OSV-2020-521 Heap-buffer-overflow in acommon::ObjStack::dup_top

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18462 Crash type: Heap-buffer-overflow WRITE Crash state: acommon::ObjStack::duptop acommon::StringMap::add acommon::Config::lookuplist...

OSV-2020-518 Global-buffer-overflow in perfetto::trace_processor::ParseSystraceTracePoint

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13481 Crash type: Global-buffer-overflow READ 1 Crash state: perfetto::traceprocessor::ParseSystraceTracePoint perfetto::traceprocessor::ProtoTraceParser::ParsePrint perfetto::traceprocessor::ProtoTraceParser::ParseFtracePacke...

OSV-2020-528 Stack-buffer-overflow in ot::Message::Read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17330 Crash type: Stack-buffer-overflow WRITE Crash state: ot::Message::Read ot::NetworkData::Leader::HandleCommissioningGet ot::Coap::CoapBase::ProcessReceivedRequest...

OSV-2020-522 Heap-buffer-overflow in buf_bytes_read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14783 Crash type: Heap-buffer-overflow WRITE Crash state: bufbytesread rbufread binpegetcertificate...

OSV-2020-531 Stack-buffer-overflow in ot::MeshCoP::DatasetManager::HandleSet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15374 Crash type: Stack-buffer-overflow READ 15 Crash state: ot::MeshCoP::DatasetManager::HandleSet ot::MeshCoP::ActiveDataset::HandleSet ot::Coap::CoapBase::ProcessReceivedRequest...

OSV-2020-530 Stack-buffer-overflow in ares_parse_aaaa_reply

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15459 Crash type: Stack-buffer-overflow WRITE 4 Crash state: aresparseaaaareply ares-test-fuzz.c...

OSV-2020-519 Use-of-uninitialized-value in MOS65XX_group_name

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15112 Crash type: Use-of-uninitialized-value Crash state: MOS65XXgroupname csgroupname fuzzdisasm.c...

OSV-2020-525 UNKNOWN READ in parse_sec_attr_44

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18693 Crash type: UNKNOWN READ Crash state: parsesecattr44 setcosselectfile scselectfile...

OSV-2020-516 Heap-buffer-overflow in hb_array_t<OT::IntType<unsigned short, 2u> const> hb_array_t<OT::IntType<unsigne

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18513 Crash type: Heap-buffer-overflow READ 2 Crash state: hbarrayt const hbarrayt ::copy ZN22hbserializecontextt5copyIN2OT14UnsizedArrayOfINS17IntTypeItLj2EEEEEJRj...

OSV-2020-502 Heap-use-after-free in WelsDec::SetUnRef

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18644 Crash type: Heap-use-after-free WRITE 1 Crash state: WelsDec::SetUnRef WelsDec::WelsResetRefPic WelsFreeDynamicMemory...

OSV-2020-510 UNKNOWN READ in ot::Timer::GetFireTime

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13390 Crash type: UNKNOWN READ Crash state: ot::Timer::GetFireTime ot::Timer::DoesFireBefore ot::TimerScheduler::Add...

OSV-2020-513 Use-of-uninitialized-value in icalcomponent_remove_component

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14738 Crash type: Use-of-uninitialized-value Crash state: icalcomponentremovecomponent icalcomponentfree icalparserfree...

OSV-2020-504 Global-buffer-overflow in lwan_parse_rfc_time

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14297 Crash type: Global-buffer-overflow READ 4 Crash state: lwanparserfctime parseifmodifiedsince fuzzparsehttprequest...

OSV-2020-497 Heap-buffer-overflow in str_table_entry

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13956 Crash type: Heap-buffer-overflow READ 1 Crash state: strtableentry parseelfheader64be elfload...

OSV-2020-506 Stack-buffer-overflow in parse_file_extra_owner

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14331 Crash type: Stack-buffer-overflow WRITE 1 Crash state: parsefileextraowner processheadfileextra processheadfile...

OSV-2020-496 Stack-buffer-overflow in ot::Mle::Mle::HandleParentResponse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15382 Crash type: Stack-buffer-overflow READ Crash state: ot::Mle::Mle::HandleParentResponse ot::Mle::Mle::HandleUdpReceive ot::Ip6::Udp::HandleMessage...

OSV-2020-503 Heap-use-after-free in WelsDec::SetUnRef

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18438 Crash type: Heap-use-after-free WRITE 1 Crash state: WelsDec::SetUnRef WelsDec::WelsResetRefPic WelsFreeDynamicMemory...

OSV-2020-509 Use-of-uninitialized-value in hb_hashmap_t<hb_serialize_context_t::object_t const*, unsigned int,

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14641 Crash type: Use-of-uninitialized-value Crash state: hbhashmapthbserializecontextt::objectt const, unsigned int, hbhashmapthbserializecontextt::objectt const, unsigned int, hbhashmapthbserializecontextt::objectt const,...

OSV-2020-508 Use-of-uninitialized-value in pe_rva_to_offset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19003 Crash type: Use-of-uninitialized-value Crash state: pervatooffset dotnetparsetilde2 dotnetparsetilde...

OSV-2020-514 UNKNOWN READ in asn1_item_print_ctx

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14546 Crash type: UNKNOWN READ Crash state: asn1itemprintctx asn1templateprintctx asn1itemprintctx...

OSV-2020-515 Use-of-uninitialized-value in bool std::__1::equal<std::__1::__wrap_iter<unsigned char const*>, std::__1::__wr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18320 Crash type: Use-of-uninitialized-value Crash state: bool std::1::equal, std::1::wr bool std::1::operator== cryptofuzz::ExecutorBase::compa...

OSV-2020-484 Heap-buffer-overflow in AAT::KerxSubTableFormat4<AAT::KerxSubTableHeader>::driver_context_t::transition

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12532 Crash type: Heap-buffer-overflow READ 4 Crash state: AAT::KerxSubTableFormat4::drivercontextt::transition void AAT::StateTableDriver::apply...

OSV-2020-491 Stack-buffer-overflow in Mat_VarReadNextInfo5

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17119 Crash type: Stack-buffer-overflow READ 4 Crash state: MatVarReadNextInfo5 MatGetDir MatioRead...

OSV-2020-489 UNKNOWN READ in ot::Dhcp6::Dhcp6Client::ProcessNextIdentityAssociation

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13348 Crash type: UNKNOWN READ Crash state: ot::Dhcp6::Dhcp6Client::ProcessNextIdentityAssociation ot::Dhcp6::Dhcp6Client::Start ot::Dhcp6::Dhcp6Client::UpdateAddresses...

OSV-2020-494 Use-of-uninitialized-value in Variant_decodeJson

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14620 Crash type: Use-of-uninitialized-value Crash state: VariantdecodeJson UAdecodeJson fuzzjsondecode.cc...

OSV-2020-487 UNKNOWN READ in crc32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15278 Crash type: UNKNOWN READ Crash state: crc32 updatecrc pushdataready...

OSV-2020-481 Heap-buffer-overflow in sctp_handle_asconf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18070 Crash type: Heap-buffer-overflow READ 2 Crash state: sctphandleasconf sctpprocesscontrol sctpcommoninputprocessing...

OSV-2020-490 Heap-double-free in _free_resources

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12945 Crash type: Heap-double-free Crash state: freeresources rlistdelete rlistpurge...

OSV-2020-486 Heap-buffer-overflow in _iri_unescape_inline

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14448 Crash type: Heap-buffer-overflow READ 1 Crash state: iriunescapeinline wgetiriparse parseproxies...

OSV-2020-480 Use-of-uninitialized-value in _idn2_punycode_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13359 Crash type: Use-of-uninitialized-value Crash state: idn2punycodedecode tr46 idn2lookupu8...

OSV-2020-483 Heap-buffer-overflow in run_arm_filter

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15431 Crash type: Heap-buffer-overflow READ 1 Crash state: runarmfilter runfilter applyfilters...

OSV-2020-474 Bad-free in spss_varinfo_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12595 Crash type: Bad-free Crash state: spssvarinfofree savreadvariablerecord savparserecordspass2...

OSV-2020-467 UNKNOWN READ in ot::MessageQueue::GetTail

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13345 Crash type: UNKNOWN READ Crash state: ot::MessageQueue::GetTail ot::Message::GetNext ot::MeshForwarder::GetDirectTransmission...

OSV-2020-471 Stack-buffer-overflow in ot::Cli::Interpreter::ProcessService

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12642 Crash type: Stack-buffer-overflow WRITE Crash state: ot::Cli::Interpreter::ProcessService ot::Cli::Interpreter::ProcessLine ot::Cli::Uart::ProcessCommand...

OSV-2020-475 Heap-use-after-free in String_clear

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14487 Crash type: Heap-use-after-free READ 8 Crash state: Stringclear clearStructure UAArraydelete...

OSV-2020-466 Heap-buffer-overflow in LzmaDec_DecodeToDic

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17198 Crash type: Heap-buffer-overflow READ 1 Crash state: LzmaDecDecodeToDic LzmaDecDecodeToBuf htpgzipdecompressordecompress...

OSV-2020-473 Heap-use-after-free in Envoy::Server::InitManagerImpl::initializeTarget

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13221 Crash type: Heap-use-after-free READ 8 Crash state: Envoy::Server::InitManagerImpl::initializeTarget Envoy::Server::InitManagerImpl::initialize Envoy::Server::ValidationInstance::initialize...

OSV-2020-468 Stack-buffer-overflow in ot::Ip6::Address::FromString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14821 Crash type: Stack-buffer-overflow WRITE 1 Crash state: ot::Ip6::Address::FromString ot::Cli::Coap::ProcessRequest ot::Cli::Interpreter::ProcessCoap...

OSV-2020-455 Heap-buffer-overflow in r_core_lines_initcache

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14690 Crash type: Heap-buffer-overflow WRITE 8 Crash state: rcorelinesinitcache cblinesto rconfigseti...

OSV-2020-461 Index-out-of-bounds in parse_file_extra_owner

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14393 Crash type: Index-out-of-bounds Crash state: parsefileextraowner processheadfileextra processheadfile...

OSV-2020-448 Heap-use-after-free in read_chunks_before_idat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16051 Crash type: Heap-use-after-free READ 2 Crash state: readchunksbeforeidat getancillary spngdecodedimagesize...

OSV-2020-447 UNKNOWN READ in yyparse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17968 Crash type: UNKNOWN READ Crash state: yyparse mrbparserparse mrbparsenstring...

OSV-2020-449 Heap-buffer-overflow in perfetto::trace_processor::FuchsiaTraceParser::ParseTracePacket

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14752 Crash type: Heap-buffer-overflow READ 8 Crash state: perfetto::traceprocessor::FuchsiaTraceParser::ParseTracePacket perfetto::traceprocessor::TraceSorter::SortAndExtractEventsBeyondWindow...

OSV-2020-462 Global-buffer-overflow in strsep_char

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14509 Crash type: Global-buffer-overflow READ Crash state: strsepchar parseproxyprotocolv1 parsehttprequest...

OSV-2020-452 UNKNOWN READ in _fini

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18611 Crash type: UNKNOWN READ Crash state: fini...

OSV-2020-434 Heap-buffer-overflow in format_generic_odp_key

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14429 Crash type: Heap-buffer-overflow READ 1 Crash state: formatgenericodpkey checkattrlen formatodpkeyattr...

OSV-2020-433 UNKNOWN READ in icu_64::UCharsTrie::branchNext

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15580 Crash type: UNKNOWN READ Crash state: icu64::UCharsTrie::branchNext icu64::CollationIterator::nextCE32FromContraction icu64::CollationIterator::appendCEsFromCE32...

OSV-2020-442 Heap-buffer-overflow in CRYPTO_strdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17715 Crash type: Heap-buffer-overflow READ 14 Crash state: CRYPTOstrdup X509V3addvalue i2vGENERALNAME...

OSV-2020-440 UNKNOWN READ in r_uleb128

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13915 Crash type: UNKNOWN READ Crash state: ruleb128 parseclass dexloadcode...

OSV-2020-431 Global-buffer-overflow in parse_headers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14511 Crash type: Global-buffer-overflow READ 2 Crash state: parseheaders parsehttprequest fuzzparsehttprequest...