OSV-2020-631 Stack-use-after-return in ihevcd_process_thread

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17500 Crash type: Stack-use-after-return READ 8 Crash state: ihevcdprocessthread startthread...

OSV-2020-624 Heap-buffer-overflow in LZ4_write32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15941 Crash type: Heap-buffer-overflow WRITE 4 Crash state: LZ4write32 LZ4compressfastextState LZ4compressfast...

OSV-2020-635 Use-of-uninitialized-value in varlink_write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14688 Crash type: Use-of-uninitialized-value Crash state: varlinkwrite varlinkprocess defercallback...

OSV-2020-628 UNKNOWN READ in copy_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15482 Crash type: UNKNOWN READ Crash state: copystring douncompressblock processblock...

OSV-2020-632 Global-buffer-overflow in parse_http_request

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14582 Crash type: Global-buffer-overflow READ 1 Crash state: parsehttprequest fuzzparsehttprequest...

OSV-2020-640 Stack-buffer-overflow in ot::Message::Write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15447 Crash type: Stack-buffer-overflow READ Crash state: ot::Message::Write ot::Message::Append ot::AddressResolver::SendAddressQueryResponse...

OSV-2020-625 Heap-buffer-overflow in r_read_le32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13945 Crash type: Heap-buffer-overflow READ 1 Crash state: rreadle32 rreadle64 iskernelcache...

OSV-2020-614 Use-of-uninitialized-value in __RefHead_ZIP_INSERT

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15133 Crash type: Use-of-uninitialized-value Crash state: RefHeadZIPINSERT RefHeadZIPINSERT RefTreeadd...

OSV-2020-619 UNKNOWN READ in ot::Ip6::Netif::UnsubscribeAllRoutersMulticast

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13353 Crash type: UNKNOWN READ Crash state: ot::Ip6::Netif::UnsubscribeAllRoutersMulticast ot::Mle::MleRouter::HandleDetachStart ot::Mle::Mle::SetStateDetached...

OSV-2020-608 UNKNOWN READ in ot::Ip6::Address::PrefixMatch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13349 Crash type: UNKNOWN READ Crash state: ot::Ip6::Address::PrefixMatch ot::Dhcp6::Dhcp6Server::RemovePrefixAgent ot::Dhcp6::Dhcp6Server::UpdateService...

OSV-2020-605 Global-buffer-overflow in parse_headers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14232 Crash type: Global-buffer-overflow READ 4 Crash state: parseheaders parsehttprequest fuzzparsehttprequest...

OSV-2020-610 UNKNOWN READ in opj_t2_decode_packets

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18979 Crash type: UNKNOWN READ Crash state: opjt2decodepackets opjtcdt2decode opjtcddecodetile...

OSV-2020-612 Use-of-uninitialized-value in std::__1::vector<std::__1::vector<Sass::SharedImpl<Sass::ComplexSelector>, std::

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18066 Crash type: Use-of-uninitialized-value Crash state: std::1::vector, std:: Sass::ComplexSelector::resolveparentrefs Sass::Eval::operator...

OSV-2020-607 UNKNOWN READ in WelsDec::CWelsDecoder::DecodeFrame2WithCtx

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18864 Crash type: UNKNOWN READ Crash state: WelsDec::CWelsDecoder::DecodeFrame2WithCtx WelsDec::CWelsDecoder::DecodeFrame2 WelsDec::CWelsDecoder::DecodeFrameNoDelay...

OSV-2020-596 UNKNOWN READ in ot::PriorityQueue::GetHead

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13388 Crash type: UNKNOWN READ Crash state: ot::PriorityQueue::GetHead ot::Ip6::Ip6::HandleSendQueue ot::TaskletScheduler::ProcessQueuedTasklets...

OSV-2020-600 Use-of-uninitialized-value in dprintf_formatf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16699 Crash type: Use-of-uninitialized-value Crash state: dprintfformatf curlmvsnprintf curlmsnprintf...

OSV-2020-598 UNKNOWN READ in ot::Message::GetPriority

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13380 Crash type: UNKNOWN READ Crash state: ot::Message::GetPriority ot::PriorityQueue::RemoveFromList ot::PriorityQueue::Dequeue...

OSV-2020-604 UNKNOWN READ in Sass::Parser::parseCompoundSelector

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15904 Crash type: UNKNOWN READ Crash state: Sass::Parser::parseCompoundSelector Sass::Parser::parseComplexSelector Sass::Parser::parseSelectorList...

OSV-2020-597 UNKNOWN READ in ot::MessageQueue::GetHead

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13386 Crash type: UNKNOWN READ Crash state: ot::MessageQueue::GetHead ot::Coap::CoapBase::ClearRequestsAndResponses ot::Coap::CoapSecure::Stop...

OSV-2020-593 Heap-buffer-overflow in UInt32_encodeBinary

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12889 Crash type: Heap-buffer-overflow READ 4 Crash state: UInt32encodeBinary DiagnosticInfoencodeBinary DiagnosticInfoencodeBinary...

OSV-2020-599 Index-out-of-bounds in prepare_macpads

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14768 Crash type: Index-out-of-bounds Crash state: preparemacpads gcrymdsetkey gcrymacsetkey...

OSV-2020-578 Heap-use-after-free in WelsDec::ResetRefPicReferences

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13450 Crash type: Heap-use-after-free READ 8 Crash state: WelsDec::ResetRefPicReferences WelsDec::DecreasePicBuff WelsRequestMem...

OSV-2020-584 Heap-buffer-overflow in collator_compare_fuzzer.cpp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15499 Crash type: Heap-buffer-overflow WRITE 3 Crash state: collatorcomparefuzzer.cpp...

OSV-2020-580 Heap-buffer-overflow in ots::OpenTypeSTAT::Serialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12840 Crash type: Heap-buffer-overflow READ 2 Crash state: ots::OpenTypeSTAT::Serialize ProcessGeneric ProcessTTF...

OSV-2020-587 UNKNOWN READ in Interpreter::evaluate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15844 Crash type: UNKNOWN READ Crash state: Interpreter::evaluate jsonnetvmexecute jsonnetevaluatesnippetaux...

OSV-2020-589 UNKNOWN WRITE in perfetto::trace_processor::ProtoTraceParser::ParsePowerRails

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14018 Crash type: UNKNOWN WRITE Crash state: perfetto::traceprocessor::ProtoTraceParser::ParsePowerRails perfetto::traceprocessor::ProtoTraceParser::ParseTracePacket...

OSV-2020-585 Heap-buffer-overflow in ihevcd_get_mv_ctb

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17286 Crash type: Heap-buffer-overflow WRITE 1 Crash state: ihevcdgetmvctb ihevcdprocess ihevcddecode...

OSV-2020-567 Heap-buffer-overflow in _iri_unescape_inline

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14449 Crash type: Heap-buffer-overflow READ 1 Crash state: iriunescapeinline wgetiriparse init...

OSV-2020-570 Global-buffer-overflow in decode_tlv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13542 Crash type: Global-buffer-overflow READ 4 Crash state: decodetlv dissectnoe calldissectorwork...

OSV-2020-562 UNKNOWN READ in local_add_lv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18030 Crash type: UNKNOWN READ Crash state: localaddlv yyparse mrbparserparse...

OSV-2020-574 Negative-size-param in r_buf_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14832 Crash type: Negative-size-param Crash state: rbufread binpegetcertificate binpeinit...

OSV-2020-565 Use-of-uninitialized-value in OT::AxisValue::sanitize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14850 Crash type: Use-of-uninitialized-value Crash state: OT::AxisValue::sanitize bool OT::OffsetTo, true::sanitiz bool OT::UnsizedArrayOfOT::OffsetToOT::AxisValue, OT::IntTypeunsigned short,...

OSV-2020-568 Heap-use-after-free in proc_plaintext

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13730 Crash type: Heap-use-after-free READ 4 Crash state: procplaintext doprocpackets procsignaturepackets...

OSV-2020-569 Null-dereference READ

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15388 Crash type: Null-dereference READ Crash state: NULL...

OSV-2020-573 UNKNOWN READ in (__has_construct<std::__1::allocator<unsigned

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14479 Crash type: UNKNOWN READ Crash state: hasconstruct::value, void::t std::1::vector ::vectoruns...

OSV-2020-564 Heap-buffer-overflow in ihevcd_parse_slice_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17031 Crash type: Heap-buffer-overflow WRITE 1 Crash state: ihevcdparseslicedata ihevcdnalunit ihevcddecode...

OSV-2020-552 Heap-buffer-overflow in varlink_enqueue_json

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14708 Crash type: Heap-buffer-overflow WRITE Crash state: varlinkenqueuejson varlinkerror varlinkerrorb...

OSV-2020-560 Heap-use-after-free in cin_get

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15200 Crash type: Heap-use-after-free READ 1 Crash state: cinget gettoken prim...

OSV-2020-555 Heap-use-after-free in WelsDec::CWelsDecoder::SetOption

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18747 Crash type: Heap-use-after-free WRITE 1 Crash state: WelsDec::CWelsDecoder::SetOption decoderfuzzer.cpp WelsCommon::WelsFree...

OSV-2020-546 Heap-buffer-overflow in ih264d_decode_slice_thread

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18960 Crash type: Heap-buffer-overflow READ 8 Crash state: ih264ddecodeslicethread ih264ddecodepicturethread startthread...

OSV-2020-559 Use-of-uninitialized-value in parser_get_next_char

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14739 Crash type: Use-of-uninitialized-value Crash state: parsergetnextchar parsergetparamnameheap icalparseraddline...

OSV-2020-548 Heap-buffer-overflow in acommon::DecodeDirect<unsigned short>::decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16531 Crash type: Heap-buffer-overflow READ 2 Crash state: acommon::DecodeDirect::decode acommon::Convert::convert aspellspellersuggest...

OSV-2020-557 Global-buffer-overflow in dissect_snmp_PDUs

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18816 Crash type: Global-buffer-overflow READ 4 Crash state: dissectsnmpPDUs dissectberchoice dissectsnmpRegisterResponse...

OSV-2020-535 Heap-buffer-overflow in looks_ucs32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13222 Crash type: Heap-buffer-overflow READ 1 Crash state: looksucs32 fileencoding filebuffer...

OSV-2020-543 Heap-buffer-overflow in circular_memcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14574 Crash type: Heap-buffer-overflow READ 8 Crash state: circularmemcpy runarmfilter runfilter...

OSV-2020-541 UNKNOWN READ in _fini

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15391 Crash type: UNKNOWN READ Crash state: fini...

OSV-2020-540 Heap-buffer-overflow in byte_from_wkb_state

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16591 Crash type: Heap-buffer-overflow READ 1 Crash state: bytefromwkbstate lwgeomfromwkbstate lwcollectionfromwkbstate...

OSV-2020-533 Heap-buffer-overflow in r_utf8_strlen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13726 Crash type: Heap-buffer-overflow READ 1 Crash state: rutf8strlen getstr parseclass...

OSV-2020-526 Use-of-uninitialized-value in Mat_VarRead4

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16857 Crash type: Use-of-uninitialized-value Crash state: MatVarRead4 MatVarReadDataAll matiofuzzer.cc...

OSV-2020-523 Heap-buffer-overflow in check_buffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15003 Crash type: Heap-buffer-overflow READ 1 Crash state: checkbuffer rbingetbinpluginbybuffer getpluginfrombuffer...