OSV-2020-802 UNKNOWN READ

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22234 Crash type: UNKNOWN READ Crash state: NULL...

OSV-2020-800 UNKNOWN READ in std::__1::__tree<std::__1::__value_type<std::__1::basic_string<char, std::__1::c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24051 Crash type: UNKNOWN READ Crash state: std::1::tree, std::1...

OSV-2020-799 Heap-buffer-overflow in ReadInt32DataDouble

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21421 Crash type: Heap-buffer-overflow WRITE 4 Crash state: ReadInt32DataDouble ReadInt32Data MatVarRead4...

OSV-2020-796 Use-of-uninitialized-value in Mat_VarRead5

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17118 Crash type: Use-of-uninitialized-value Crash state: MatVarRead5 MatVarRead5 MatVarRead5...

OSV-2020-797 Use-of-uninitialized-value in MipsAsmParser::isPicAndNotNxxAbi

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22778 Crash type: Use-of-uninitialized-value Crash state: MipsAsmParser::isPicAndNotNxxAbi MipsAsmParser::processInstruction MipsAsmParser::MatchAndEmitInstruction...

OSV-2020-794 Use-of-uninitialized-value in Splash::pipeRunSimpleXBGR8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23086 Crash type: Use-of-uninitialized-value Crash state: Splash::pipeRunSimpleXBGR8 Splash::blitImage Splash::drawImage...

OSV-2020-795 Heap-buffer-overflow in ndpi_search_setup_iax

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23831 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpisearchsetupiax ndpisearchiax checkndpiudpflowfunc...

OSV-2020-792 Use-of-uninitialized-value in ihevc_inter_pred_chroma_copy_ssse3

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23197 Crash type: Use-of-uninitialized-value Crash state: ihevcinterpredchromacopyssse3 ihevcdinterpredctb ihevcdprocess...

OSV-2020-790 Use-of-uninitialized-value in clang::tok::isAnnotation

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18444 Crash type: Use-of-uninitialized-value Crash state: clang::tok::isAnnotation clang::TokenLexer::Lex clang::Preprocessor::Lex...

OSV-2020-789 Heap-use-after-free in llvm_ks::X86Operand::getToken

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22850 Crash type: Heap-use-after-free READ 4 Crash state: llvmks::X86Operand::getToken X86AsmParser::MatchAndEmitATTInstruction X86AsmParser::MatchAndEmitInstruction...

OSV-2020-791 UNKNOWN READ in BZ2_decompress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15639 Crash type: UNKNOWN READ Crash state: BZ2decompress BZ2bzDecompress ftbzip2filefilloutput...

OSV-2020-786 UNKNOWN READ in H5T__bit_find

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23887 Crash type: UNKNOWN READ Crash state: H5Tbitfind H5Tconvii H5Tconvert...

OSV-2020-784 Bad-cast to zmq::session_base_t from invalid vptr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24018 Crash type: Bad-cast Crash state: Bad-cast to zmq::sessionbaset from invalid vptr zmq::streamenginebaset::ineventinternal zmq::streamenginebaset::inevent...

OSV-2020-785 Heap-buffer-overflow in sctp_handle_packet_dropped

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23656 Crash type: Heap-buffer-overflow READ 1 Crash state: sctphandlepacketdropped sctpprocesscontrol sctpcommoninputprocessing...

OSV-2020-783 UNKNOWN READ in wabt::BinaryReaderIR::OnFunctionSymbol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20364 Crash type: UNKNOWN READ Crash state: wabt::BinaryReaderIR::OnFunctionSymbol wabt::BinaryReader::ReadLinkingSection wabt::BinaryReader::ReadCustomSection...

OSV-2020-781 Heap-buffer-overflow in __libcpp_memchr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23328 Crash type: Heap-buffer-overflow READ Crash state: libcppmemchr memchr pcpp::HeaderField::HeaderField...

OSV-2020-782 UNKNOWN READ in H5O_dtype_decode_helper

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23320 Crash type: UNKNOWN READ Crash state: H5Odtypedecodehelper H5Odtypeshareddecode H5Oattrshareddecode...

OSV-2020-780 Segv on unknown address in ndpi_strdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22676 Crash type: Segv on unknown address Crash state: ndpistrdup processndpicollectedinfo packetprocessing...

OSV-2020-778 Heap-use-after-free in void draco::Metadata::AddEntry<std::__1::vector<unsigned char, std::__1::allocat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24044 Crash type: Heap-use-after-free READ 8 Crash state: void draco::Metadata::AddEntrystd::1::vectorunsigned char, std::1::allocat draco::MetadataDecoder::DecodeEntry draco::MetadataDecoder::DecodeMetadata...

OSV-2020-776 Negative-size-param in arrow::ConcatenateBuffers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24101 Crash type: Negative-size-param Crash state: arrow::ConcatenateBuffers arrow::ConcatenateImpl::Visit arrow::Status arrow::VisitTypeInline...

OSV-2020-775 Use-of-uninitialized-value in blosc_run_decompression_with_context

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23826 Crash type: Use-of-uninitialized-value Crash state: bloscrundecompressionwithcontext bloscdecompress fuzzdecompress.c...

OSV-2020-774 Heap-buffer-overflow in ndpi_search_kerberos

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23021 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpisearchkerberos checkndpiudpflowfunc ndpicheckflowfunc...

OSV-2020-773 Heap-buffer-overflow in pcpp::SSLCertificateRequestMessage::SSLCertificateRequestMessage

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23592 Crash type: Heap-buffer-overflow READ 1 Crash state: pcpp::SSLCertificateRequestMessage::SSLCertificateRequestMessage pcpp::SSLHandshakeMessage::createHandhakeMessage pcpp::SSLHandshakeLayer::SSLHandshakeLayer...

OSV-2020-772 Heap-buffer-overflow in __libcpp_strstr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23601 Crash type: Heap-buffer-overflow READ 4 Crash state: libcppstrstr strstr pcpp::SipRequestFirstLine::parseVersion...

OSV-2020-769 Heap-buffer-overflow in perfetto::trace_processor::ClockTracker::ConvertSlowpath

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23149 Crash type: Heap-buffer-overflow READ 8 Crash state: perfetto::traceprocessor::ClockTracker::ConvertSlowpath perfetto::traceprocessor::ClockTracker::Convert perfetto::traceprocessor::ClockTracker::ToTraceTime...

OSV-2020-762 Heap-buffer-overflow in blosclz_compress

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23794 Crash type: Heap-buffer-overflow WRITE 1 Crash state: blosclzcompress bloscc dojob...

OSV-2020-761 Heap-buffer-overflow in arrow::ConcatenateBuffers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23848 Crash type: Heap-buffer-overflow READ Crash state: arrow::ConcatenateBuffers arrow::ConcatenateImpl::Visit arrow::Status arrow::VisitTypeInline...

OSV-2020-758 Heap-buffer-overflow in void arrow::internal::TransferBitmap<

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23868 Crash type: Heap-buffer-overflow READ 8 Crash state: void arrow::internal::TransferBitmap arrow::ConcatenateBitmaps arrow::ConcatenateImpl::Concatenate...

OSV-2020-757 Heap-buffer-overflow in cras_channel_remix_conv_create

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23612 Crash type: Heap-buffer-overflow READ 4 Crash state: craschannelremixconvcreate audiothreadconfigglobalremix ccrhandlemessagefromclient...

OSV-2020-755 Heap-use-after-free in xmlParserPrintFileContextInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23765 Crash type: Heap-use-after-free READ 1 Crash state: xmlParserPrintFileContextInternal xmlReportError xmlRaiseError...

OSV-2020-756 Use-of-uninitialized-value in spng_read_fuzzer.c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23936 Crash type: Use-of-uninitialized-value Crash state: spngreadfuzzer.c spngreadfuzzer.c...

OSV-2020-751 Heap-buffer-overflow in readcfgfile

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23653 Crash type: Heap-buffer-overflow WRITE 1 Crash state: readcfgfile fuzzcfgparser.c...

OSV-2020-748 Heap-buffer-overflow in OGR_RawField_IsUnset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23705 Crash type: Heap-buffer-overflow READ 4 Crash state: OGRRawFieldIsUnset OGRFeature::IsFieldSetAndNotNull OGRFeature::OGRFeature...

OSV-2020-747 Heap-use-after-free in check_content_type_and_change_protocol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23691 Crash type: Heap-use-after-free READ 2 Crash state: checkcontenttypeandchangeprotocol ndpicheckhttptcp ndpisearchhttptcp...

OSV-2020-745 Heap-buffer-overflow in memvprintf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23715 Crash type: Heap-buffer-overflow READ 1 Crash state: memvprintf printmessage haalert...

OSV-2020-744 Heap-double-free in mrb_default_allocf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23801 Crash type: Heap-double-free Crash state: mrbdefaultallocf mrbfree objfree...

OSV-2020-741 Heap-buffer-overflow in uri_decoder

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23815 Crash type: Heap-buffer-overflow READ 1 Crash state: uridecoder uridecode guriparseparams...

OSV-2020-742 Heap-buffer-overflow in is_codefence

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23764 Crash type: Heap-buffer-overflow READ 1 Crash state: iscodefence parselistitem parsedefinition...

OSV-2020-743 Heap-buffer-overflow in uri_decoder

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23818 Crash type: Heap-buffer-overflow READ 1 Crash state: uridecoder guriunescapebytes fuzzuriescape.c...

OSV-2020-739 UNKNOWN READ in str_decref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18756 Crash type: UNKNOWN READ Crash state: strdecref objfree mrbgcdestroy...

OSV-2020-729 Stack-buffer-overflow in ot::MeshCoP::Leader::HandlePetition

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13335 Crash type: Stack-buffer-overflow READ 1 Crash state: ot::MeshCoP::Leader::HandlePetition ot::Coap::CoapBase::ProcessReceivedRequest ot::Ip6::Udp::HandleMessage...

OSV-2020-734 Heap-buffer-overflow in Sass::Prelexer::quoted_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Heap-buffer-overflow READ 1 Crash state: Sass::Prelexer::quotedstring char const Sass::Parser::lex& Sass::Parser::parsevalueschema...

OSV-2020-732 Stack-buffer-overflow in ot::MeshCoP::Leader::HandlePetition

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13537 Crash type: Stack-buffer-overflow READ 1 Crash state: ot::MeshCoP::Leader::HandlePetition ot::Coap::CoapBase::ProcessReceivedRequest ot::Ip6::Udp::HandleMessage...

OSV-2020-730 Use-of-uninitialized-value in xmlOutputBufferWriteEscape

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15914 Crash type: Use-of-uninitialized-value Crash state: xmlOutputBufferWriteEscape xmlNodeDumpOutput xsltSaveResultTo...

OSV-2020-736 Heap-use-after-free in WelsDec::DecreasePicBuff

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14423 Crash type: Heap-use-after-free READ 8 Crash state: WelsDec::DecreasePicBuff WelsRequestMem SyncPictureResolutionExt...

OSV-2020-718 UNKNOWN READ in double_from_wkb_state

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18153 Crash type: UNKNOWN READ Crash state: doublefromwkbstate ptarrayfromwkbstate lwlinefromwkbstate...

OSV-2020-727 Use-of-uninitialized-value in psnip_safe_size_mul

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17120 Crash type: Use-of-uninitialized-value Crash state: psnipsafesizemul SafeMul MatVarGetSize...

OSV-2020-725 Heap-buffer-overflow in walk_exports

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18321 Crash type: Heap-buffer-overflow READ 2 Crash state: walkexports getsymbols getmain...

OSV-2020-715 Heap-buffer-overflow in cras_rclient_message_from_client

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15058 Crash type: Heap-buffer-overflow READ 4 Crash state: crasrclientmessagefromclient crasrclientbufferfromclient rclientmessage.cc...

OSV-2020-713 Heap-buffer-overflow in XRef::getEntry

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12797 Crash type: Heap-buffer-overflow READ 4 Crash state: XRef::getEntry Parser::makeStream Parser::getObj...