OSV-2018-71 Heap-use-after-free in parse_odp_action

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10796 Crash type: Heap-use-after-free READ 2 Crash state: parseodpaction odpactionsfromstring parseactions...

OSV-2018-70 Heap-buffer-overflow in learn_check

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11862 Crash type: Heap-buffer-overflow READ 2 Crash state: learncheck ofpactscheck parseofpstr...

OSV-2018-68 Heap-buffer-overflow in read_bits_16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12817 Crash type: Heap-buffer-overflow READ 1 Crash state: readbits16 decodenumber parsetables...

OSV-2018-64 Heap-buffer-overflow in BEInt<unsigned int, 4>::operator unsigned int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11522 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned int void hbsanitizecontextt::setobject::sanitize...

OSV-2018-62 Heap-buffer-overflow in parse_odp_key_mask_attr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11170 Crash type: Heap-buffer-overflow READ 1 Crash state: parseodpkeymaskattr parseodpaction odpactionsfromstring...

OSV-2018-61 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12312 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::OffsetTo...

OSV-2018-56 UNKNOWN READ in OT::propagate_attachment_offsets

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11013 Crash type: UNKNOWN READ Crash state: OT::propagateattachmentoffsets OT::propagateattachmentoffsets OT::GPOS::positionfinishoffsets...

OSV-2018-55 Heap-buffer-overflow in ot::MeshForwarder::GetFramePriority

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11376 Crash type: Heap-buffer-overflow READ 8 Crash state: ot::MeshForwarder::GetFramePriority ot::MeshForwarder::HandleFragment ot::MeshForwarder::HandleReceivedFrame...

OSV-2018-59 Heap-use-after-free in read_uncompressed_header

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10200 Crash type: Heap-use-after-free WRITE 2 Crash state: readuncompressedheader av1decodeframeheadersandsetup aomdecodeframefromobus...

OSV-2018-58 Heap-buffer-overflow in tag_parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10999 Crash type: Heap-buffer-overflow READ 2 Crash state: tagparse gittagparseraw gitobjectfromraw...

OSV-2018-57 Heap-buffer-overflow in read_uncompressed_header

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11523 Crash type: Heap-buffer-overflow READ Crash state: readuncompressedheader av1decodeframeheadersandsetup aomdecodeframefromobus...

OSV-2017-17 Use-of-uninitialized-value in QuickOpen::Seek

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4522 Crash type: Use-of-uninitialized-value Crash state: QuickOpen::Seek Archive::Seek QuickOpen::Load...

OSV-2018-54 UNKNOWN READ in BEInt<short, 2>::operator short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11305 Crash type: UNKNOWN READ Crash state: BEInt::operator short AAT::KerxSubTableFormat1::drivercontextt::transition void AAT::StateTableDriver::EntryDat...

OSV-2017-16 Heap-buffer-overflow in file_strncmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=750 Crash type: Heap-buffer-overflow READ 1 Crash state: filestrncmp magiccheck match...

OSV-2018-50 Heap-use-after-free in UA_Session_deleteMembersCleanup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5577 Crash type: Heap-use-after-free WRITE 8 Crash state: UASessiondeleteMembersCleanup removeSessionCallback UAServerrunshutdown...

OSV-2018-48 Heap-buffer-overflow in PCF_Glyph_Load

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9524 Crash type: Heap-buffer-overflow READ 2 Crash state: PCFGlyphLoad FTLoadGlyph ftfuzzer.cc...

OSV-2018-47 Heap-buffer-overflow in ycc_rgb_convert

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9471 Crash type: Heap-buffer-overflow WRITE 1 Crash state: yccrgbconvert sepupsample processdatacontextmain...

OSV-2021-69 Uncaught exception in fuzz_loader.pkg

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29519 Crash type: Uncaught exception Crash state: fuzzloader.pkg fuzzloader.pkg fuzzloader.pkg...

OSV-2017-14 Use-of-uninitialized-value in Archive::ConvertFileHeader

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4614 Crash type: Use-of-uninitialized-value Crash state: Archive::ConvertFileHeader Archive::ReadHeader15 Archive::ReadHeader...

OSV-2018-46 Heap-buffer-overflow in GDAL_LercNS::RLE::readCount

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9282 Crash type: Heap-buffer-overflow READ 2 Crash state: GDALLercNS::RLE::readCount GDALLercNS::RLE::decompress GDALLercNS::Lerc2::ReadMask...

OSV-2017-13 Heap-buffer-overflow in File::Write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4293 Crash type: Heap-buffer-overflow READ Crash state: File::Write ComprDataIO::UnpWrite CmdExtract::UnstoreFile...

OSV-2018-43 Heap-buffer-overflow in OT::post::accelerator_t::cmp_gids

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11263 Crash type: Heap-buffer-overflow READ Crash state: OT::post::acceleratort::cmpgids sortrcmpswap sortrsimple...

OSV-2018-42 Heap-buffer-overflow in tap_type_find

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8159 Crash type: Heap-buffer-overflow READ 12 Crash state: taptypefind gsttypefindfactorycallfunction gsttypefindhelperfordata...

OSV-2017-10 Heap-use-after-free in UA_Subscription_answerPublishRequestsNoSubscription

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4097 Crash type: Heap-use-after-free READ 8 Crash state: UASubscriptionanswerPublishRequestsNoSubscription UAServerrunshutdown start...

OSV-2018-40 UNKNOWN READ in ftp_disconnect

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12173 Crash type: UNKNOWN READ Crash state: ftpdisconnect Curldisconnect ConnectionExists...

OSV-2018-41 Heap-buffer-overflow in Botan::bigint_monty_redc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6581 Crash type: Heap-buffer-overflow READ 8 Crash state: Botan::bigintmontyredc Botan::CurveGFpMontgomery::curvemul Botan::CurveGFpMontgomery::tocurverep...

OSV-2021-64 Heap-buffer-overflow in H5MM_memcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29500 Crash type: Heap-buffer-overflow READ 4 Crash state: H5MMmemcpy H5Oattrdecode H5Oattrshareddecode...

OSV-2021-60 Heap-buffer-overflow in H5O__sdspace_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29517 Crash type: Heap-buffer-overflow READ 1 Crash state: H5Osdspacedecode H5Osdspaceshareddecode H5Oattrdecode...

OSV-2018-36 UNKNOWN READ in ebml_parse_chunk

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7887 Crash type: UNKNOWN READ Crash state: ebmlparsechunk matroskatypefind gsttypefindfactorycallfunction...

OSV-2018-33 Heap-buffer-overflow in yr_object_set_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14560 Crash type: Heap-buffer-overflow READ Crash state: yrobjectsetstring dotnetparseus dotnetparsecom...

OSV-2017-9 Use-of-uninitialized-value in QuickOpen::Read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4507 Crash type: Use-of-uninitialized-value Crash state: QuickOpen::Read Archive::Read RawRead::Read...

OSV-2018-31 Heap-buffer-overflow in emu_edge_c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11389 Crash type: Heap-buffer-overflow READ 2 Crash state: emuedgec warpaffine dav1dreconbinter8bpc...

OSV-2018-29 Heap-buffer-overflow in r_bin_mdmp_get_mem_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10222 Crash type: Heap-buffer-overflow READ 8 Crash state: rbinmdmpgetmeminfo rbinmdmpgetsrwx sections...

OSV-2018-22 Heap-buffer-overflow in gvs_read_unaligned_le

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9807 Crash type: Heap-buffer-overflow READ 1 Crash state: gvsreadunalignedle gvstupleisnormal gvariantserialisedisnormal...

OSV-2018-26 UNKNOWN READ in BEInt<unsigned char, 1>::operator unsigned char

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11351 Crash type: UNKNOWN READ Crash state: BEInt::operator unsigned char OT::DeviceRecord::serialize OT::hdmx::serialize...

OSV-2018-24 Heap-buffer-overflow in pcf_get_encodings

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9608 Crash type: Heap-buffer-overflow READ 1 Crash state: pcfgetencodings pcfloadfont PCFFaceInit...

OSV-2018-19 Use-of-uninitialized-value in rawspeed::RawImageData::checkMemIsInitialized

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6796 Crash type: Use-of-uninitialized-value Crash state: rawspeed::RawImageData::checkMemIsInitialized rawspeed::RawDecoder::decodeRaw rawspeed::alignedMalloc...

OSV-2017-8 Heap-buffer-overflow in setcharset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4161 Crash type: Heap-buffer-overflow READ 1 Crash state: setcharset loop loop...

OSV-2020-2300 Heap-buffer-overflow in H5MM_strdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29493 Crash type: Heap-buffer-overflow READ Crash state: H5MMstrdup H5Oattrshareddecode H5Omsgiteratereal...

OSV-2018-18 Heap-buffer-overflow in json_parse_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9847 Crash type: Heap-buffer-overflow READ 1 Crash state: jsonparseobject jsonparse fileisjson...

OSV-2018-15 Heap-buffer-overflow in json_parse_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9922 Crash type: Heap-buffer-overflow READ 1 Crash state: jsonparsestring jsonparse jsonparsearray...

OSV-2018-17 Use-of-uninitialized-value in FT_Set_Transform

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8811 Crash type: Use-of-uninitialized-value Crash state: FTSetTransform SplashFTFont::makeGlyph SplashFont::getGlyph...

OSV-2018-13 Use-of-uninitialized-value in bn_sub_words

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8654 Crash type: Use-of-uninitialized-value Crash state: bnsubwords bnreduceonce bnfrommontgomeryinplace...

OSV-2018-12 Heap-double-free in RMFRasterBand::IReadBlock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9138 Crash type: Heap-double-free Crash state: RMFRasterBand::IReadBlock GDALRasterBand::GetLockedBlockRef GDALRasterBand::IRasterIO...

OSV-2021-52 Stack-buffer-overflow in ot::KeyManager::SetMasterKey

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7766 Crash type: Stack-buffer-overflow READ 16 Crash state: ot::KeyManager::SetMasterKey ot::MeshCoP::Dataset::ApplyConfiguration ot::MeshCoP::DatasetManager::Set...

OSV-2018-10 UNKNOWN READ in __msan_memcpy.part.51

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9801 Crash type: UNKNOWN READ Crash state: msanmemcpy.part.51 gvsreadunalignedle gvsvariablesizedarrayisnormal...

OSV-2017-5 Heap-buffer-overflow in opj_dwt_interleave_partial_v

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3115 Crash type: Heap-buffer-overflow READ 4 Crash state: opjdwtinterleavepartialv opjdwtdecodepartialtile opjtcddwtdecode...

OSV-2017-3 Use-of-uninitialized-value in Archive::GetComment

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4610 Crash type: Use-of-uninitialized-value Crash state: Archive::GetComment Archive::ViewComment CmdExtract::ExtractArchive...

OSV-2018-6 Use-of-uninitialized-value in DosSlashToUnix

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9307 Crash type: Use-of-uninitialized-value Crash state: DosSlashToUnix ExtractUnixLink50 ExtractSymlink...

OSV-2017-1 Index-out-of-bounds in fuzz_send_next_response

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3956 Crash type: Index-out-of-bounds Crash state: fuzzsendnextresponse fuzzhandletransfer start...