OSV-2020-584 Heap-buffer-overflow in collator_compare_fuzzer.cpp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15499 Crash type: Heap-buffer-overflow WRITE 3 Crash state: collatorcomparefuzzer.cpp...

OSV-2020-569 Null-dereference READ

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15388 Crash type: Null-dereference READ Crash state: NULL...

OSV-2020-564 Heap-buffer-overflow in ihevcd_parse_slice_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17031 Crash type: Heap-buffer-overflow WRITE 1 Crash state: ihevcdparseslicedata ihevcdnalunit ihevcddecode...

OSV-2020-567 Heap-buffer-overflow in _iri_unescape_inline

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14449 Crash type: Heap-buffer-overflow READ 1 Crash state: iriunescapeinline wgetiriparse init...

OSV-2020-570 Global-buffer-overflow in decode_tlv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13542 Crash type: Global-buffer-overflow READ 4 Crash state: decodetlv dissectnoe calldissectorwork...

OSV-2020-574 Negative-size-param in r_buf_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14832 Crash type: Negative-size-param Crash state: rbufread binpegetcertificate binpeinit...

OSV-2020-573 UNKNOWN READ in (__has_construct<std::__1::allocator<unsigned

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14479 Crash type: UNKNOWN READ Crash state: hasconstruct::value, void::t std::1::vector ::vectoruns...

OSV-2020-565 Use-of-uninitialized-value in OT::AxisValue::sanitize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14850 Crash type: Use-of-uninitialized-value Crash state: OT::AxisValue::sanitize bool OT::OffsetTo, true::sanitiz bool OT::UnsizedArrayOfOT::OffsetToOT::AxisValue, OT::IntTypeunsigned short,...

OSV-2020-568 Heap-use-after-free in proc_plaintext

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13730 Crash type: Heap-use-after-free READ 4 Crash state: procplaintext doprocpackets procsignaturepackets...

OSV-2020-562 UNKNOWN READ in local_add_lv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18030 Crash type: UNKNOWN READ Crash state: localaddlv yyparse mrbparserparse...

OSV-2020-546 Heap-buffer-overflow in ih264d_decode_slice_thread

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18960 Crash type: Heap-buffer-overflow READ 8 Crash state: ih264ddecodeslicethread ih264ddecodepicturethread startthread...

OSV-2020-560 Heap-use-after-free in cin_get

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15200 Crash type: Heap-use-after-free READ 1 Crash state: cinget gettoken prim...

OSV-2020-557 Global-buffer-overflow in dissect_snmp_PDUs

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18816 Crash type: Global-buffer-overflow READ 4 Crash state: dissectsnmpPDUs dissectberchoice dissectsnmpRegisterResponse...

OSV-2020-559 Use-of-uninitialized-value in parser_get_next_char

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14739 Crash type: Use-of-uninitialized-value Crash state: parsergetnextchar parsergetparamnameheap icalparseraddline...

OSV-2020-555 Heap-use-after-free in WelsDec::CWelsDecoder::SetOption

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18747 Crash type: Heap-use-after-free WRITE 1 Crash state: WelsDec::CWelsDecoder::SetOption decoderfuzzer.cpp WelsCommon::WelsFree...

OSV-2020-548 Heap-buffer-overflow in acommon::DecodeDirect<unsigned short>::decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16531 Crash type: Heap-buffer-overflow READ 2 Crash state: acommon::DecodeDirect::decode acommon::Convert::convert aspellspellersuggest...

OSV-2020-552 Heap-buffer-overflow in varlink_enqueue_json

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14708 Crash type: Heap-buffer-overflow WRITE Crash state: varlinkenqueuejson varlinkerror varlinkerrorb...

OSV-2020-540 Heap-buffer-overflow in byte_from_wkb_state

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16591 Crash type: Heap-buffer-overflow READ 1 Crash state: bytefromwkbstate lwgeomfromwkbstate lwcollectionfromwkbstate...

OSV-2020-543 Heap-buffer-overflow in circular_memcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14574 Crash type: Heap-buffer-overflow READ 8 Crash state: circularmemcpy runarmfilter runfilter...

OSV-2020-541 UNKNOWN READ in _fini

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15391 Crash type: UNKNOWN READ Crash state: fini...

OSV-2020-535 Heap-buffer-overflow in looks_ucs32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13222 Crash type: Heap-buffer-overflow READ 1 Crash state: looksucs32 fileencoding filebuffer...

OSV-2020-533 Heap-buffer-overflow in r_utf8_strlen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13726 Crash type: Heap-buffer-overflow READ 1 Crash state: rutf8strlen getstr parseclass...

OSV-2020-521 Heap-buffer-overflow in acommon::ObjStack::dup_top

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18462 Crash type: Heap-buffer-overflow WRITE Crash state: acommon::ObjStack::duptop acommon::StringMap::add acommon::Config::lookuplist...

OSV-2020-530 Stack-buffer-overflow in ares_parse_aaaa_reply

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15459 Crash type: Stack-buffer-overflow WRITE 4 Crash state: aresparseaaaareply ares-test-fuzz.c...

OSV-2020-522 Heap-buffer-overflow in buf_bytes_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14783 Crash type: Heap-buffer-overflow WRITE Crash state: bufbytesread rbufread binpegetcertificate...

OSV-2020-523 Heap-buffer-overflow in check_buffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15003 Crash type: Heap-buffer-overflow READ 1 Crash state: checkbuffer rbingetbinpluginbybuffer getpluginfrombuffer...

OSV-2020-526 Use-of-uninitialized-value in Mat_VarRead4

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16857 Crash type: Use-of-uninitialized-value Crash state: MatVarRead4 MatVarReadDataAll matiofuzzer.cc...

OSV-2020-525 UNKNOWN READ in parse_sec_attr_44

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18693 Crash type: UNKNOWN READ Crash state: parsesecattr44 setcosselectfile scselectfile...

OSV-2020-531 Stack-buffer-overflow in ot::MeshCoP::DatasetManager::HandleSet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15374 Crash type: Stack-buffer-overflow READ 15 Crash state: ot::MeshCoP::DatasetManager::HandleSet ot::MeshCoP::ActiveDataset::HandleSet ot::Coap::CoapBase::ProcessReceivedRequest...

OSV-2020-516 Heap-buffer-overflow in hb_array_t<OT::IntType<unsigned short, 2u> const> hb_array_t<OT::IntType<unsigne

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18513 Crash type: Heap-buffer-overflow READ 2 Crash state: hbarrayt const hbarrayt ::copy ZN22hbserializecontextt5copyIN2OT14UnsizedArrayOfINS17IntTypeItLj2EEEEEJRj...

OSV-2020-519 Use-of-uninitialized-value in MOS65XX_group_name

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15112 Crash type: Use-of-uninitialized-value Crash state: MOS65XXgroupname csgroupname fuzzdisasm.c...

OSV-2020-518 Global-buffer-overflow in perfetto::trace_processor::ParseSystraceTracePoint

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13481 Crash type: Global-buffer-overflow READ 1 Crash state: perfetto::traceprocessor::ParseSystraceTracePoint perfetto::traceprocessor::ProtoTraceParser::ParsePrint perfetto::traceprocessor::ProtoTraceParser::ParseFtracePacke...

OSV-2020-528 Stack-buffer-overflow in ot::Message::Read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17330 Crash type: Stack-buffer-overflow WRITE Crash state: ot::Message::Read ot::NetworkData::Leader::HandleCommissioningGet ot::Coap::CoapBase::ProcessReceivedRequest...

OSV-2020-508 Use-of-uninitialized-value in pe_rva_to_offset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19003 Crash type: Use-of-uninitialized-value Crash state: pervatooffset dotnetparsetilde2 dotnetparsetilde...

OSV-2020-496 Stack-buffer-overflow in ot::Mle::Mle::HandleParentResponse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15382 Crash type: Stack-buffer-overflow READ Crash state: ot::Mle::Mle::HandleParentResponse ot::Mle::Mle::HandleUdpReceive ot::Ip6::Udp::HandleMessage...

OSV-2020-514 UNKNOWN READ in asn1_item_print_ctx

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14546 Crash type: UNKNOWN READ Crash state: asn1itemprintctx asn1templateprintctx asn1itemprintctx...

OSV-2020-510 UNKNOWN READ in ot::Timer::GetFireTime

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13390 Crash type: UNKNOWN READ Crash state: ot::Timer::GetFireTime ot::Timer::DoesFireBefore ot::TimerScheduler::Add...

OSV-2020-506 Stack-buffer-overflow in parse_file_extra_owner

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14331 Crash type: Stack-buffer-overflow WRITE 1 Crash state: parsefileextraowner processheadfileextra processheadfile...

OSV-2020-515 Use-of-uninitialized-value in bool std::__1::equal<std::__1::__wrap_iter<unsigned char const*>, std::__1::__wr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18320 Crash type: Use-of-uninitialized-value Crash state: bool std::1::equal, std::1::wr bool std::1::operator== cryptofuzz::ExecutorBase::compa...

OSV-2020-513 Use-of-uninitialized-value in icalcomponent_remove_component

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14738 Crash type: Use-of-uninitialized-value Crash state: icalcomponentremovecomponent icalcomponentfree icalparserfree...

OSV-2020-509 Use-of-uninitialized-value in hb_hashmap_t<hb_serialize_context_t::object_t const*, unsigned int,

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14641 Crash type: Use-of-uninitialized-value Crash state: hbhashmapthbserializecontextt::objectt const, unsigned int, hbhashmapthbserializecontextt::objectt const, unsigned int, hbhashmapthbserializecontextt::objectt const,...

OSV-2020-504 Global-buffer-overflow in lwan_parse_rfc_time

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14297 Crash type: Global-buffer-overflow READ 4 Crash state: lwanparserfctime parseifmodifiedsince fuzzparsehttprequest...

OSV-2020-502 Heap-use-after-free in WelsDec::SetUnRef

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18644 Crash type: Heap-use-after-free WRITE 1 Crash state: WelsDec::SetUnRef WelsDec::WelsResetRefPic WelsFreeDynamicMemory...

OSV-2020-503 Heap-use-after-free in WelsDec::SetUnRef

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18438 Crash type: Heap-use-after-free WRITE 1 Crash state: WelsDec::SetUnRef WelsDec::WelsResetRefPic WelsFreeDynamicMemory...

OSV-2020-497 Heap-buffer-overflow in str_table_entry

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13956 Crash type: Heap-buffer-overflow READ 1 Crash state: strtableentry parseelfheader64be elfload...

OSV-2020-484 Heap-buffer-overflow in AAT::KerxSubTableFormat4<AAT::KerxSubTableHeader>::driver_context_t::transition

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12532 Crash type: Heap-buffer-overflow READ 4 Crash state: AAT::KerxSubTableFormat4::drivercontextt::transition void AAT::StateTableDriver::apply...

OSV-2020-494 Use-of-uninitialized-value in Variant_decodeJson

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14620 Crash type: Use-of-uninitialized-value Crash state: VariantdecodeJson UAdecodeJson fuzzjsondecode.cc...

OSV-2020-487 UNKNOWN READ in crc32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15278 Crash type: UNKNOWN READ Crash state: crc32 updatecrc pushdataready...

OSV-2020-480 Use-of-uninitialized-value in _idn2_punycode_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13359 Crash type: Use-of-uninitialized-value Crash state: idn2punycodedecode tr46 idn2lookupu8...

OSV-2020-481 Heap-buffer-overflow in sctp_handle_asconf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18070 Crash type: Heap-buffer-overflow READ 2 Crash state: sctphandleasconf sctpprocesscontrol sctpcommoninputprocessing...