OSV-2020-1609 Heap-buffer-overflow in fdisk_partname

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24859 Crash type: Heap-buffer-overflow READ 1 Crash state: fdiskpartname writefilesfdisk fdiskscriptwritefile...

OSV-2020-1606 UNKNOWN READ in hb_set_digest_lowest_bits_t<unsigned long, 4u>::may_have

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24842 Crash type: UNKNOWN READ Crash state: hbsetdigestlowestbitst::mayhave hbsetdigestcombinert, hbset OT::hbotlayoutlookupacceleratort::mayhave...

OSV-2020-1600 Use-of-uninitialized-value in fuzzing::memory::memory_test_msan

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24786 Crash type: Use-of-uninitialized-value Crash state: fuzzing::memory::memorytestmsan cryptofuzz::ExecutorBasecryptofuzz::component::Ciphertext, cryptofuzz::operatio cryptofuzz::ExecutorBasecryptofuzz::component::Ciphertex...

OSV-2020-1599 Use-of-uninitialized-value in slide_hash

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24820 Crash type: Use-of-uninitialized-value Crash state: slidehash fillwindow deflatefast...

OSV-2020-1597 UNKNOWN WRITE in avifDecoderDataFillImageGrid

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24811 Crash type: UNKNOWN WRITE Crash state: avifDecoderDataFillImageGrid avifDecoderNextImage avifdecodefuzzer.cc...

OSV-2020-1598 Use-of-uninitialized-value in longest_match

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24804 Crash type: Use-of-uninitialized-value Crash state: longestmatch deflatefast deflate...

OSV-2020-1595 Use-of-uninitialized-value in cryptofuzz::module::Nettle::OpSymmetricDecrypt

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24785 Crash type: Use-of-uninitialized-value Crash state: cryptofuzz::module::Nettle::OpSymmetricDecrypt cryptofuzz::ExecutorBasecryptofuzz::Buffer, cryptofuzz::operation::SymmetricDec cryptofuzz::ExecutorBasecryptofuzz::Buffe...

OSV-2020-1591 UNKNOWN READ in ft_smooth_overlap_spans

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24729 Crash type: UNKNOWN READ Crash state: ftsmoothoverlapspans graysweep grayconvertglyph...

OSV-2020-1590 Heap-buffer-overflow in ft_smooth_overlap_spans

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24726 Crash type: Heap-buffer-overflow READ 1 Crash state: ftsmoothoverlapspans graysweep grayconvertglyph...

OSV-2020-1589 UNKNOWN READ in RegisterSetjmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24695 Crash type: UNKNOWN READ Crash state: RegisterSetjmp wasmtimeruntime::traphandlers::CallThreadState::with::hada2d3d104ef56de wasmtime::func::invokewasmandcatchtraps::h25a8cbd9f03c9a30...

OSV-2020-1587 UNKNOWN WRITE in count_blocks

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24704 Crash type: UNKNOWN WRITE Crash state: countblocks optinit bpfoptimize...

OSV-2020-1583 Segv on unknown address in clang::Preprocessor::LexHeaderName

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24668 Crash type: Segv on unknown address Crash state: clang::Preprocessor::LexHeaderName clang::Preprocessor::HandleIncludeDirective clang::Preprocessor::HandleDirective...

OSV-2020-1577 Heap-buffer-overflow in QPointF::x

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24615 Crash type: Heap-buffer-overflow READ 8 Crash state: QPointF::x QBezier::fromPoints QOutlineMapper::curveTo...

OSV-2020-1573 Use-of-uninitialized-value in void ArduinoJsonNUMBER_71::Utf8::encodeCodepoint<ArduinoJsonNUMBER_71::StringCop

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24633 Crash type: Use-of-uninitialized-value Crash state: void ArduinoJsonNUMBER71::Utf8::encodeCodepointArduinoJsonNUMBER71::StringCop ArduinoJsonNUMBER71::JsonDeserializerArduinoJsonNUMBER71::BoundedReaderunsig...

OSV-2020-1572 UNKNOWN WRITE in sarrayAddString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24617 Crash type: UNKNOWN WRITE Crash state: sarrayAddString gplotAddPlot numaQuantizeCrossingsByWidth...

OSV-2020-1570 Heap-buffer-overflow in x265::PicYuv::copyFromPicture

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24590 Crash type: Heap-buffer-overflow READ Crash state: x265::PicYuv::copyFromPicture x265::Encoder::encode x265encoderencode...

OSV-2020-1567 Heap-buffer-overflow in allocate_field

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24580 Crash type: Heap-buffer-overflow WRITE 8 Crash state: allocatefield decodepointerfield decodefield...

OSV-2020-1566 Heap-buffer-overflow in ndpi_workflow_process_packet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24576 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpiworkflowprocesspacket fuzzndpireader.c...

OSV-2020-1565 Heap-buffer-overflow in allocate_field

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24586 Crash type: Heap-buffer-overflow WRITE 8 Crash state: allocatefield pbdecstring decodebasicfield...

OSV-2020-1564 Use-of-uninitialized-value in pb_encode_varint

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24582 Crash type: Use-of-uninitialized-value Crash state: pbencodevarint pbencvarint encodearray...

OSV-2020-1563 UNKNOWN READ in OT::VariationSelectorRecord::operator=

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24548 Crash type: UNKNOWN READ Crash state: OT::VariationSelectorRecord::operator= OT::VariationSelectorRecord::VariationSelectorRecord hbarrayt::reverse...

OSV-2020-1559 UNKNOWN WRITE in hb_vector_t<CFF::parsed_cs_op_t>::resize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24532 Crash type: UNKNOWN WRITE Crash state: hbvectort::resize hbvectort::push CFF::parsedvaluest::addop...

OSV-2020-1558 Stack-buffer-overflow in dst_print_s2k

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24538 Crash type: Stack-buffer-overflow READ 1 Crash state: dstprints2k streamdumppacketsraw streamdumppackets...

OSV-2020-1555 Global-buffer-overflow in OT::VarData::get_scalars

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24504 Crash type: Global-buffer-overflow WRITE 4 Crash state: OT::VarData::getscalars OT::VariationStore::getscalars CFF::cff2csinterpenvt::processblend...

OSV-2020-1554 Object-size in void hb_ot_map_t::apply<GPOSProxy>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24508 Crash type: Object-size Crash state: void hbotmapt::apply hbotmapt::position hbotshapeplant::position...

OSV-2020-1553 UNKNOWN READ in hb_realloc_impl

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24497 Crash type: UNKNOWN READ Crash state: hbreallocimpl hbvectort::alloc hbvectort::resize...

OSV-2020-1551 UNKNOWN WRITE in CFF::parsed_cs_op_t::set_skip

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24507 Crash type: UNKNOWN WRITE Crash state: CFF::parsedcsopt::setskip CFF::parsedcsstrt::addcallop cff1csopsetsubrsubsett::processcallsubr...

OSV-2020-1550 UNKNOWN WRITE in hb_vector_t<CFF::dict_val_t>::resize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24489 Crash type: UNKNOWN WRITE Crash state: hbvectort::resize hbvectort::push CFF::dictvalt hbvectort::push...

OSV-2020-1549 UNKNOWN WRITE in hb_vector_t<CFF::op_str_t>::resize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24500 Crash type: UNKNOWN WRITE Crash state: hbvectort::resize hbvectort::push CFF::parsedvaluest::addop...

OSV-2020-1547 Heap-use-after-free in destroy_op_array

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24436 Crash type: Heap-use-after-free READ 4 Crash state: destroyoparray fuzzerdorequest fuzzerdorequestfrombuffer...

OSV-2020-1540 UNKNOWN READ in eval_expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23781 Crash type: UNKNOWN READ Crash state: evalexpr evalbinary evalexpr...

OSV-2020-1541 UNKNOWN READ in eval_expr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22919 Crash type: UNKNOWN READ Crash state: evalexpr pathxeval pathxsymtabdefine...

OSV-2020-1538 Use-of-uninitialized-value in cmsMLUgetASCII

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19724 Crash type: Use-of-uninitialized-value Crash state: cmsMLUgetASCII cmsGetProfileInfoASCII GetICCProperty...

OSV-2020-1536 Segv on unknown address in GetValueFromLinkedList

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20923 Crash type: Segv on unknown address Crash state: GetValueFromLinkedList Magick::throwException Magick::Image::read...

OSV-2020-1534 Use-of-uninitialized-value in void transform_idct_add<unsigned short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23918 Crash type: Use-of-uninitialized-value Crash state: void transformidctadd transform8x8add16fallback void accelerationfunctions::transformadd...

OSV-2020-1532 Heap-buffer-overflow in Op_RGB_to_RGB24_32::convert_colorspace

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22109 Crash type: Heap-buffer-overflow READ 1 Crash state: OpRGBtoRGB2432::convertcolorspace heif::ColorConversionPipeline::convertimage heif::convertcolorspace...

OSV-2020-1531 Segv on unknown address in clang::Sema::PerformImplicitConversion

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19621 Crash type: Segv on unknown address Crash state: clang::Sema::PerformImplicitConversion clang::Sema::PerformImplicitConversion clang::Sema::PerformContextuallyConvertToBool...

OSV-2020-1529 Use-of-uninitialized-value in CorrectPSDAlphaBlend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13836 Crash type: Use-of-uninitialized-value Crash state: CorrectPSDAlphaBlend ReadPSDMergedImage ReadPSDImage...

OSV-2020-1528 Use-of-uninitialized-value in PushColormapIndex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10379 Crash type: Use-of-uninitialized-value Crash state: PushColormapIndex SyncImage WriteOnePNGImage...

OSV-2020-1527 Use-of-uninitialized-value in ConstantString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21159 Crash type: Use-of-uninitialized-value Crash state: ConstantString SetImageProperty TIFFGetProperties...

OSV-2020-1521 Use-of-uninitialized-value in stbi__jpeg_huff_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22598 Crash type: Use-of-uninitialized-value Crash state: stbijpeghuffdecode stbijpegdecodeblockprogac stbiparseentropycodeddata...

OSV-2020-1519 Index-out-of-bounds in DHT::hide_hots

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23837 Crash type: Index-out-of-bounds Crash state: DHT::hidehots LibRaw::dhtinterpolate LibRaw::dcrawprocess...

OSV-2020-1525 UNKNOWN in zend_ast_export_ex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24405 Crash type: UNKNOWN Crash state: zendastexportex zendastexportex zendastexportex...

OSV-2020-1522 Segv on unknown address in clang::Sema::EnterDeclaratorContext

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20232 Crash type: Segv on unknown address Crash state: clang::Sema::EnterDeclaratorContext clang::Sema::ActOnCXXEnterDeclaratorScope clang::Parser::ParseDirectDeclarator...

OSV-2020-1520 Use-of-uninitialized-value in transform_4x4_luma_add_8_fallback

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23288 Crash type: Use-of-uninitialized-value Crash state: transform4x4lumaadd8fallback void accelerationfunctions::transform4x4dstadd void transformcoefficients...

OSV-2020-1523 UNKNOWN READ in Mat_H5ReadFieldNames

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23456 Crash type: UNKNOWN READ Crash state: MatH5ReadFieldNames MatH5ReadGroupInfo MatVarReadNextInfoIterate...

OSV-2020-1510 UNKNOWN WRITE in FLAC__bitwriter_write_raw_uint32_nocheck

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19816 Crash type: UNKNOWN WRITE Crash state: FLACbitwriterwriterawuint32nocheck FLACbitwriterwriterawuint32 FLACframeaddheader...

OSV-2020-1512 Segv on unknown address in clang::Sema::SetCtorInitializers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22828 Crash type: Segv on unknown address Crash state: clang::Sema::SetCtorInitializers clang::Sema::ActOnDefaultCtorInitializers clang::Parser::ParseLexedMethodDef...

OSV-2020-1516 Use-of-uninitialized-value in ScaleQuantumToChar

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22583 Crash type: Use-of-uninitialized-value Crash state: ScaleQuantumToChar LosslessReduceDepthOK ReadOneMNGImage...

OSV-2020-1513 Segv on unknown address in bool EvaluateComparisonBinaryOperator<IntExprEvaluator::VisitBinaryOperator

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23836 Crash type: Segv on unknown address Crash state: bool EvaluateComparisonBinaryOperator::Visit...