OSV-2020-2230 Heap-buffer-overflow in _zend_is_inconsistent

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28129 Crash type: Heap-buffer-overflow READ 4 Crash state: zendisinconsistent zendhashfind zendhashfindptr...

OSV-2020-2228 Heap-buffer-overflow in grk::t1_part1::T1Part1::decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28227 Crash type: Heap-buffer-overflow READ Crash state: grk::t1part1::T1Part1::decompress grk::DecompressBlockExec::open grk::T1DecompressScheduler::decompressBlock...

OSV-2020-2227 Heap-buffer-overflow in ieeeNUMBER_fragment_hash

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28191 Crash type: Heap-buffer-overflow READ 6 Crash state: ieeeNUMBERfragmenthash ghashtableinsertinternal fragmentaddseqcommon...

OSV-2020-2223 Heap-use-after-free in e1000e_write_packet_to_guest

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28194 Crash type: Heap-use-after-free READ 8 Crash state: e1000ewritepackettoguest e1000ereceiveiov e1000encreceiveiov...

OSV-2020-2222 Heap-double-free in sc_pkcs15_free_tokeninfo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28185 Crash type: Heap-double-free Crash state: scpkcs15freetokeninfo scpkcs15cardfree fuzzpkcs15reader.c...

OSV-2020-2221 UNKNOWN READ in std::__1::pair<unsigned int, void*> uWS::HttpParser::fenceAndConsumePostPadded<0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28216 Crash type: UNKNOWN READ Crash state: std::1::pair uWS::HttpParser::fenceAndConsumePostPadded0 uWS::HttpParser::consumePostPadded std::1::function::funcLLVMFuzzerTestOneInput::$0, std::1::allocatorLL...

OSV-2020-2220 Heap-buffer-overflow in mk_rconf_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28241 Crash type: Heap-buffer-overflow READ 1 Crash state: mkrconfread mkrconfopen flbparserconffile...

OSV-2020-2217 Heap-buffer-overflow in std::__1::pair<int, void*> uWS::HttpParser::fenceAndConsumePostPadded<0>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28143 Crash type: Heap-buffer-overflow READ Crash state: std::1::pair uWS::HttpParser::fenceAndConsumePostPadded uWS::HttpParser::consumePostPadded uWS::HttpContext::init...

OSV-2020-2216 Heap-buffer-overflow in ojph::local::ojph_decode_codeblock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28103 Crash type: Heap-buffer-overflow WRITE 4 Crash state: ojph::local::ojphdecodecodeblock grk::t1ht::T1HT::decompress grk::DecompressBlockExec::open...

OSV-2020-2212 Heap-buffer-overflow in ih264d_fill_bs1_16x16mb_pslice

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28039 Crash type: Heap-buffer-overflow READ 8 Crash state: ih264dfillbs116x16mbpslice ih264dcomputebsnonmbaffthread ih264drecondeblkslice...

OSV-2020-2206 Segv on unknown address in ndpi_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27988 Crash type: Segv on unknown address Crash state: ndpifree ndpifreeflow fuzzprocesspacket.c...

OSV-2020-2205 Heap-buffer-overflow in ojph::local::ojph_decode_codeblock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27924 Crash type: Heap-buffer-overflow WRITE 4 Crash state: ojph::local::ojphdecodecodeblock grk::t1ht::T1HT::decompress grk::DecompressBlockExec::open...

OSV-2020-2201 Heap-buffer-overflow in String::append

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27912 Crash type: Heap-buffer-overflow READ 3 Crash state: String::append appendidentifier Itemfuncgetuservar::print...

OSV-2020-2200 Global-buffer-overflow in draco::MeshEdgebreakerDecoderImpl<draco::MeshEdgebreakerTraversalValenceDecoder>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27950 Crash type: Global-buffer-overflow READ 4 Crash state: draco::MeshEdgebreakerDecoderImpl draco::MeshEdgebreakerDecoderImpl draco::MeshDecoder::DecodeGeometryData...

OSV-2020-2197 Heap-use-after-free in decode_NXAST_RAW_ENCAP

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27851 Crash type: Heap-use-after-free WRITE 2 Crash state: decodeNXASTRAWENCAP ofpactdecode ofpactsdecode...

OSV-2020-2193 Heap-buffer-overflow in sctp_process_init

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27900 Crash type: Heap-buffer-overflow READ 8 Crash state: sctpprocessinit sctpprocesscontrol sctpcommoninputprocessing...

OSV-2020-2192 Heap-buffer-overflow in decompress_smooth_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27852 Crash type: Heap-buffer-overflow READ 2 Crash state: decompresssmoothdata processdatacontextmain jpegreadscanlines...

OSV-2020-2190 Heap-buffer-overflow in my_ismbchar_utf8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27813 Crash type: Heap-buffer-overflow READ 2 Crash state: myismbcharutf8 checkcolumnname getvariable...

OSV-2020-2188 Heap-buffer-overflow in ih264d_parse_pslice

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27856 Crash type: Heap-buffer-overflow WRITE Crash state: ih264dparsepslice ih264dparsedecodeslice ih264dparsenalunit...

OSV-2020-2184 Heap-buffer-overflow in frame_get_usermeta

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27812 Crash type: Heap-buffer-overflow READ Crash state: framegetusermeta blosc2frametoschunk blosc2schunkopensframe...

OSV-2020-2183 Heap-buffer-overflow in Lizard_decompress_safe

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27818 Crash type: Heap-buffer-overflow READ 2 Crash state: Lizarddecompresssafe bloscd dojob...

OSV-2020-2180 UNKNOWN READ in helper_be_stl_mmu_armeb

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27736 Crash type: UNKNOWN READ Crash state: helperbestlmmuarmeb stack...

OSV-2020-2179 Heap-buffer-overflow in arrow::internal::ValidateUTF8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27731 Crash type: Heap-buffer-overflow READ 8 Crash state: arrow::internal::ValidateUTF8 arrow::internal::ValidateArrayFullImpl::ValidateWithType arrow::internal::ValidateArrayFullImpl::Visit...

OSV-2020-2178 Stack-buffer-overflow in insert_key

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27719 Crash type: Stack-buffer-overflow READ 1 Crash state: insertkey detectnetkey scpkcs15emutcosinitex...

OSV-2020-2171 Stack-buffer-overflow in fp_read_unsigned_bin

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27666 Crash type: Stack-buffer-overflow READ 8 Crash state: fpreadunsignedbin mpreadunsignedbin wcRsaPublicKeyDecodeRaw...

OSV-2020-2168 Heap-buffer-overflow in H5D__scatter_mem

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27625 Crash type: Heap-buffer-overflow WRITE Crash state: H5Dscattermem H5Dscatgathread H5Dcontigread...

OSV-2020-2167 Heap-buffer-overflow in ojph::local::ojph_decode_codeblock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27533 Crash type: Heap-buffer-overflow WRITE 4 Crash state: ojph::local::ojphdecodecodeblock grk::t1ht::T1HT::decompress grk::DecompressBlockExec::open...

OSV-2020-2166 Heap-buffer-overflow in get_32aligned_be64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27524 Crash type: Heap-buffer-overflow READ 4 Crash state: get32alignedbe64 nlattrgetbe64 formatodptunattr...

OSV-2020-2165 Use-of-uninitialized-value in isSameGfxColor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27523 Crash type: Use-of-uninitialized-value Crash state: isSameGfxColor Gfx::doAxialShFill Gfx::opShFill...

OSV-2020-2161 Heap-buffer-overflow in msix_vector_masked

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27418 Crash type: Heap-buffer-overflow READ 1 Crash state: msixvectormasked msixismasked msixtablemmiowrite...

OSV-2020-2159 Heap-buffer-overflow in flb_parser_json_do

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27499 Crash type: Heap-buffer-overflow READ Crash state: flbparserjsondo flbparserdo parserfuzzer.c...

OSV-2020-2158 Global-buffer-overflow in arrow::Status arrow::internal::ValidateArrayFullImpl::ValidateListLike<arrow::Li

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27475 Crash type: Global-buffer-overflow READ 4 Crash state: arrow::Status arrow::internal::ValidateArrayFullImpl::ValidateListLikearrow::Li arrow::internal::ValidateArrayFullImpl::ValidateWithType...

OSV-2020-2157 Stack-buffer-overflow in insert_key

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27480 Crash type: Stack-buffer-overflow READ 1 Crash state: insertkey detectnetkey scpkcs15emutcosinitex...

OSV-2020-2155 Heap-buffer-overflow in wolfSSH_CleanPath

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27436 Crash type: Heap-buffer-overflow READ 16 Crash state: wolfSSHCleanPath ParseScpCommand DoScpRequest...

OSV-2020-2154 Heap-buffer-overflow in void arrow::internal::TransferBitmap<

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27474 Crash type: Heap-buffer-overflow READ 8 Crash state: void arrow::internal::TransferBitmap arrow::ConcatenateBitmaps arrow::ConcatenateImpl::Concatenate...

OSV-2020-2151 Use-of-uninitialized-value in tinfl_decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27413 Crash type: Use-of-uninitialized-value Crash state: tinfldecompress mzinflate mzuncompress2...

OSV-2020-2148 Heap-buffer-overflow in flb_gzip_compress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27368 Crash type: Heap-buffer-overflow WRITE 1 Crash state: flbgzipcompress utilsfuzzer.c...

OSV-2020-2147 Use-of-uninitialized-value in stringNew

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27348 Crash type: Use-of-uninitialized-value Crash state: stringNew stringReplace pixSetText...

OSV-2020-2144 Heap-buffer-overflow in wolfSSH_accept

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27298 Crash type: Heap-buffer-overflow READ 5 Crash state: wolfSSHaccept server.c...

OSV-2020-2143 UNKNOWN READ in __dynamic_cast

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27315 Crash type: UNKNOWN READ Crash state: dynamiccast HandleDynamicTypeCacheMiss RDKit::SubstanceGroup::addAtomWithBookmark...

OSV-2020-2141 Use-of-uninitialized-value in WelsDec::WelsDeblockingMb

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27306 Crash type: Use-of-uninitialized-value Crash state: WelsDec::WelsDeblockingMb WelsDec::WelsDeblockingFilterSlice WelsDec::WelsTargetSliceConstruction...

OSV-2020-2140 Heap-double-free in flb_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27279 Crash type: Heap-double-free Crash state: flbfree flbhttpclientdestroy flbhttpclient...

OSV-2020-2138 Use-of-uninitialized-value in Mat_VarReadNextInfo5

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27258 Crash type: Use-of-uninitialized-value Crash state: MatVarReadNextInfo5 MatVarReadNextInfo MatGetDir...

OSV-2020-2139 Heap-double-free in flb_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27025 Crash type: Heap-double-free Crash state: flbfree flbsdsdestroy flbkvitemdestroy...

OSV-2020-2136 UNKNOWN READ in flb_sds_cat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27234 Crash type: UNKNOWN READ Crash state: flbsdscat ratranslatetag flbratranslate...

OSV-2020-2135 Heap-buffer-overflow in _flb_strptime

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27241 Crash type: Heap-buffer-overflow READ 1 Crash state: flbstrptime flbstrptime strpfuzzer.c...

OSV-2020-2134 UNKNOWN READ in wpabuf_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27269 Crash type: UNKNOWN READ Crash state: wpabuffree p2pdevicefree p2pflush...

OSV-2020-2133 Heap-buffer-overflow in tdefl_compress_lz_codes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27263 Crash type: Heap-buffer-overflow WRITE 8 Crash state: tdeflcompresslzcodes tdeflcompressblock tdeflflushblock...

OSV-2020-2132 Heap-buffer-overflow in flb_gzip_compress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27261 Crash type: Heap-buffer-overflow WRITE 1 Crash state: flbgzipcompress utilsfuzzer.c...

OSV-2020-2131 Stack-use-after-return in solidity::smtutil::CHCSmtLib2Interface::querySolver

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26997 Crash type: Stack-use-after-return READ 8 Crash state: solidity::smtutil::CHCSmtLib2Interface::querySolver solidity::smtutil::CHCSmtLib2Interface::query solidity::frontend::CHC::query...