OSV-2020-1759 Index-out-of-bounds in LibRaw::ahd_interpolate_r_and_b_in_rgb_and_convert_to_cielab

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25652 Crash type: Index-out-of-bounds Crash state: LibRaw::ahdinterpolaterandbinrgbandconverttocielab LibRaw::ahdinterpolaterandbandconverttocielab LibRaw::ahdinterpolate...

OSV-2020-1755 Use-of-uninitialized-value in void intra_prediction_angular<unsigned char>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25650 Crash type: Use-of-uninitialized-value Crash state: void intrapredictionangular void decodeintrapredictioninternal decodeintraprediction...

OSV-2020-1752 Heap-buffer-overflow in void mc_chroma<unsigned short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25620 Crash type: Heap-buffer-overflow READ 2 Crash state: void mcchroma generateinterpredictionsamples decodepredictionunit...

OSV-2020-1749 Stack-use-after-return in ucl_include_file_single

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25622 Crash type: Stack-use-after-return READ 6 Crash state: uclincludefilesingle uclincludefile uclincludecommon...

OSV-2020-1748 Use-of-uninitialized-value in transform_4x4_luma_add_8_fallback

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25619 Crash type: Use-of-uninitialized-value Crash state: transform4x4lumaadd8fallback void accelerationfunctions::transform4x4dstadd void transformcoefficients...

OSV-2020-1742 Heap-use-after-free in grk::SOTMarker::read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25602 Crash type: Heap-use-after-free READ 2 Crash state: grk::SOTMarker::read grk::j2kreadsot grk::CodeStream::processmarker...

OSV-2020-1741 Heap-use-after-free in zend_assign_to_variable

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25601 Crash type: Heap-use-after-free READ 1 Crash state: zendassigntovariable zendstdwriteproperty ZENDASSIGNOBJSPECCVCONSTOPDATAVARHANDLER...

OSV-2020-1739 Index-out-of-bounds in tsk_img_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25580 Crash type: Index-out-of-bounds Crash state: tskimgread tskvsreadblock macloadtable...

OSV-2020-1735 Heap-use-after-free in zend_gc_delref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25526 Crash type: Heap-use-after-free READ 4 Crash state: zendgcdelref izvalptrdtor zvalptrdtor...

OSV-2020-1733 Heap-buffer-overflow in le_to_u32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25533 Crash type: Heap-buffer-overflow READ 4 Crash state: letou32 letoi32 bcfdectypedint1safe...

OSV-2020-1730 Bad-cast to RDKit::Atom

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25547 Crash type: Bad-cast Crash state: Bad-cast to RDKit::Atom...

OSV-2020-1729 Use-of-uninitialized-value in ndpi_check_dga_name

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25545 Crash type: Use-of-uninitialized-value Crash state: ndpicheckdganame checkcontenttypeandchangeprotocol ndpicheckhttptcp...

OSV-2020-1727 Heap-buffer-overflow in mbedtls_nist_kw_wrap

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25529 Crash type: Heap-buffer-overflow WRITE 16 Crash state: mbedtlsnistkwwrap mbedtlscipherauthencrypt cryptofuzz::module::mbedTLSdetail::encryptAEAD...

OSV-2020-1726 Heap-use-after-free in xmlXPathNodeSetAdd

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25536 Crash type: Heap-use-after-free READ 4 Crash state: xmlXPathNodeSetAdd xmlXPathGetElementsByIds xmlXPathIdFunction...

OSV-2020-1720 Heap-buffer-overflow in hextoint

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25473 Crash type: Heap-buffer-overflow READ 2 Crash state: hextoint getnamefromEFDatiPersonali itacnsadddatafiles...

OSV-2020-1717 Segv on unknown address in ndpi_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25468 Crash type: Segv on unknown address Crash state: ndpifree ndpifreeflow fuzzprocesspacket.c...

OSV-2020-1715 Stack-buffer-overflow in ndpi_search_kerberos

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25446 Crash type: Stack-buffer-overflow READ 1 Crash state: ndpisearchkerberos checkndpiudpflowfunc ndpicheckflowfunc...

OSV-2020-1712 Use-of-uninitialized-value in gx_color_frac_map

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25463 Crash type: Use-of-uninitialized-value Crash state: gxcolorfracmap pdf14cmaprgbdirect gxremapconcreteDRGB...

OSV-2020-1711 Use-of-uninitialized-value in void transform_idct_add<unsigned char>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25448 Crash type: Use-of-uninitialized-value Crash state: void transformidctadd transform4x4add8fallback void accelerationfunctions::transformadd...

OSV-2020-1702 Heap-buffer-overflow in mem_src_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25388 Crash type: Heap-buffer-overflow READ Crash state: memsrcread srcpeek srceof...

OSV-2020-1700 UNKNOWN READ in zend_gc_delref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25384 Crash type: UNKNOWN READ Crash state: zendgcdelref izvalptrdtor zenduncleanzvalptrdtor...

OSV-2020-1699 Heap-buffer-overflow in rnp_key_store_kbx_from_src

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25386 Crash type: Heap-buffer-overflow READ 1 Crash state: rnpkeystorekbxfromsrc rnploadkeys keyringkbx.c...

OSV-2020-1698 Heap-buffer-overflow in macho_handle_segment

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25385 Crash type: Heap-buffer-overflow READ Crash state: machohandlesegment machoparsefile machoload...

OSV-2020-1695 Stack-buffer-overflow in uWS::TopicTree::trimTree

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25381 Crash type: Stack-buffer-overflow WRITE 8 Crash state: uWS::TopicTree::trimTree uWS::TopicTree::unsubscribeAll TopicTree.cpp...

OSV-2020-1694 Segv on unknown address in std::__1::__tree<std::__1::__value_type<unsigned int, std::__1::pair<std::__1::b

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25376 Crash type: Segv on unknown address Crash state: std::1::treestd::1::valuetypeunsigned int, std::1::pairstd::1::b uWS::TopicTree::drain std::1::function::funcLLVMFuzzerTestOneInput::$1, std::1::allocatorLL...

OSV-2020-1687 Bad-cast to pcpp::Layer from invalid vptr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25340 Crash type: Bad-cast Crash state: Bad-cast to pcpp::Layer from invalid vptr pcpp::IDnsResource::getRawData pcpp::DnsResource::getDataLength...

OSV-2020-1683 UNKNOWN READ in zend_gc_delref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25321 Crash type: UNKNOWN READ Crash state: zendgcdelref zvaldelrefp zvalptrdtornogc...

OSV-2020-1682 Heap-buffer-overflow in void arrow::internal::TransferBitmap<

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25332 Crash type: Heap-buffer-overflow READ 8 Crash state: void arrow::internal::TransferBitmap arrow::ConcatenateBitmaps arrow::ConcatenateImpl::Concatenate...

OSV-2020-1680 Use-of-uninitialized-value in LibRaw::ljpeg_diff

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25291 Crash type: Use-of-uninitialized-value Crash state: LibRaw::ljpegdiff LibRaw::pentaxloadraw LibRaw::unpack...

OSV-2020-1679 Use-of-uninitialized-value in ClampPixel

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25298 Crash type: Use-of-uninitialized-value Crash state: ClampPixel CompositeOverImage CompositeImage...

OSV-2020-1677 Heap-use-after-free in UA_NodeMap_delete

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25245 Crash type: Heap-use-after-free READ 4 Crash state: UANodeMapdelete UAServernew fuzzbinarymessage.cc...

OSV-2020-1676 Heap-buffer-overflow in Op_YCbCr_to_RGB<unsigned char>::convert_colorspace

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25267 Crash type: Heap-buffer-overflow READ Crash state: OpYCbCrtoRGB::convertcolorspace heif::ColorConversionPipeline::convertimage heif::convertcolorspace...

OSV-2020-1671 Heap-buffer-overflow in Dasher::Dasher

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25243 Crash type: Heap-buffer-overflow READ 4 Crash state: Dasher::Dasher bool drawLineAA& QCosmeticStroker::drawPath...

OSV-2020-1668 Memcpy-param-overlap in ot::Message::Write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25226 Crash type: Memcpy-param-overlap Crash state: ot::Message::Write ot::Message::CopyTo ot::Ip6::Ip6::InsertMplOption...

OSV-2020-1667 Heap-use-after-free in xmlTextReaderRead

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25210 Crash type: Heap-use-after-free READ 4 Crash state: xmlTextReaderRead xml.c xmlTextReaderFreeNode...

OSV-2020-1664 Negative-size-param in BaseMemStream<char const>::getChars

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25221 Crash type: Negative-size-param Crash state: BaseMemStream::getChars Stream::doGetChars Stream::fillString...

OSV-2020-1661 Use-of-uninitialized-value in fuzzing::memory::memory_test_msan

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25181 Crash type: Use-of-uninitialized-value Crash state: fuzzing::memory::memorytestmsan cryptofuzz::ExecutorBase::postp cryptofuzz::ExecutorBase::Run...

OSV-2020-1659 Use-of-uninitialized-value in LibRaw::parse_sinar_ia

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25188 Crash type: Use-of-uninitialized-value Crash state: LibRaw::parsesinaria LibRaw::identify LibRaw::opendatastream...

OSV-2020-1656 Heap-buffer-overflow in macho_is_32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25134 Crash type: Heap-buffer-overflow READ 1 Crash state: machois32 machoparsefile machoparsefatfile...

OSV-2020-1655 Heap-buffer-overflow in zmq_z85_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25167 Crash type: Heap-buffer-overflow READ Crash state: zmqz85decode zmq::optionst::setcurvekey zmq::optionst::setsockopt...

OSV-2020-1647 UNKNOWN READ in aiTexture::~aiTexture

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25108 Crash type: UNKNOWN READ Crash state: aiTexture::aiTexture Assimp::MDLImporter::SkipSkinLump3DGSMDL7 Assimp::HMPImporter::ReadFirstSkin...

OSV-2020-1645 Use-of-uninitialized-value in std::__1::char_traits<char>::length

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25076 Crash type: Use-of-uninitialized-value Crash state: std::1::chartraits::length std::1::basicstring, std::1::allocatorch Magick::formatExceptionMessage...

OSV-2020-1644 Segv on unknown address in clang::Sema::PushDeclContext

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25059 Crash type: Segv on unknown address Crash state: clang::Sema::PushDeclContext clang::Sema::ActOnStartDelayedMemberDeclarations clang::Parser::ParseLexedPragmas...

OSV-2020-1643 Heap-use-after-free in UA_NodeMap_delete

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25068 Crash type: Heap-use-after-free READ 4 Crash state: UANodeMapdelete UAServernew fuzzbinarymessage.cc...

OSV-2020-1641 Use-of-uninitialized-value in us_internal_dispatch_ready_poll

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25057 Crash type: Use-of-uninitialized-value Crash state: usinternaldispatchreadypoll uslooprun uWS::TemplatedApp::run...

OSV-2020-1629 Segv on unknown address in wabt::BinaryReader::PrintError

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24992 Crash type: Segv on unknown address Crash state: wabt::BinaryReader::PrintError wabt::BinaryReader::ReadRelocSection wabt::BinaryReader::ReadCustomSection...

OSV-2020-1623 Heap-use-after-free in xmlXIncludeIncludeNode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24925 Crash type: Heap-use-after-free READ 4 Crash state: xmlXIncludeIncludeNode xmlXIncludeDoProcess xmlXIncludeLoadFallback...

OSV-2020-1613 Segv on unknown address in std::__1::deque<std::__1::deque<boost::variant<libetonyek::MoveTo, libetonyek::L

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24858 Crash type: Segv on unknown address Crash state: std::1::dequestd::1::dequeboost::variantlibetonyek::MoveTo, libetonyek::L libetonyek::IWORKPath::appendCCurveTo libetonyek::IWAParser::parsePath...

OSV-2020-1611 Heap-buffer-overflow in yaml_emitter_emit_flow_mapping_key

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24869 Crash type: Heap-buffer-overflow READ 4 Crash state: yamlemitteremitflowmappingkey yamlemitterstatemachine yamlemitteremit...

OSV-2020-1610 Segv on unknown address in Imf_2_5::hufUncompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24854 Crash type: Segv on unknown address Crash state: Imf25::hufUncompress Imf25::DwaCompressor::uncompress Imf25::DwaCompressor::uncompress...