OSV-2020-1173 Use-of-uninitialized-value in psscan

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21670 Crash type: Use-of-uninitialized-value Crash state: psscan documentload spectrereadfuzzer.c...

OSV-2020-1175 Use-of-uninitialized-value in readline

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21638 Crash type: Use-of-uninitialized-value Crash state: readline psscan documentload...

OSV-2020-1171 Heap-use-after-free in JS_ReadObjectRec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21532 Crash type: Heap-use-after-free READ 4 Crash state: JSReadObjectRec JSReadObject fuzzcompile.c...

OSV-2020-1172 Global-buffer-overflow in WelsDec::ParseInterBInfo

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12652 Crash type: Global-buffer-overflow READ 1 Crash state: WelsDec::ParseInterBInfo WelsDec::WelsActualDecodeMbCavlcBSlice WelsDec::WelsDecodeMbCavlcBSlice...

OSV-2020-1165 Global-buffer-overflow in parse_headers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14154 Crash type: Global-buffer-overflow READ 4 Crash state: parseheaders parsehttprequest fuzzparsehttprequest...

OSV-2020-1168 Use-of-uninitialized-value in gbNUMBER_mbc_enc_len

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21944 Crash type: Use-of-uninitialized-value Crash state: gbNUMBERmbcenclen onigencmb4codetombc parseexp...

OSV-2020-1161 Heap-buffer-overflow in impeg2_fmt_conv_yuv420p_to_yuv420sp_uv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16604 Crash type: Heap-buffer-overflow WRITE 1 Crash state: impeg2fmtconvyuv420ptoyuv420spuv impeg2dformatconvert impeg2ddecpicdatathread...

OSV-2020-1167 Heap-buffer-overflow in tiffReadCallback

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14773 Crash type: Heap-buffer-overflow READ Crash state: tiffReadCallback OJPEGReadHeaderInfoSecTablesQTable OJPEGReadHeaderInfoSec...

OSV-2020-1163 Heap-buffer-overflow in readstat_convert

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12566 Crash type: Heap-buffer-overflow READ 1 Crash state: readstatconvert sas7bcatparsevaluelabels sas7bcatparseblock...

OSV-2020-1159 Segv on unknown address in arrow::ipc::ReadMessage

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20124 Crash type: Segv on unknown address Crash state: arrow::ipc::ReadMessage arrow::ipc::RecordBatchFileReader::RecordBatchFileReaderImpl::ReadMessageFromBlo...

OSV-2020-1158 Use-of-uninitialized-value in JBIG2HuffmanDecoder::buildTable

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18802 Crash type: Use-of-uninitialized-value Crash state: JBIG2HuffmanDecoder::buildTable JBIG2Stream::readTextRegionSeg JBIG2Stream::readSegments...

OSV-2020-1170 Heap-buffer-overflow in arrow::internal::CountSetBits

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20199 Crash type: Heap-buffer-overflow READ 8 Crash state: arrow::internal::CountSetBits arrow::Array::nullcount arrow::internal::ValidateArray...

OSV-2020-1150 Global-buffer-overflow in ssl_sigalg

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13800 Crash type: Global-buffer-overflow READ 2 Crash state: sslsigalg ssl3getserverkeyexchange ssl3connect...

OSV-2020-1148 Heap-buffer-overflow in asn1_item_ex_d2i

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14217 Crash type: Heap-buffer-overflow READ 1 Crash state: asn1itemexd2i ASN1itemd2i d2iPrivateKey...

OSV-2020-1155 Heap-buffer-overflow in FLAC__bitreader_read_rice_signed_block

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17069 Crash type: Heap-buffer-overflow READ 4 Crash state: FLACbitreaderreadricesignedblock readresidualpartitionedrice readsubframelpc...

OSV-2020-1153 Heap-buffer-overflow in ih264d_cavlc_4x4res_block_totalcoeff_11to16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16514 Crash type: Heap-buffer-overflow READ 4 Crash state: ih264dcavlc4x4resblocktotalcoeff11to16 ih264dcavlcparse4x4coeffn0to7 ih264dcavlcparse8x8blockbothavailable...

OSV-2020-1156 Heap-buffer-overflow in mu::Parser::Sum

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22927 Crash type: Heap-buffer-overflow READ 8 Crash state: mu::Parser::Sum mu::ParserBase::ParseCmdCodeBulk mu::ParserBase::ParseString...

OSV-2020-1154 Use-of-uninitialized-value in xmlStrlen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15746 Crash type: Use-of-uninitialized-value Crash state: xmlStrlen xmlStrncat xmlNodeAddContentLen...

OSV-2020-1151 Heap-buffer-overflow in sas_read2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12774 Crash type: Heap-buffer-overflow READ 2 Crash state: sasread2 sas7bdatparsecolumnnamesubheader sas7bdatparsepagepass2...

OSV-2020-1152 Heap-buffer-overflow in pcpp::tbp_my_own_strnlen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22483 Crash type: Heap-buffer-overflow READ 1 Crash state: pcpp::tbpmyownstrnlen pcpp::HeaderField::HeaderField pcpp::TextBasedProtocolMessage::parseFields...

OSV-2020-1146 Heap-buffer-overflow in dex_parse_debug_item

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14021 Crash type: Heap-buffer-overflow READ 1 Crash state: dexparsedebugitem parsedexclassmethod parseclass...

OSV-2020-1142 UNKNOWN WRITE in ideint_weave_blk

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16606 Crash type: UNKNOWN WRITE Crash state: ideintweaveblk ideintprocess impeg2ddeinterlace...

OSV-2020-1143 UNKNOWN WRITE in mips_release_mips

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13852 Crash type: UNKNOWN WRITE Crash state: mipsreleasemips ucclose fuzzemumips32be.c...

OSV-2020-1141 Heap-buffer-overflow in ff_hevc_put_hevc_epel_pixels_8_sse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13568 Crash type: Heap-buffer-overflow READ 16 Crash state: ffhevcputhevcepelpixels8sse accelerationfunctions::puthevcepel void mcchroma...

OSV-2020-1138 Heap-buffer-overflow in void apply_sao_internal<unsigned short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14184 Crash type: Heap-buffer-overflow READ 1 Crash state: void applysaointernal void applysao threadtasksao::work...

OSV-2020-1145 Heap-buffer-overflow in ihevcd_sao_shift_ctb

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16817 Crash type: Heap-buffer-overflow WRITE 1 Crash state: ihevcdsaoshiftctb ihevcdprocess ihevcdparseslicedata...

OSV-2020-1133 Heap-buffer-overflow in ndpi_search_h323

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21289 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpisearchh323 checkndpitcpflowfunc ndpidetectionprocesspacket...

OSV-2020-1125 Use-of-uninitialized-value in pcpp::IDnsResource::decodeName

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22451 Crash type: Use-of-uninitialized-value Crash state: pcpp::IDnsResource::decodeName pcpp::IDnsResource::IDnsResource pcpp::DnsQuery::DnsQuery...

OSV-2020-1127 Use-of-uninitialized-value in WelsDec::CWelsDecoder::ReorderPicturesInDisplay

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12647 Crash type: Use-of-uninitialized-value Crash state: WelsDec::CWelsDecoder::ReorderPicturesInDisplay WelsDec::CWelsDecoder::DecodeFrame2 WelsDec::CWelsDecoder::DecodeFrameNoDelay...

OSV-2020-1135 Heap-buffer-overflow in sas_read4

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12584 Crash type: Heap-buffer-overflow READ 4 Crash state: sasread4 sas7bcatparseblock readstatparsesas7bcat...

OSV-2020-1136 Global-buffer-overflow in ssl_sigalg

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13797 Crash type: Global-buffer-overflow READ 2 Crash state: sslsigalg tls1processsigalgs tlsextsigalgsserverparse...

OSV-2020-1137 Heap-use-after-free in ihevcd_jobq_lock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16884 Crash type: Heap-use-after-free READ 8 Crash state: ihevcdjobqlock ihevcdjobqyield ihevcdjobqdequeue...

OSV-2020-1130 Heap-buffer-overflow in xsltFormatNumberConversion

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17171 Crash type: Heap-buffer-overflow READ 1 Crash state: xsltFormatNumberConversion xsltFormatNumberFunction xmlXPathCompOpEval...

OSV-2020-1129 Heap-buffer-overflow in rt_read_handler

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12572 Crash type: Heap-buffer-overflow WRITE Crash state: rtreadhandler savreadvariablemissingvalues savreadvariablerecord...

OSV-2020-1131 Heap-buffer-overflow in ndpi_search_oscar_tcp_connect

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21000 Crash type: Heap-buffer-overflow READ 4 Crash state: ndpisearchoscartcpconnect checkndpitcpflowfunc ndpidetectionprocesspacket...

OSV-2020-1112 Heap-buffer-overflow in getNameLength

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18757 Crash type: Heap-buffer-overflow READ 1 Crash state: getNameLength getNameLength ndpisearchdns...

OSV-2020-1121 UNKNOWN READ in vcf_format

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18196 Crash type: UNKNOWN READ Crash state: vcfformat vcfwrite bcfwrite...

OSV-2020-1113 Heap-use-after-free in node_min_byte_len

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21998 Crash type: Heap-use-after-free READ 4 Crash state: nodeminbytelen tunequant tunetree...

OSV-2020-1123 Index-out-of-bounds in store_reg_arm

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20026 Crash type: Index-out-of-bounds Crash state: storeregarm genloadexclusivearm disasarminsnarm...

OSV-2020-1115 Heap-use-after-free in WelsDec::MapColToList0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13941 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::MapColToList0 WelsDec::PredBDirectTemporal WelsDec::ParseInterBInfo...

OSV-2020-1116 Heap-use-after-free in Interpreter::evaluate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15888 Crash type: Heap-use-after-free READ 4 Crash state: Interpreter::evaluate jsonnetvmexecute jsonnetevaluatesnippetaux...

OSV-2020-1114 Heap-buffer-overflow in ndpi_int_check_stun

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19332 Crash type: Heap-buffer-overflow READ 2 Crash state: ndpiintcheckstun ndpisearchstun checkndpiudpflowfunc...

OSV-2020-1117 Heap-buffer-overflow in arrow::internal::CountSetBits

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20575 Crash type: Heap-buffer-overflow READ 8 Crash state: arrow::internal::CountSetBits arrow::Array::nullcount arrow::internal::ValidateArray...

OSV-2020-1098 Heap-use-after-free in WelsDec::MapColToList0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14060 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::MapColToList0 WelsDec::PredBDirectTemporal WelsDec::ParseInterBInfo...

OSV-2020-1101 Heap-buffer-overflow in Sass::Prelexer::quoted_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Heap-buffer-overflow READ 1 Crash state: Sass::Prelexer::quotedstring char const Sass::Parser::lex& Sass::Parser::parsevalue...

OSV-2020-1108 Heap-buffer-overflow in Sass::Prelexer::quoted_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Heap-buffer-overflow READ 1 Crash state: Sass::Prelexer::quotedstring char const Sass::Prelexer::alternatives& Sass::Prelexer::cssvariabletoplevelvalue...

OSV-2020-1100 Heap-buffer-overflow in tlb_set_page_mips

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15030 Crash type: Heap-buffer-overflow READ 8 Crash state: tlbsetpagemips mipscpuhandlemmufaultmips tlbfillmips...

OSV-2020-1094 Heap-buffer-overflow in dex_parse_debug_item

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12973 Crash type: Heap-buffer-overflow READ 1 Crash state: dexparsedebugitem parsedexclassmethod parseclass...

OSV-2020-1092 Use-of-uninitialized-value in time_update_datetime

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14744 Crash type: Use-of-uninitialized-value Crash state: timeupdatedatetime currentmrbtime mrbtimenow...

OSV-2020-1093 Heap-buffer-overflow in mu::ParserBase::ParseCmdCodeBulk

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23330 Crash type: Heap-buffer-overflow READ 8 Crash state: mu::ParserBase::ParseCmdCodeBulk mu::ParserBase::ParseString mu::ParserBase::Eval...