OSV-2020-761 Heap-buffer-overflow in arrow::ConcatenateBuffers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23848 Crash type: Heap-buffer-overflow READ Crash state: arrow::ConcatenateBuffers arrow::ConcatenateImpl::Visit arrow::Status arrow::VisitTypeInline...

OSV-2020-758 Heap-buffer-overflow in void arrow::internal::TransferBitmap<

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23868 Crash type: Heap-buffer-overflow READ 8 Crash state: void arrow::internal::TransferBitmap arrow::ConcatenateBitmaps arrow::ConcatenateImpl::Concatenate...

OSV-2020-757 Heap-buffer-overflow in cras_channel_remix_conv_create

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23612 Crash type: Heap-buffer-overflow READ 4 Crash state: craschannelremixconvcreate audiothreadconfigglobalremix ccrhandlemessagefromclient...

OSV-2020-756 Use-of-uninitialized-value in spng_read_fuzzer.c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23936 Crash type: Use-of-uninitialized-value Crash state: spngreadfuzzer.c spngreadfuzzer.c...

OSV-2020-755 Heap-use-after-free in xmlParserPrintFileContextInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23765 Crash type: Heap-use-after-free READ 1 Crash state: xmlParserPrintFileContextInternal xmlReportError xmlRaiseError...

OSV-2020-751 Heap-buffer-overflow in readcfgfile

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23653 Crash type: Heap-buffer-overflow WRITE 1 Crash state: readcfgfile fuzzcfgparser.c...

OSV-2020-748 Heap-buffer-overflow in OGR_RawField_IsUnset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23705 Crash type: Heap-buffer-overflow READ 4 Crash state: OGRRawFieldIsUnset OGRFeature::IsFieldSetAndNotNull OGRFeature::OGRFeature...

OSV-2020-747 Heap-use-after-free in check_content_type_and_change_protocol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23691 Crash type: Heap-use-after-free READ 2 Crash state: checkcontenttypeandchangeprotocol ndpicheckhttptcp ndpisearchhttptcp...

OSV-2020-745 Heap-buffer-overflow in memvprintf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23715 Crash type: Heap-buffer-overflow READ 1 Crash state: memvprintf printmessage haalert...

OSV-2020-742 Heap-buffer-overflow in is_codefence

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23764 Crash type: Heap-buffer-overflow READ 1 Crash state: iscodefence parselistitem parsedefinition...

OSV-2020-744 Heap-double-free in mrb_default_allocf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23801 Crash type: Heap-double-free Crash state: mrbdefaultallocf mrbfree objfree...

OSV-2020-741 Heap-buffer-overflow in uri_decoder

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23815 Crash type: Heap-buffer-overflow READ 1 Crash state: uridecoder uridecode guriparseparams...

OSV-2020-743 Heap-buffer-overflow in uri_decoder

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23818 Crash type: Heap-buffer-overflow READ 1 Crash state: uridecoder guriunescapebytes fuzzuriescape.c...

OSV-2020-736 Heap-use-after-free in WelsDec::DecreasePicBuff

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14423 Crash type: Heap-use-after-free READ 8 Crash state: WelsDec::DecreasePicBuff WelsRequestMem SyncPictureResolutionExt...

OSV-2020-739 UNKNOWN READ in str_decref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18756 Crash type: UNKNOWN READ Crash state: strdecref objfree mrbgcdestroy...

OSV-2020-732 Stack-buffer-overflow in ot::MeshCoP::Leader::HandlePetition

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13537 Crash type: Stack-buffer-overflow READ 1 Crash state: ot::MeshCoP::Leader::HandlePetition ot::Coap::CoapBase::ProcessReceivedRequest ot::Ip6::Udp::HandleMessage...

OSV-2020-730 Use-of-uninitialized-value in xmlOutputBufferWriteEscape

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15914 Crash type: Use-of-uninitialized-value Crash state: xmlOutputBufferWriteEscape xmlNodeDumpOutput xsltSaveResultTo...

OSV-2020-729 Stack-buffer-overflow in ot::MeshCoP::Leader::HandlePetition

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13335 Crash type: Stack-buffer-overflow READ 1 Crash state: ot::MeshCoP::Leader::HandlePetition ot::Coap::CoapBase::ProcessReceivedRequest ot::Ip6::Udp::HandleMessage...

OSV-2020-734 Heap-buffer-overflow in Sass::Prelexer::quoted_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Heap-buffer-overflow READ 1 Crash state: Sass::Prelexer::quotedstring char const Sass::Parser::lex& Sass::Parser::parsevalueschema...

OSV-2020-718 UNKNOWN READ in double_from_wkb_state

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18153 Crash type: UNKNOWN READ Crash state: doublefromwkbstate ptarrayfromwkbstate lwlinefromwkbstate...

OSV-2020-727 Use-of-uninitialized-value in psnip_safe_size_mul

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17120 Crash type: Use-of-uninitialized-value Crash state: psnipsafesizemul SafeMul MatVarGetSize...

OSV-2020-725 Heap-buffer-overflow in walk_exports

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18321 Crash type: Heap-buffer-overflow READ 2 Crash state: walkexports getsymbols getmain...

OSV-2020-728 Stack-buffer-overflow in ot::Ip6::OptionPadN::Init

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14854 Crash type: Stack-buffer-overflow WRITE 9 Crash state: ot::Ip6::OptionPadN::Init ot::Ip6::Ip6::RemoveMplOption ot::Ip6::Ip6::ProcessReceiveCallback...

OSV-2020-721 Stack-buffer-overflow in ot::NetworkData::NetworkData::GetNextOnMeshPrefix

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13334 Crash type: Stack-buffer-overflow WRITE Crash state: ot::NetworkData::NetworkData::GetNextOnMeshPrefix ot::Dhcp6::Dhcp6Client::UpdateAddresses ot::Mle::Mle::HandleStateChanged...

OSV-2020-708 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14919 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int hbmapiterthbmapiterthbarraytOT::OffsetToOT::AxisValue, OT::IntTypeu...

OSV-2020-722 Heap-buffer-overflow in r_buf_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15218 Crash type: Heap-buffer-overflow WRITE Crash state: rbufread parsefunctionstarts inititems...

OSV-2020-709 Heap-double-free in sc_pkcs15_free_object_content

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18890 Crash type: Heap-double-free Crash state: scpkcs15freeobjectcontent scpkcs15freeobject fuzzpkcs15decode.c...

OSV-2020-715 Heap-buffer-overflow in cras_rclient_message_from_client

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15058 Crash type: Heap-buffer-overflow READ 4 Crash state: crasrclientmessagefromclient crasrclientbufferfromclient rclientmessage.cc...

OSV-2020-713 Heap-buffer-overflow in XRef::getEntry

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12797 Crash type: Heap-buffer-overflow READ 4 Crash state: XRef::getEntry Parser::makeStream Parser::getObj...

OSV-2020-691 UNKNOWN WRITE in ZSTD_decodeLiteralsBlock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16541 Crash type: UNKNOWN WRITE Crash state: ZSTDdecodeLiteralsBlock ZSTDdecompressBlock ZSTDdecompressDCtx...

OSV-2020-699 Heap-buffer-overflow in ihevcd_process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18406 Crash type: Heap-buffer-overflow READ 4 Crash state: ihevcdprocess ihevcdprocessthread startthread...

OSV-2020-692 Heap-use-after-free in WelsDec::SetUnRef

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18458 Crash type: Heap-use-after-free WRITE 1 Crash state: WelsDec::SetUnRef WelsDec::SlidingWindow WelsDec::WelsMarkAsRef...

OSV-2020-700 Stack-buffer-overflow in ot::Message::Write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15380 Crash type: Stack-buffer-overflow READ Crash state: ot::Message::Write ot::Message::Append ot::Mle::Mle::AppendResponse...

OSV-2020-693 Heap-buffer-overflow in parse_sec_attr_44

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18798 Crash type: Heap-buffer-overflow READ 1 Crash state: parsesecattr44 setcosselectfile scselectfile...

OSV-2020-690 UNKNOWN READ in ot::Coap::CoapBase::RemoveResource

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13369 Crash type: UNKNOWN READ Crash state: ot::Coap::CoapBase::RemoveResource ot::MeshCoP::BorderAgent::Stop ot::Mle::Mle::SetStateDetached...

OSV-2020-701 Heap-use-after-free in read_chunks_before_idat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16266 Crash type: Heap-use-after-free READ Crash state: readchunksbeforeidat getancillary spngdecodedimagesize...

OSV-2020-694 Heap-buffer-overflow in r_read_le32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13942 Crash type: Heap-buffer-overflow READ 1 Crash state: rreadle32 iskernelcache checkbytes...

OSV-2020-705 Use-of-uninitialized-value in xmlOutputBufferWriteEscape

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15768 Crash type: Use-of-uninitialized-value Crash state: xmlOutputBufferWriteEscape xmlNodeListDumpOutput xmlNodeDumpOutputInternal...

OSV-2020-698 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18515 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::ArrayOf, OT::IntType ::...

OSV-2020-704 Heap-buffer-overflow in BEInt<unsigned char, 1>::set

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13736 Crash type: Heap-buffer-overflow WRITE 1 Crash state: BEInt::set CFF::CFFIndex ::setoffsetat bool CFF::FDArray ::serializeCFF::cff2fontdict...

OSV-2020-675 Use-of-uninitialized-value in UA_base64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14625 Crash type: Use-of-uninitialized-value Crash state: UAbase64 ByteStringencodeJson VariantencodeJson...

OSV-2020-681 Heap-use-after-free in WelsDec::SetUnRef

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18459 Crash type: Heap-use-after-free WRITE 1 Crash state: WelsDec::SetUnRef WelsDec::WelsDelLongFromListSetUnref WelsDec::MMCOProcess...

OSV-2020-677 Heap-buffer-overflow in load

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15007 Crash type: Heap-buffer-overflow READ 4 Crash state: load rbinobjectnew rbinfilenewfrombuffer...

OSV-2020-676 Heap-use-after-free in String_clear

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14567 Crash type: Heap-use-after-free READ 8 Crash state: Stringclear clearStructure UAArraydelete...

OSV-2020-688 Heap-use-after-free in icalparameter_new_from_value_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14737 Crash type: Heap-use-after-free READ 2 Crash state: icalparameternewfromvaluestring icalparseraddline icalparserparse...

OSV-2020-685 Global-buffer-overflow in backup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18464 Crash type: Global-buffer-overflow READ 1 Crash state: backup peek lexconfig...

OSV-2020-680 Bad-free in sc_pkcs15_decode_prkdf_entry

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18482 Crash type: Bad-free Crash state: scpkcs15decodeprkdfentry fuzzpkcs15decode.c...

OSV-2020-682 Heap-use-after-free in condition_free_list_type

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13878 Crash type: Heap-use-after-free READ 8 Crash state: conditionfreelisttype linkconfigfree linkloadone...

OSV-2020-679 Use-of-uninitialized-value in printUInt32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14642 Crash type: Use-of-uninitialized-value Crash state: printUInt32 printU1ImmOperand printInstruction...

OSV-2020-670 Memcpy-param-overlap in ot::Cli::CoapSecure::Process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12679 Crash type: Memcpy-param-overlap Crash state: ot::Cli::CoapSecure::Process ot::Cli::Interpreter::ProcessCoapSecure ot::Cli::Interpreter::ProcessLine...