify_classperms

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31065 Crash type: Heap-use-after-free READ 8 Crash state: cilverifyclassperms cilverifyclasspermission cilpreverifyhelper...

OSV-2021-414 Heap-use-after-free in us_socket_close

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31047 Crash type: Heap-use-after-free READ 8 Crash state: ussocketclose wrapepollwait uslooprun...

OSV-2021-413 UNKNOWN WRITE in sudo_user_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31042 Crash type: UNKNOWN WRITE Crash state: sudouserfree sudoerspolicyclose fuzzpolicy.c...

OSV-2021-411 UNKNOWN READ in ot::Cli::Interpreter::OutputFormatV

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31002 Crash type: UNKNOWN READ Crash state: ot::Cli::Interpreter::OutputFormatV ot::Cli::Interpreter::OutputLine ot::Cli::SrpServer::ProcessDomain...

OSV-2021-404 Segv on unknown address in blosc_read_header

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30974 Crash type: Segv on unknown address Crash state: bloscreadheader blosc2getitemctx bloscgetitem...

OSV-2021-401 Segv on unknown address in us_internal_dispatch_ready_poll

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30951 Crash type: Segv on unknown address Crash state: usinternaldispatchreadypoll uslooprun test...

OSV-2021-399 Heap-buffer-overflow in void AK::__format_value<unsigned char>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30914 Crash type: Heap-buffer-overflow READ 1 Crash state: void AK::formatvalue AK::vformatimpl AK::vformatimpl...

OSV-2021-398 Segv on unknown address in llvm_ks::StringRef::operator

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30932 Crash type: Segv on unknown address Crash state: llvmks::StringRef::operator llvmks::HashString llvmks::StringMapImpl::LookupBucketFor...

OSV-2021-397 Heap-buffer-overflow in Crypto::UnsignedBigInteger::UnsignedBigInteger

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30920 Crash type: Heap-buffer-overflow READ 1 Crash state: Crypto::UnsignedBigInteger::UnsignedBigInteger Crypto::UnsignedBigInteger::importdata Crypto::derdecodeinteger...

OSV-2021-396 Heap-buffer-overflow in OT::OffsetTo<OT::Anchor, OT::IntType<unsigned short, 2u>, true>* hb_serialize_co

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30908 Crash type: Heap-buffer-overflow READ 2 Crash state: OT::OffsetTo, true hbserializeco OT::OffsetTo, true hbserializeco bool OT::AnchorMatrix::serializehbfilteriterthbrangeitertunsigned int,...

OSV-2021-395 Heap-buffer-overflow in Crypto::der_decode_integer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30907 Crash type: Heap-buffer-overflow READ 1 Crash state: Crypto::derdecodeinteger Crypto::derdecodesequence Crypto::derdecodesequencemany::operator bool...

OSV-2021-394 Heap-buffer-overflow in Crypto::der_decode_sequence

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30906 Crash type: Heap-buffer-overflow READ 1 Crash state: Crypto::derdecodesequence Crypto::PK::RSA::parsersakey FuzzRSAKeyParsing.cpp...

OSV-2021-392 Heap-buffer-overflow in heredoc_remove_indent

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30886 Crash type: Heap-buffer-overflow READ Crash state: heredocremoveindent parsestring parseryylex...

OSV-2021-389 Bad-cast to tt_cmap_t' (aka 'struct _tt_cmap')_cairo_truetype_index_to_ucs4

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30823 Crash type: Bad-cast Crash state: Bad-cast to ttcmapt' aka 'struct ttcmap'cairotruetypeindextoucs4 cairosubfontglyphlookupunicode cairosubfontmapglyph...

OSV-2021-386 Stack-buffer-overflow in ot::Coap::Message::AppendUintOption

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30831 Crash type: Stack-buffer-overflow READ 1 Crash state: ot::Coap::Message::AppendUintOption ot::Coap::Message::AppendBlockOption otCoapMessageAppendBlock2Option...

OSV-2021-385 Heap-buffer-overflow in grk::BitIO::bytein

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30863 Crash type: Heap-buffer-overflow READ 1 Crash state: grk::BitIO::bytein grk::BitIO::read grk::T2Decompress::readpacketheader...

OSV-2021-383 Heap-buffer-overflow in des_ede3_wrap

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30847 Crash type: Heap-buffer-overflow WRITE 8 Crash state: desede3wrap tdeswrapcipherinternal tdeswrapcipher...

OSV-2021-382 Heap-buffer-overflow in frame_get_vlmetalayers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30868 Crash type: Heap-buffer-overflow READ 1 Crash state: framegetvlmetalayers frametoschunk blosc2schunkfrombuffer...

OSV-2021-380 Heap-buffer-overflow in ih264d_fill_bs1_16x16mb_pslice

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30801 Crash type: Heap-buffer-overflow READ 8 Crash state: ih264dfillbs116x16mbpslice ih264dcomputebsnonmbaffthread ih264drecondeblkslice...

OSV-2021-374 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30817 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::AnchorMatrix::subset...

OSV-2021-373 Global-buffer-overflow in wabt::GetRelocTypeName

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30792 Crash type: Global-buffer-overflow READ 8 Crash state: wabt::GetRelocTypeName wabt::BinaryReader::ReadRelocSection wabt::BinaryReader::ReadCustomSection...

OSV-2021-371 Heap-buffer-overflow in frame_get_lazychunk

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30772 Crash type: Heap-buffer-overflow READ 4 Crash state: framegetlazychunk framedecompresschunk blosc2schunkdecompresschunk...