OSV-2020-671 Heap-use-after-free in WelsDec::SetUnRef

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18743 Crash type: Heap-use-after-free WRITE 1 Crash state: WelsDec::SetUnRef WelsDec::SlidingWindow WelsDec::WelsMarkAsRef...

OSV-2020-670 Memcpy-param-overlap in ot::Cli::CoapSecure::Process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12679 Crash type: Memcpy-param-overlap Crash state: ot::Cli::CoapSecure::Process ot::Cli::Interpreter::ProcessCoapSecure ot::Cli::Interpreter::ProcessLine...

OSV-2020-669 Use-of-uninitialized-value in g_date_time_get_week_number

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17648 Crash type: Use-of-uninitialized-value Crash state: gdatetimegetweeknumber gdatetimenewweek parseisoNUMBERdate...

OSV-2020-668 Heap-buffer-overflow in post_process_template

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19013 Crash type: Heap-buffer-overflow READ 4 Crash state: postprocesstemplate parsershutdown parsestring...

OSV-2020-673 UNKNOWN WRITE in htp_connp_res_buffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19323 Crash type: UNKNOWN WRITE Crash state: htpconnpresbuffer htpconnpRESLINE htpconnpresdata...

OSV-2020-672 Stack-buffer-overflow in ot::NetworkData::NetworkData::PrefixMatch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13333 Crash type: Stack-buffer-overflow READ 1 Crash state: ot::NetworkData::NetworkData::PrefixMatch ot::NetworkData::LeaderBase::GetContext ot::Mle::MleRouter::GetNeighbor...

OSV-2020-674 Heap-buffer-overflow in ihevcd_mv_merge

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17196 Crash type: Heap-buffer-overflow READ 4 Crash state: ihevcdmvmerge ihevcdgetmvctb ihevcdparseslicedata...

OSV-2020-663 Heap-buffer-overflow in Variant_decodeJson

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18259 Crash type: Heap-buffer-overflow READ 4 Crash state: VariantdecodeJson UAdecodeJson fuzzjsondecodeencode.cc...

OSV-2020-665 Global-buffer-overflow in backup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18447 Crash type: Global-buffer-overflow READ 1 Crash state: backup lexstring lexnext...

OSV-2020-653 Heap-buffer-overflow in perfetto::base::Hash::Update

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14753 Crash type: Heap-buffer-overflow READ 1 Crash state: perfetto::base::Hash::Update perfetto::base::StringView::Hash perfetto::traceprocessor::StringPool::InternString...

OSV-2020-651 Stack-buffer-overflow in tvb_memcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15936 Crash type: Stack-buffer-overflow WRITE Crash state: tvbmemcpy quicextractheader dissectquic...

OSV-2020-642 Stack-use-after-return in sdb_itoa

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12751 Crash type: Stack-use-after-return WRITE 1 Crash state: sdbitoa parseresourcedirectory parseresourcedirectory...

OSV-2020-641 Use-of-uninitialized-value in bool std::__1::equal<std::__1::__wrap_iter<unsigned char const*>, std::__1::__wr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14353 Crash type: Use-of-uninitialized-value Crash state: bool std::1::equal, std::1::wr bool std::1::operator== std::1::enableifisconvertiblevdecltype...

OSV-2020-654 Heap-buffer-overflow in ZSTD_copy16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17451 Crash type: Heap-buffer-overflow READ 16 Crash state: ZSTDcopy16 ZSTDdecompressSequencesbmi2 ZSTDdecompressBlockinternal...

OSV-2020-658 Heap-buffer-overflow in inflate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15495 Crash type: Heap-buffer-overflow READ 1 Crash state: inflate perfetto::traceprocessor::GzipTraceParser::Parse perfetto::traceprocessor::TraceProcessorImpl::Parse...

OSV-2020-657 UNKNOWN READ in perfetto::trace_processor::ProtoTraceParser::ParseTypedFtraceToRaw

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13724 Crash type: UNKNOWN READ Crash state: perfetto::traceprocessor::ProtoTraceParser::ParseTypedFtraceToRaw perfetto::traceprocessor::ProtoTraceParser::ParseFtracePacket...

OSV-2020-643 UNKNOWN READ in ot::Ip6::UdpSocket::GetNext

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13405 Crash type: UNKNOWN READ Crash state: ot::Ip6::UdpSocket::GetNext ot::Ip6::Udp::AddSocket ot::Ip6::UdpSocket::Open...

OSV-2020-649 Heap-use-after-free in sctp_fill_hmac_digest_m

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18080 Crash type: Heap-use-after-free WRITE Crash state: sctpfillhmacdigestm sctplowlevelchunkoutput sctpmedchunkoutput...

OSV-2020-631 Stack-use-after-return in ihevcd_process_thread

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17500 Crash type: Stack-use-after-return READ 8 Crash state: ihevcdprocessthread startthread...

OSV-2020-639 UNKNOWN READ in ot::Dhcp6::Dhcp6Client::UpdateAddresses

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13332 Crash type: UNKNOWN READ Crash state: ot::Dhcp6::Dhcp6Client::UpdateAddresses ot::Mle::Mle::HandleStateChanged ot::Notifier::HandleStateChanged...

OSV-2020-625 Heap-buffer-overflow in r_read_le32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13945 Crash type: Heap-buffer-overflow READ 1 Crash state: rreadle32 rreadle64 iskernelcache...

OSV-2020-638 Heap-buffer-overflow in OT::UnsizedArrayOf<OT::IntType<unsigned char, 1u> >::copy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14637 Crash type: Heap-buffer-overflow READ 1 Crash state: OT::UnsizedArrayOf ::copy bool OT::OffsetTo , OT::IntTy OT::NameRecord::copy...

OSV-2020-632 Global-buffer-overflow in parse_http_request

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14582 Crash type: Global-buffer-overflow READ 1 Crash state: parsehttprequest fuzzparsehttprequest...

OSV-2020-630 Use-of-uninitialized-value in ares__parse_into_addrinfo2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15379 Crash type: Use-of-uninitialized-value Crash state: aresparseintoaddrinfo2 aresparseaaaareply ares-test-fuzz.c...

OSV-2020-624 Heap-buffer-overflow in LZ4_write32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15941 Crash type: Heap-buffer-overflow WRITE 4 Crash state: LZ4write32 LZ4compressfastextState LZ4compressfast...

OSV-2020-628 UNKNOWN READ in copy_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15482 Crash type: UNKNOWN READ Crash state: copystring douncompressblock processblock...

OSV-2020-635 Use-of-uninitialized-value in varlink_write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14688 Crash type: Use-of-uninitialized-value Crash state: varlinkwrite varlinkprocess defercallback...

OSV-2020-633 Global-buffer-overflow in ne_find_element

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15056 Crash type: Global-buffer-overflow READ 8 Crash state: nefindelement neparse nestegginit...

OSV-2020-626 UNKNOWN READ in ot::Buffer::GetNextBuffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13412 Crash type: UNKNOWN READ Crash state: ot::Buffer::GetNextBuffer ot::MessagePool::FreeBuffers ot::Coap::ResponsesQueue::DequeueAllResponses...

OSV-2020-640 Stack-buffer-overflow in ot::Message::Write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15447 Crash type: Stack-buffer-overflow READ Crash state: ot::Message::Write ot::Message::Append ot::AddressResolver::SendAddressQueryResponse...

OSV-2020-629 Heap-buffer-overflow in bytestring_to_str

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19070 Crash type: Heap-buffer-overflow READ 1 Crash state: bytestringtostr dissectNUMBERacflin calldissectorwork...

OSV-2020-608 UNKNOWN READ in ot::Ip6::Address::PrefixMatch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13349 Crash type: UNKNOWN READ Crash state: ot::Ip6::Address::PrefixMatch ot::Dhcp6::Dhcp6Server::RemovePrefixAgent ot::Dhcp6::Dhcp6Server::UpdateService...

OSV-2020-612 Use-of-uninitialized-value in std::__1::vector<std::__1::vector<Sass::SharedImpl<Sass::ComplexSelector>, std::

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18066 Crash type: Use-of-uninitialized-value Crash state: std::1::vector, std:: Sass::ComplexSelector::resolveparentrefs Sass::Eval::operator...

OSV-2020-605 Global-buffer-overflow in parse_headers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14232 Crash type: Global-buffer-overflow READ 4 Crash state: parseheaders parsehttprequest fuzzparsehttprequest...

OSV-2020-614 Use-of-uninitialized-value in __RefHead_ZIP_INSERT

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15133 Crash type: Use-of-uninitialized-value Crash state: RefHeadZIPINSERT RefHeadZIPINSERT RefTreeadd...

OSV-2020-610 UNKNOWN READ in opj_t2_decode_packets

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18979 Crash type: UNKNOWN READ Crash state: opjt2decodepackets opjtcdt2decode opjtcddecodetile...

OSV-2020-619 UNKNOWN READ in ot::Ip6::Netif::UnsubscribeAllRoutersMulticast

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13353 Crash type: UNKNOWN READ Crash state: ot::Ip6::Netif::UnsubscribeAllRoutersMulticast ot::Mle::MleRouter::HandleDetachStart ot::Mle::Mle::SetStateDetached...

OSV-2020-607 UNKNOWN READ in WelsDec::CWelsDecoder::DecodeFrame2WithCtx

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18864 Crash type: UNKNOWN READ Crash state: WelsDec::CWelsDecoder::DecodeFrame2WithCtx WelsDec::CWelsDecoder::DecodeFrame2 WelsDec::CWelsDecoder::DecodeFrameNoDelay...

OSV-2020-596 UNKNOWN READ in ot::PriorityQueue::GetHead

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13388 Crash type: UNKNOWN READ Crash state: ot::PriorityQueue::GetHead ot::Ip6::Ip6::HandleSendQueue ot::TaskletScheduler::ProcessQueuedTasklets...

OSV-2020-597 UNKNOWN READ in ot::MessageQueue::GetHead

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13386 Crash type: UNKNOWN READ Crash state: ot::MessageQueue::GetHead ot::Coap::CoapBase::ClearRequestsAndResponses ot::Coap::CoapSecure::Stop...

OSV-2020-599 Index-out-of-bounds in prepare_macpads

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14768 Crash type: Index-out-of-bounds Crash state: preparemacpads gcrymdsetkey gcrymacsetkey...

OSV-2020-600 Use-of-uninitialized-value in dprintf_formatf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16699 Crash type: Use-of-uninitialized-value Crash state: dprintfformatf curlmvsnprintf curlmsnprintf...

OSV-2020-593 Heap-buffer-overflow in UInt32_encodeBinary

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12889 Crash type: Heap-buffer-overflow READ 4 Crash state: UInt32encodeBinary DiagnosticInfoencodeBinary DiagnosticInfoencodeBinary...

OSV-2020-604 UNKNOWN READ in Sass::Parser::parseCompoundSelector

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15904 Crash type: UNKNOWN READ Crash state: Sass::Parser::parseCompoundSelector Sass::Parser::parseComplexSelector Sass::Parser::parseSelectorList...

OSV-2020-598 UNKNOWN READ in ot::Message::GetPriority

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13380 Crash type: UNKNOWN READ Crash state: ot::Message::GetPriority ot::PriorityQueue::RemoveFromList ot::PriorityQueue::Dequeue...

OSV-2020-580 Heap-buffer-overflow in ots::OpenTypeSTAT::Serialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12840 Crash type: Heap-buffer-overflow READ 2 Crash state: ots::OpenTypeSTAT::Serialize ProcessGeneric ProcessTTF...

OSV-2020-585 Heap-buffer-overflow in ihevcd_get_mv_ctb

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17286 Crash type: Heap-buffer-overflow WRITE 1 Crash state: ihevcdgetmvctb ihevcdprocess ihevcddecode...

OSV-2020-589 UNKNOWN WRITE in perfetto::trace_processor::ProtoTraceParser::ParsePowerRails

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14018 Crash type: UNKNOWN WRITE Crash state: perfetto::traceprocessor::ProtoTraceParser::ParsePowerRails perfetto::traceprocessor::ProtoTraceParser::ParseTracePacket...

OSV-2020-587 UNKNOWN READ in Interpreter::evaluate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15844 Crash type: UNKNOWN READ Crash state: Interpreter::evaluate jsonnetvmexecute jsonnetevaluatesnippetaux...

OSV-2020-578 Heap-use-after-free in WelsDec::ResetRefPicReferences

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13450 Crash type: Heap-use-after-free READ 8 Crash state: WelsDec::ResetRefPicReferences WelsDec::DecreasePicBuff WelsRequestMem...