OSV-2021-369 Segv on unknown address in blosc_read_header

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30761 Crash type: Segv on unknown address Crash state: bloscreadheader blosc2getitemctx bloscgetitem...

OSV-2021-367 Heap-buffer-overflow in H5MM_memcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30749 Crash type: Heap-buffer-overflow READ Crash state: H5MMmemcpy H5VMmemcpyvv H5Dcompactreadvv...

OSV-2021-366 Negative-size-param in frame_get_metalayers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30748 Crash type: Negative-size-param Crash state: framegetmetalayers frametoschunk blosc2schunkfrombuffer...

OSV-2021-365 Global-buffer-overflow in llvm_ks::StringRef::find_last_not_of

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30790 Crash type: Global-buffer-overflow READ 1 Crash state: llvmks::StringRef::findlastnotof llvmks::StringRef::rtrim llvmks::StringRef::trim...

OSV-2021-363 Heap-buffer-overflow in H5HG_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30743 Crash type: Heap-buffer-overflow READ 8 Crash state: H5HGread H5VLnativeblobget H5VLblobget...

OSV-2021-362 Heap-use-after-free in DestroyPicBuff

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30770 Crash type: Heap-use-after-free WRITE 4 Crash state: DestroyPicBuff WelsRequestMem SyncPictureResolutionExt...

OSV-2021-361 Stack-buffer-overflow in add_file

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30774 Crash type: Stack-buffer-overflow WRITE Crash state: addfile strfilenamecb handleoption...

OSV-2021-349 Heap-buffer-overflow in flatbuffers::vector_downward::fill

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30684 Crash type: Heap-buffer-overflow WRITE 1 Crash state: flatbuffers::vectordownward::fill flatbuffers::FlatBufferBuilder::PreAlign flatbuffers::FlatBufferBuilder::ForceVectorAlignment...

OSV-2021-347 Heap-buffer-overflow in flatbuffers::Table* flatbuffers::GetMutableRoot<flatbuffers::Table>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30682 Crash type: Heap-buffer-overflow READ 4 Crash state: flatbuffers::Table flatbuffers::GetMutableRoot flatbuffers::Table const flatbuffers::GetRoot flatbuffers::JsonPrinter::GenFieldOffset...

OSV-2021-345 UNKNOWN READ in cpu_arm_exec_arm

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30636 Crash type: UNKNOWN READ Crash state: cpuarmexecarm tcgcpuexecarm tcgexecallarm...

OSV-2021-343 Heap-use-after-free in sctp_sorecvmsg

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30571 Crash type: Heap-use-after-free READ 8 Crash state: sctpsorecvmsg usrsctprecvv handleupcall...

OSV-2020-2308 Heap-buffer-overflow in derive_collocated_motion_vectors

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30568 Crash type: Heap-buffer-overflow READ 1 Crash state: derivecollocatedmotionvectors derivetemporallumavectorprediction filllumamotionvectorpredictors...

OSV-2021-337 Heap-use-after-free in sampled_data_sample

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30715 Crash type: Heap-use-after-free WRITE 4 Crash state: sampleddatasample sampleddatacontinue interp...

OSV-2021-333 Heap-buffer-overflow in int flatbuffers::ReadScalar<int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30699 Crash type: Heap-buffer-overflow READ 4 Crash state: int flatbuffers::ReadScalar flatbuffers::Table::GetVTable flatbuffers::Table::GetOptionalFieldOffset...

OSV-2021-330 Heap-buffer-overflow in bn_sqr_karat_imp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30537 Crash type: Heap-buffer-overflow WRITE 8 Crash state: bnsqrkaratimp bnsqrkarat cryptofuzz::module::relicbignum::Sqr::Run...

OSV-2021-315 Global-buffer-overflow in Gfx::decode_frame

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30507 Crash type: Global-buffer-overflow READ 4 Crash state: Gfx::decodeframe Gfx::GIFImageDecoderPlugin::frame Gfx::GIFImageDecoderPlugin::bitmap...

OSV-2021-312 Heap-use-after-free in sampled_data_continue

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30487 Crash type: Heap-use-after-free WRITE 4 Crash state: sampleddatacontinue gsinterpret gsmainrunstringwithlength...

OSV-2021-308 Heap-buffer-overflow in flatbuffers::JsonPrinter::GenFieldOffset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30468 Crash type: Heap-buffer-overflow READ 4 Crash state: flatbuffers::JsonPrinter::GenFieldOffset flatbuffers::JsonPrinter::GenStruct flatbuffers::GenerateText...

OSV-2021-307 UNKNOWN READ in cpu_arm_exec_armeb

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30444 Crash type: UNKNOWN READ Crash state: cpuarmexecarmeb resumeallvcpusarmeb vmstartarmeb...

OSV-2021-305 Heap-buffer-overflow in rle_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30395 Crash type: Heap-buffer-overflow WRITE Crash state: rledecode ransuncompressto4x16 ransuncompress4x16...

OSV-2021-304 Stack-buffer-overflow in processClientServerHello

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30393 Crash type: Stack-buffer-overflow WRITE 6 Crash state: processClientServerHello processTLSBlock ndpisearchtlstcp...

OSV-2020-2305 UNKNOWN WRITE in tb_flush_armeb

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30391 Crash type: UNKNOWN WRITE Crash state: tbflusharmeb cpuarmexecarmeb tcgcpuexecarmeb...

OSV-2021-298 Heap-buffer-overflow in http_process_user_agent

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30389 Crash type: Heap-buffer-overflow READ Crash state: httpprocessuseragent processchlo ndpisearchquic...

OSV-2021-289 Global-buffer-overflow in vte_write_debug

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30351 Crash type: Global-buffer-overflow READ 1 Crash state: vtewritedebug doaction parsedata...

OSV-2021-288 UNKNOWN READ in wabt::ReadBinary

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30373 Crash type: UNKNOWN READ Crash state: wabt::ReadBinary wabt::ReadBinaryIr wasm2watfuzzer.cc...

OSV-2021-285 Use-of-uninitialized-value in grk::FileFormat::apply_palette_clr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30273 Crash type: Use-of-uninitialized-value Crash state: grk::FileFormat::applypaletteclr grk::FileFormat::decompress grkdecompress...

OSV-2021-284 UNKNOWN READ in _fini

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30296 Crash type: UNKNOWN READ Crash state: fini...

OSV-2021-282 Heap-buffer-overflow in LibRaw_buffer_datastream::read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30324 Crash type: Heap-buffer-overflow WRITE Crash state: LibRawbufferdatastream::read LibRaw::uncompressedfpdngloadraw LibRaw::unpack...

OSV-2021-281 Heap-buffer-overflow in flatbuffers::Table* flatbuffers::GetMutableRoot<flatbuffers::Table>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30289 Crash type: Heap-buffer-overflow READ 4 Crash state: flatbuffers::Table flatbuffers::GetMutableRoot flatbuffers::Table const flatbuffers::GetRoot flatbuffers::JsonPrinter::GenFieldOffset...

OSV-2021-278 Heap-buffer-overflow in H5MM_memcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30250 Crash type: Heap-buffer-overflow READ Crash state: H5MMmemcpy H5VMmemcpyvv H5Dcompactreadvv...

OSV-2021-276 Global-buffer-overflow in mode_sense_page

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30219 Crash type: Global-buffer-overflow READ 4 Crash state: modesensepage scsidiskcheckmodeselect modeselectpages...

OSV-2021-274 Memcpy-param-overlap in frame_get_metalayers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30253 Crash type: Memcpy-param-overlap Crash state: framegetmetalayers blosc2frametoschunk fuzzdecompressframe.c...

OSV-2021-273 Heap-use-after-free in sctp_sorecvmsg

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30215 Crash type: Heap-use-after-free WRITE 4 Crash state: sctpsorecvmsg usrsctprecvv handleupcall...

OSV-2021-271 Heap-buffer-overflow in blosc_run_decompression_with_context

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30193 Crash type: Heap-buffer-overflow READ 1 Crash state: bloscrundecompressionwithcontext blosc2decompress fuzzdecompresschunk.c...

OSV-2021-269 Stack-use-after-return in sta_prop_equal_fn

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30192 Crash type: Stack-use-after-return READ 6 Crash state: stapropequalfn wmemmapinsert dissectieeeNUMBERcommon...

OSV-2021-270 Heap-use-after-free in cil_destroy_block

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30234 Crash type: Heap-use-after-free READ 4 Crash state: cildestroyblock cildestroydata ciltreenodedestroy...

OSV-2021-262 Heap-buffer-overflow in sc_pkcs15emu_oberthur_add_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30112 Crash type: Heap-buffer-overflow READ Crash state: scpkcs15emuoberthuradddata scoberthurparseprivateinfo scpkcs15emuoberthurinit...

OSV-2021-261 Stack-buffer-overflow in flb_sds_cat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30093 Crash type: Stack-buffer-overflow READ Crash state: flbsdscat ratranslatekeymap flbratranslate...

OSV-2021-260 Heap-buffer-overflow in flb_parser_json_do

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30090 Crash type: Heap-buffer-overflow READ Crash state: flbparserjsondo flbparserdo parserfuzzer.c...

OSV-2021-258 Heap-buffer-overflow in unstripe

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30087 Crash type: Heap-buffer-overflow READ 1 Crash state: unstripe arithuncompressto arithdecode...

OSV-2021-257 Stack-buffer-overflow in kdf_sshkdf_set_ctx_params

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30037 Crash type: Stack-buffer-overflow READ 1 Crash state: kdfsshkdfsetctxparams EVPKDFCTXsetparams cryptofuzz::module::OpenSSL::OpKDFSSH...

OSV-2021-251 Heap-buffer-overflow in safe_ltf8_get

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30012 Crash type: Heap-buffer-overflow READ 1 Crash state: safeltf8get cramconstdecodeinit cramdecoderinit...

OSV-2021-247 Heap-buffer-overflow in blosc_getitem

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29976 Crash type: Heap-buffer-overflow READ 1 Crash state: bloscgetitem getcoffset framegetlazychunk...

OSV-2021-246 Memcpy-param-overlap in frame_get_usermeta

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29973 Crash type: Memcpy-param-overlap Crash state: framegetusermeta blosc2frametoschunk blosc2schunkopensframe...

OSV-2021-245 UNKNOWN WRITE in WelsDecodeBs

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29969 Crash type: UNKNOWN WRITE Crash state: WelsDecodeBs WelsDec::CWelsDecoder::DecodeFrame2WithCtx WelsDec::CWelsDecoder::DecodeFrame2...

OSV-2021-242 Heap-buffer-overflow in rans_uncompress_to_4x16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29939 Crash type: Heap-buffer-overflow READ 1 Crash state: ransuncompressto4x16 ransdecode uncompress...

OSV-2021-240 Heap-buffer-overflow in safe_itf8_get

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29908 Crash type: Heap-buffer-overflow READ 1 Crash state: safeitf8get cramdecodecompressionheader cramfirstslice...

OSV-2021-237 Heap-use-after-free in sampled_data_sample

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29903 Crash type: Heap-use-after-free WRITE 4 Crash state: sampleddatasample sampleddatacontinue interp...

OSV-2021-236 Heap-use-after-free in DatasetAdd

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29886 Crash type: Heap-use-after-free READ 4 Crash state: DatasetAdd DetectDatasetBufferMatch DetectEngineContentInspection...

OSV-2021-235 Global-buffer-overflow in QSvgSwitch::draw

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29873 Crash type: Global-buffer-overflow READ 1 Crash state: QSvgSwitch::draw QSvgTinyDocument::draw QSvgTinyDocument::draw...