OSV-2020-1273 Use-of-uninitialized-value in psscan

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21302 Crash type: Use-of-uninitialized-value Crash state: psscan documentload spectrereadfuzzer.c...

OSV-2020-1263 Heap-buffer-overflow in getSSCertificateFingerprint

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18733 Crash type: Heap-buffer-overflow READ 2 Crash state: getSSCertificateFingerprint tlsDetectProtocolFromCertificate ndpisearchtlstcpudp...

OSV-2020-1260 Negative-size-param in heif::HeifPixelImage::fill_RGB_16bit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13563 Crash type: Negative-size-param Crash state: heif::HeifPixelImage::fillRGB16bit heif::HeifContext::decodeoverlayimage heif::HeifContext::decodeimage...

OSV-2020-1266 UNKNOWN READ in arrow::Array::IsNull

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20139 Crash type: UNKNOWN READ Crash state: arrow::Array::IsNull arrow::Status arrow::VisitArrayInline arrow::internal::ValidateArrayData...

OSV-2020-1264 Use-of-uninitialized-value in AnnotAppearanceBuilder::drawText

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17607 Crash type: Use-of-uninitialized-value Crash state: AnnotAppearanceBuilder::drawText AnnotAppearanceBuilder::drawFormFieldChoice AnnotAppearanceBuilder::drawFormField...

OSV-2020-1252 Heap-buffer-overflow in jpc_dec_process_sot

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13310 Crash type: Heap-buffer-overflow READ 4 Crash state: jpcdecprocesssot jpcdecode jp2decode...

OSV-2020-1246 Stack-buffer-overflow in void apply_sao_internal<unsigned short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13643 Crash type: Stack-buffer-overflow READ 4 Crash state: void applysaointernal void applysao threadtasksao::work...

OSV-2020-1250 Heap-use-after-free in WelsDec::MapColToList0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13185 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::MapColToList0 WelsDec::ParseInterBMotionInfoCabac WelsDec::WelsDecodeMbCabacBSliceBaseMode0...

OSV-2020-1258 Heap-use-after-free in WelsDec::MapColToList0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13457 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::MapColToList0 WelsDec::PredBDirectTemporal WelsDec::ParseInterBMotionInfoCabac...

OSV-2020-1257 Stack-buffer-overflow in readstat_convert

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12579 Crash type: Stack-buffer-overflow WRITE 1 Crash state: readstatconvert dtahandlerow dtahandlerows...

OSV-2020-1256 UNKNOWN WRITE in TIFFReadRGBATileExt

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14185 Crash type: UNKNOWN WRITE Crash state: TIFFReadRGBATileExt cv::TiffDecoder::readData cv::imread...

OSV-2020-1253 Heap-buffer-overflow in pixReadFromTiffStream

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21435 Crash type: Heap-buffer-overflow WRITE 1 Crash state: pixReadFromTiffStream pixReadMemTiff pixReadMem...

OSV-2020-1244 Use-of-uninitialized-value in decimate_dsd_run

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19925 Crash type: Use-of-uninitialized-value Crash state: decimatedsdrun WavpackUnpackSamples fuzzer.cc...

OSV-2020-1245 Heap-buffer-overflow in c2i_ASN1_INTEGER

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14142 Crash type: Heap-buffer-overflow READ 1 Crash state: c2iASN1INTEGER asn1exc2i asn1d2iexprimitive...

OSV-2020-1240 Use-of-uninitialized-value in jbig2_decode_mmr_line

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17855 Crash type: Use-of-uninitialized-value Crash state: jbig2decodemmrline jbig2decodehalftonemmr jbig2decodegrayscaleimage...

OSV-2020-1238 Use-of-uninitialized-value in pcpp::Packet::createFirstLayer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22085 Crash type: Use-of-uninitialized-value Crash state: pcpp::Packet::createFirstLayer pcpp::Packet::setRawPacket FuzzTarget.cpp...

OSV-2020-1237 Use-of-uninitialized-value in pcpp::NullLoopbackLayer::getFamily

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22084 Crash type: Use-of-uninitialized-value Crash state: pcpp::NullLoopbackLayer::getFamily pcpp::NullLoopbackLayer::parseNextLayer pcpp::Packet::setRawPacket...

OSV-2020-1235 Heap-buffer-overflow in mbc_case_fold

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21977 Crash type: Heap-buffer-overflow READ 1 Crash state: mbccasefold stringcmpic matchat...

OSV-2020-1242 Heap-buffer-overflow in ih264d_cavlc_parse4x4coeff_n8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16587 Crash type: Heap-buffer-overflow READ 4 Crash state: ih264dcavlcparse4x4coeffn8 ih264dcavlcparse8x8blockbothavailable ih264dparseresidual4x4cavlc...

OSV-2020-1234 Use-of-uninitialized-value in ihevc_recon_32x32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17072 Crash type: Use-of-uninitialized-value Crash state: ihevcrecon32x32 ihevcdiquantitransreconctb ihevcdprocess...

OSV-2020-1226 Heap-buffer-overflow in void mc_chroma<unsigned short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13583 Crash type: Heap-buffer-overflow READ 2 Crash state: void mcchroma generateinterpredictionsamples decodepredictionunit...

OSV-2020-1233 Heap-buffer-overflow in getTLScertificate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19269 Crash type: Heap-buffer-overflow READ 6 Crash state: getTLScertificate tlsDetectProtocolFromCertificate ndpisearchtlstcpudp...

OSV-2020-1228 Heap-use-after-free in arrow::internal::CountSetBits

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20120 Crash type: Heap-use-after-free READ 8 Crash state: arrow::internal::CountSetBits arrow::Array::nullcount arrow::internal::ValidateArray...

OSV-2020-1232 Use-of-uninitialized-value in TIFFYCbCrtoRGB

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16844 Crash type: Use-of-uninitialized-value Crash state: TIFFYCbCrtoRGB putcontig8bitYCbCr22tile gtTileContig...

OSV-2020-1231 Heap-buffer-overflow in find_dom

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15284 Crash type: Heap-buffer-overflow WRITE Crash state: finddom optloop bpfoptimize...

OSV-2020-1229 Heap-buffer-overflow in Sass::Prelexer::quoted_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Heap-buffer-overflow READ 1 Crash state: Sass::Prelexer::quotedstring char const Sass::Prelexer::alternatives& char const Sass::Prelexer::sequence&...

OSV-2020-1230 Heap-buffer-overflow in to_u32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16734 Crash type: Heap-buffer-overflow READ 1 Crash state: tou32 fuzzgettlvcomn fuzzaddmimepart...

OSV-2020-1222 UNKNOWN READ in hpeek

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20473 Crash type: UNKNOWN READ Crash state: hpeek samhdrcreate viewsam...

OSV-2020-1220 Heap-use-after-free in WelsDec::WelsReorderRefList

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12728 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::WelsReorderRefList WelsDec::DecodeCurrentAccessUnit WelsDec::ConstructAccessUnit...

OSV-2020-1221 Use-of-uninitialized-value in ps_read_doseps

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21301 Crash type: Use-of-uninitialized-value Crash state: psreaddoseps psscan documentload...

OSV-2020-1211 Heap-buffer-overflow in ihevcd_parse_slice_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16805 Crash type: Heap-buffer-overflow READ 4 Crash state: ihevcdparseslicedata ihevcdnalunit ihevcddecode...

OSV-2020-1212 Heap-buffer-overflow in helper_ret_stb_mmu_mips

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13489 Crash type: Heap-buffer-overflow READ 4 Crash state: helperretstbmmumips...

OSV-2020-1216 Heap-buffer-overflow in ihevcd_ctb_boundary_strength_islice

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16842 Crash type: Heap-buffer-overflow WRITE 1 Crash state: ihevcdctbboundarystrengthislice ihevcdparseslicedata ihevcdnalunit...

OSV-2020-1204 Heap-buffer-overflow in pcpp::IPv4Layer::getSrcIpAddress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22427 Crash type: Heap-buffer-overflow READ 4 Crash state: pcpp::IPv4Layer::getSrcIpAddress FuzzTarget.cpp...

OSV-2020-1203 Heap-use-after-free in WelsDec::WelsReorderRefList

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20491 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::WelsReorderRefList WelsDec::InitRefPicList WelsDec::DecodeCurrentAccessUnit...

OSV-2020-1206 Use-of-uninitialized-value in Sass::Prelexer::quoted_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Use-of-uninitialized-value Crash state: Sass::Prelexer::quotedstring char const Sass::Prelexer::nongreedy& Sass::Parser::lookaheadforvalue...

OSV-2020-1202 Use-of-uninitialized-value in pcpp::NullLoopbackLayer::parseNextLayer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22831 Crash type: Use-of-uninitialized-value Crash state: pcpp::NullLoopbackLayer::parseNextLayer pcpp::Packet::setRawPacket pcpp::Packet::Packet...

OSV-2020-1210 UNKNOWN READ in xmlXPathCompileExpr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16288 Crash type: UNKNOWN READ Crash state: xmlXPathCompileExpr xmlXPathCompPrimaryExpr xmlXPathCompFilterExpr...

OSV-2020-1209 Use-of-uninitialized-value in psnip_safe_size_mul

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16834 Crash type: Use-of-uninitialized-value Crash state: psnipsafesizemul SafeMulDims MatVarFree...

OSV-2020-1193 Heap-buffer-overflow in cdf_read_property_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16634 Crash type: Heap-buffer-overflow WRITE 4 Crash state: cdfreadpropertyinfo cdfunpacksummaryinfo cdffilesummaryinfo...

OSV-2020-1192 Index-out-of-bounds in decoder_context::has_sps

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13591 Crash type: Index-out-of-bounds Crash state: decodercontext::hassps picparameterset::read decodercontext::readppsNAL...

OSV-2020-1194 Heap-buffer-overflow in ndpi_search_mail_smtp_tcp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20563 Crash type: Heap-buffer-overflow READ 4 Crash state: ndpisearchmailsmtptcp checkndpitcpflowfunc ndpidetectionprocesspacket...

OSV-2020-1200 UNKNOWN WRITE in DumpModeDecode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14071 Crash type: UNKNOWN WRITE Crash state: DumpModeDecode TIFFReadEncodedStrip cv::TiffDecoder::readData32FC3...

OSV-2020-1185 Global-buffer-overflow in kencodingprober::nsCodingStateMachine::NextState

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12919 Crash type: Global-buffer-overflow READ 4 Crash state: kencodingprober::nsCodingStateMachine::NextState kencodingprober::nsEscCharSetProber::HandleData kencodingprober::nsUniversalDetector::HandleData...

OSV-2020-1187 Heap-buffer-overflow in ndpi_int_check_stun

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18737 Crash type: Heap-buffer-overflow READ 16 Crash state: ndpiintcheckstun ndpisearchstun checkndpiudpflowfunc...

OSV-2020-1186 Index-out-of-bounds in WelsDec::DecodeCurrentAccessUnit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12668 Crash type: Index-out-of-bounds Crash state: WelsDec::DecodeCurrentAccessUnit WelsDec::ConstructAccessUnit WelsDecodeBs...

OSV-2020-1188 Heap-buffer-overflow in pcpp::IPv6Extension::getExtensionLen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22105 Crash type: Heap-buffer-overflow READ 1 Crash state: pcpp::IPv6Extension::getExtensionLen pcpp::IPv6Layer::parseExtensions pcpp::IPv6Layer::IPv6Layer...

OSV-2020-1180 UNKNOWN WRITE in ideint_process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18993 Crash type: UNKNOWN WRITE Crash state: ideintprocess impeg2ddeinterlace impeg2ddecpicdatathread...

OSV-2020-1171 Heap-use-after-free in JS_ReadObjectRec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21532 Crash type: Heap-use-after-free READ 4 Crash state: JSReadObjectRec JSReadObject fuzzcompile.c...

OSV-2020-1176 Use-of-uninitialized-value in put4bitbwtile

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21434 Crash type: Use-of-uninitialized-value Crash state: put4bitbwtile gtStripContig TIFFRGBAImageGet...