OSV-2020-1373 Segv on unknown address in helper_uc_tracecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23552 Crash type: Segv on unknown address Crash state: helpeructracecode...

OSV-2020-1371 Bad-cast to pcpp::IDnsResource from invalid vptr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23926 Crash type: Bad-cast Crash state: Bad-cast to pcpp::IDnsResource from invalid vptr pcpp::DnsLayer::parseResources pcpp::DnsLayer::DnsLayer...

OSV-2020-1369 Segv on unknown address in clang::Expr::skipRValueSubobjectAdjustments

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23669 Crash type: Segv on unknown address Crash state: clang::Expr::skipRValueSubobjectAdjustments visitLocalsRetainedByInitializer clang::Sema::checkInitializerLifetime...

OSV-2020-1366 Heap-use-after-free in RDKit::SubstanceGroup::addParentAtomWithBookmark

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24406 Crash type: Heap-use-after-free READ 4 Crash state: RDKit::SubstanceGroup::addParentAtomWithBookmark RDKit::SGroupParsing::ParseSGroupV2000VectorDataLine RDKit::ParseMolBlockProperties...

OSV-2020-1368 Segv on unknown address in clang::LookupResult::sanity

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19683 Crash type: Segv on unknown address Crash state: clang::LookupResult::sanity clang::Sema::HandleDeclarator clang::Sema::ActOnDeclarator...

OSV-2020-1367 Use-of-uninitialized-value in void intra_prediction_angular<unsigned char>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23615 Crash type: Use-of-uninitialized-value Crash state: void intrapredictionangular void decodeintrapredictioninternal decodeintraprediction...

OSV-2020-1365 UNKNOWN READ in cli_vba_readdir_new

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24354 Crash type: UNKNOWN READ Crash state: clivbareaddirnew clivbascandirnew cliscanole2...

OSV-2020-1362 Use-of-uninitialized-value in LibRaw::init_fuji_block

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24016 Crash type: Use-of-uninitialized-value Crash state: LibRaw::initfujiblock LibRaw::fujidecodestrip LibRaw::fujidecodeloop...

OSV-2020-1356 Segv on unknown address in vips_XYZ2Lab_line

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24290 Crash type: Segv on unknown address Crash state: vipsXYZ2Labline vipscolourgen vipsregiongenerate...

OSV-2020-1346 UNKNOWN WRITE in StatsIncr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21508 Crash type: UNKNOWN WRITE Crash state: StatsIncr AppLayerHandleUdp FlowWorker...

OSV-2020-1352 Heap-buffer-overflow in arrow::Status arrow::internal::ValidateArrayVisitor::ValidateListArray<arrow::Li

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20186 Crash type: Heap-buffer-overflow READ 4 Crash state: arrow::Status arrow::internal::ValidateArrayVisitor::ValidateListArray arrow::internal::ValidateArray...

OSV-2020-1347 Negative-size-param in fuzz_tlv_to_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16703 Crash type: Negative-size-param Crash state: fuzztlvtostring fuzzparsemimetlv fuzzaddmimepart...

OSV-2020-1349 Heap-buffer-overflow in mu::ParserBase::ParseCmdCodeBulk

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23410 Crash type: Heap-buffer-overflow READ 8 Crash state: mu::ParserBase::ParseCmdCodeBulk mu::ParserBase::ParseString setevalfuzzer.cc...

OSV-2020-1351 Heap-use-after-free in sc_pkcs15_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17170 Crash type: Heap-use-after-free READ 4 Crash state: scpkcs15freeobject fuzzpkcs15decode.c fuzzpkcs15decode.c...

OSV-2020-1340 Use-of-uninitialized-value in Gfx::fillPatch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15395 Crash type: Use-of-uninitialized-value Crash state: Gfx::fillPatch Gfx::doPatchMeshShFill Gfx::doShadingPatternFill...

OSV-2020-1330 Heap-buffer-overflow in mu::ParserBase::ParseCmdCodeBulk

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24164 Crash type: Heap-buffer-overflow READ 8 Crash state: mu::ParserBase::ParseCmdCodeBulk mu::ParserBase::ParseString setevalfuzzer.cc...

OSV-2020-1332 Index-out-of-bounds in xsltSetAttrVTsegment

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14273 Crash type: Index-out-of-bounds Crash state: xsltSetAttrVTsegment xsltCompileAttr xsltParseTemplateContent...

OSV-2020-1331 Heap-buffer-overflow in pcpp::GtpV1Layer::GtpExtension::getNextExtensionHeaderType

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23183 Crash type: Heap-buffer-overflow READ 1 Crash state: pcpp::GtpV1Layer::GtpExtension::getNextExtensionHeaderType pcpp::GtpV1Layer::GtpExtension::getNextExtension pcpp::GtpV1Layer::getHeaderLen...

OSV-2020-1328 UNKNOWN READ in std::__1::__tree<std::__1::__value_type<std::__1::basic_string<char, std::__1::c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23566 Crash type: UNKNOWN READ Crash state: std::1::tree, std::1...

OSV-2020-1325 Global-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21769 Crash type: Global-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int CFF::Charset0::getglyph...

OSV-2020-1326 Heap-buffer-overflow in ihevcd_parse_slice_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16804 Crash type: Heap-buffer-overflow READ 4 Crash state: ihevcdparseslicedata ihevcddecode ihevcdcxaapifunction...

OSV-2020-1319 Use-of-uninitialized-value in Interpreter::evaluate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15843 Crash type: Use-of-uninitialized-value Crash state: Interpreter::evaluate jsonnetvmexecute jsonnetevaluatesnippetaux...

OSV-2020-1321 UNKNOWN READ in FlowGetHash

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21479 Crash type: UNKNOWN READ Crash state: FlowGetHash FlowSetupPacket DecodeICMPV4...

OSV-2020-1327 UNKNOWN READ in arrow::Status arrow::VisitArrayInline<arrow::internal::ValidateArrayDataVisitor>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20135 Crash type: UNKNOWN READ Crash state: arrow::Status arrow::VisitArrayInline arrow::Status arrow::internal::ValidateArrayDataVisitor::ValidateListArray...

OSV-2020-1312 Use-of-uninitialized-value in FilterInput8bitWithStride_c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13004 Crash type: Use-of-uninitialized-value Crash state: FilterInput8bitWithStridec McHorVer20c McHorVer30c...

OSV-2020-1314 Use-of-uninitialized-value in ndpi_strdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21309 Crash type: Use-of-uninitialized-value Crash state: ndpistrdup processClientServerHello processTLSBlock...

OSV-2020-1310 Use-of-uninitialized-value in pcpp::SSLCertificateRequestMessage::SSLCertificateRequestMessage

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22513 Crash type: Use-of-uninitialized-value Crash state: pcpp::SSLCertificateRequestMessage::SSLCertificateRequestMessage pcpp::SSLHandshakeMessage::createHandhakeMessage pcpp::SSLHandshakeLayer::SSLHandshakeLayer...

OSV-2020-1311 Use-of-uninitialized-value in Sass::Prelexer::quoted_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Use-of-uninitialized-value Crash state: Sass::Prelexer::quotedstring Sass::Prelexer::staticcomponent char const Sass::Prelexer::zeroplus&...

OSV-2020-1315 Heap-buffer-overflow in pcpp::IPv4Layer::getFragmentFlags

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22638 Crash type: Heap-buffer-overflow READ 2 Crash state: pcpp::IPv4Layer::getFragmentFlags pcpp::IPv4Layer::isFragment pcpp::IPv4Layer::parseNextLayer...

OSV-2020-1308 Heap-use-after-free in Interpreter::evaluate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15846 Crash type: Heap-use-after-free READ 4 Crash state: Interpreter::evaluate Interpreter::manifestJson Interpreter::evaluate...

OSV-2020-1299 UNKNOWN WRITE in ideint_weave_blk

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17084 Crash type: UNKNOWN WRITE Crash state: ideintweaveblk ideintprocess impeg2ddeinterlace...

OSV-2020-1301 Heap-buffer-overflow in hts_md5_update

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22231 Crash type: Heap-buffer-overflow READ Crash state: htsmd5update cramdecodeslice cramdecodeslicemt...

OSV-2020-1300 Heap-buffer-overflow in ihevcd_parse_slice_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17036 Crash type: Heap-buffer-overflow WRITE 1 Crash state: ihevcdparseslicedata ihevcddecode ihevcdcxaapifunction...

OSV-2020-1306 Use-of-uninitialized-value in TIFFYCbCrtoRGB

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16602 Crash type: Use-of-uninitialized-value Crash state: TIFFYCbCrtoRGB putcontig8bitYCbCr42tile gtTileContig...

OSV-2020-1307 Heap-buffer-overflow in pcpp::IPv6Extension::getExtensionLen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22636 Crash type: Heap-buffer-overflow READ 1 Crash state: pcpp::IPv6Extension::getExtensionLen pcpp::IPv6Layer::parseExtensions pcpp::IPv6Layer::IPv6Layer...

OSV-2020-1297 Heap-buffer-overflow in pcpp::DnsResource::getDataLength

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22102 Crash type: Heap-buffer-overflow READ 2 Crash state: pcpp::DnsResource::getDataLength pcpp::DnsResource::getSize pcpp::DnsLayer::parseResources...

OSV-2020-1298 Heap-buffer-overflow in char const* Sass::Prelexer::alternatives<&

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Heap-buffer-overflow READ 1 Crash state: char const Sass::Prelexer::alternatives& char const Sass::Prelexer::alternatives& char const Sass::Prelexer::sequence&...

OSV-2020-1296 Heap-use-after-free in WelsDec::WelsReorderRefList

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13038 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::WelsReorderRefList WelsDec::DecodeCurrentAccessUnit WelsDec::ConstructAccessUnit...

OSV-2020-1292 Stack-buffer-overflow in ot::ExtendedTlv::GetLength

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20775 Crash type: Stack-buffer-overflow READ 2 Crash state: ot::ExtendedTlv::GetLength ot::Tlv::GetSize ot::Tlv::GetNext...

OSV-2020-1289 Heap-use-after-free in WelsDec::MapColToList0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13037 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::MapColToList0 WelsDec::PredBDirectTemporal WelsDec::ParseInterBInfo...

OSV-2020-1290 Bad-free in aes_gcm_cleanup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14333 Crash type: Bad-free Crash state: aesgcmcleanup EVPCIPHERCTXfree cryptofuzz::module::CTXCopier::copy...

OSV-2020-1294 Heap-buffer-overflow in SHA1Update

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18740 Crash type: Heap-buffer-overflow READ Crash state: SHA1Update getSSCertificateFingerprint tlsDetectProtocolFromCertificate...

OSV-2020-1291 UNKNOWN READ in std::__1::_MetaBase<__can_be_converted_to_string_view<char, std::__1::char_trait

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23429 Crash type: UNKNOWN READ Crash state: std::1::MetaBase, std::1::allocator std::1::treeiteratorstd::1::valuetypestd::1::basicstringchar, st...

OSV-2020-1288 Heap-buffer-overflow in asn1_decode_entry

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16620 Crash type: Heap-buffer-overflow READ 1 Crash state: asn1decodeentry asn1decode asn1decodeentry...

OSV-2020-1278 Use-of-uninitialized-value in SampledFunction::SampledFunction

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12608 Crash type: Use-of-uninitialized-value Crash state: SampledFunction::SampledFunction Function::parse Function::parse...

OSV-2020-1274 Heap-buffer-overflow in exif_entry_get_value

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14543 Crash type: Heap-buffer-overflow READ 7 Crash state: exifentrygetvalue contentfunc exifcontentforeachentry...

OSV-2020-1280 Heap-buffer-overflow in cdf_read_property_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16780 Crash type: Heap-buffer-overflow WRITE 4 Crash state: cdfreadpropertyinfo cdfunpacksummaryinfo cdffilesummaryinfo...

OSV-2020-1285 Use-of-uninitialized-value in ihevc_deblk_luma_vert_ssse3

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17009 Crash type: Use-of-uninitialized-value Crash state: ihevcdeblklumavertssse3 ihevcddeblkctb ihevcdprocess...

OSV-2020-1272 Heap-buffer-overflow in ASN1_get_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13803 Crash type: Heap-buffer-overflow READ 1 Crash state: ASN1getobject asn1checktlen asn1itemexd2i...

OSV-2020-1273 Use-of-uninitialized-value in psscan

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21302 Crash type: Use-of-uninitialized-value Crash state: psscan documentload spectrereadfuzzer.c...