OSV-2020-481 Heap-buffer-overflow in sctp_handle_asconf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18070 Crash type: Heap-buffer-overflow READ 2 Crash state: sctphandleasconf sctpprocesscontrol sctpcommoninputprocessing...

OSV-2020-486 Heap-buffer-overflow in _iri_unescape_inline

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14448 Crash type: Heap-buffer-overflow READ 1 Crash state: iriunescapeinline wgetiriparse parseproxies...

OSV-2020-483 Heap-buffer-overflow in run_arm_filter

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15431 Crash type: Heap-buffer-overflow READ 1 Crash state: runarmfilter runfilter applyfilters...

OSV-2020-491 Stack-buffer-overflow in Mat_VarReadNextInfo5

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17119 Crash type: Stack-buffer-overflow READ 4 Crash state: MatVarReadNextInfo5 MatGetDir MatioRead...

OSV-2020-490 Heap-double-free in _free_resources

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12945 Crash type: Heap-double-free Crash state: freeresources rlistdelete rlistpurge...

OSV-2020-473 Heap-use-after-free in Envoy::Server::InitManagerImpl::initializeTarget

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13221 Crash type: Heap-use-after-free READ 8 Crash state: Envoy::Server::InitManagerImpl::initializeTarget Envoy::Server::InitManagerImpl::initialize Envoy::Server::ValidationInstance::initialize...

OSV-2020-471 Stack-buffer-overflow in ot::Cli::Interpreter::ProcessService

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12642 Crash type: Stack-buffer-overflow WRITE Crash state: ot::Cli::Interpreter::ProcessService ot::Cli::Interpreter::ProcessLine ot::Cli::Uart::ProcessCommand...

OSV-2020-474 Bad-free in spss_varinfo_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12595 Crash type: Bad-free Crash state: spssvarinfofree savreadvariablerecord savparserecordspass2...

OSV-2020-467 UNKNOWN READ in ot::MessageQueue::GetTail

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13345 Crash type: UNKNOWN READ Crash state: ot::MessageQueue::GetTail ot::Message::GetNext ot::MeshForwarder::GetDirectTransmission...

OSV-2020-475 Heap-use-after-free in String_clear

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14487 Crash type: Heap-use-after-free READ 8 Crash state: Stringclear clearStructure UAArraydelete...

OSV-2020-466 Heap-buffer-overflow in LzmaDec_DecodeToDic

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17198 Crash type: Heap-buffer-overflow READ 1 Crash state: LzmaDecDecodeToDic LzmaDecDecodeToBuf htpgzipdecompressordecompress...

OSV-2020-468 Stack-buffer-overflow in ot::Ip6::Address::FromString

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14821 Crash type: Stack-buffer-overflow WRITE 1 Crash state: ot::Ip6::Address::FromString ot::Cli::Coap::ProcessRequest ot::Cli::Interpreter::ProcessCoap...

OSV-2020-449 Heap-buffer-overflow in perfetto::trace_processor::FuchsiaTraceParser::ParseTracePacket

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14752 Crash type: Heap-buffer-overflow READ 8 Crash state: perfetto::traceprocessor::FuchsiaTraceParser::ParseTracePacket perfetto::traceprocessor::TraceSorter::SortAndExtractEventsBeyondWindow...

OSV-2020-448 Heap-use-after-free in read_chunks_before_idat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16051 Crash type: Heap-use-after-free READ 2 Crash state: readchunksbeforeidat getancillary spngdecodedimagesize...

OSV-2020-462 Global-buffer-overflow in strsep_char

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14509 Crash type: Global-buffer-overflow READ Crash state: strsepchar parseproxyprotocolv1 parsehttprequest...

OSV-2020-452 UNKNOWN READ in _fini

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18611 Crash type: UNKNOWN READ Crash state: fini...

OSV-2020-461 Index-out-of-bounds in parse_file_extra_owner

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14393 Crash type: Index-out-of-bounds Crash state: parsefileextraowner processheadfileextra processheadfile...

OSV-2020-447 UNKNOWN READ in yyparse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17968 Crash type: UNKNOWN READ Crash state: yyparse mrbparserparse mrbparsenstring...

OSV-2020-455 Heap-buffer-overflow in r_core_lines_initcache

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14690 Crash type: Heap-buffer-overflow WRITE 8 Crash state: rcorelinesinitcache cblinesto rconfigseti...

OSV-2020-438 Use-of-uninitialized-value in ARM_post_printer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13768 Crash type: Use-of-uninitialized-value Crash state: ARMpostprinter fillinsn csdisasm...

OSV-2020-440 UNKNOWN READ in r_uleb128

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13915 Crash type: UNKNOWN READ Crash state: ruleb128 parseclass dexloadcode...

OSV-2020-439 UNKNOWN WRITE in ares-test-fuzz.c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15375 Crash type: UNKNOWN WRITE Crash state: ares-test-fuzz.c...

OSV-2020-442 Heap-buffer-overflow in CRYPTO_strdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17715 Crash type: Heap-buffer-overflow READ 14 Crash state: CRYPTOstrdup X509V3addvalue i2vGENERALNAME...

OSV-2020-435 Heap-buffer-overflow in ares_parse_aaaa_reply

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15373 Crash type: Heap-buffer-overflow READ 16 Crash state: aresparseaaaareply ares-test-fuzz.c...

OSV-2020-431 Global-buffer-overflow in parse_headers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14511 Crash type: Global-buffer-overflow READ 2 Crash state: parseheaders parsehttprequest fuzzparsehttprequest...

OSV-2020-441 Heap-buffer-overflow in r_buf_cpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14125 Crash type: Heap-buffer-overflow WRITE Crash state: rbufcpy getrelocs64 relocs...

OSV-2020-434 Heap-buffer-overflow in format_generic_odp_key

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14429 Crash type: Heap-buffer-overflow READ 1 Crash state: formatgenericodpkey checkattrlen formatodpkeyattr...

OSV-2020-433 UNKNOWN READ in icu_64::UCharsTrie::branchNext

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15580 Crash type: UNKNOWN READ Crash state: icu64::UCharsTrie::branchNext icu64::CollationIterator::nextCE32FromContraction icu64::CollationIterator::appendCEsFromCE32...

OSV-2020-430 Stack-use-after-return in OSSL_PARAM_get_int32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15114 Crash type: Stack-use-after-return READ 4 Crash state: OSSLPARAMgetint32 md5sha1setparams ssl3finalfinishmac...

OSV-2020-418 Use-of-uninitialized-value in isMatchAtCPBoundary

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15505 Crash type: Use-of-uninitialized-value Crash state: isMatchAtCPBoundary ustrFindFirst64 icu64::UnicodeString::indexOf...

OSV-2020-420 UNKNOWN WRITE in uffd_cleanup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15156 Crash type: UNKNOWN WRITE Crash state: uffdcleanup netCDFDataset::netCDFDataset netCDFDataset::netCDFDataset...

OSV-2020-416 Use-of-uninitialized-value in UA_ServerConfig_clean

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14848 Crash type: Use-of-uninitialized-value Crash state: UAServerConfigclean UAServerdelete fuzzbinarymessage.cc...

OSV-2020-413 Stack-buffer-overflow in ot::NetworkData::NetworkDataTlv::GetNext

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14401 Crash type: Stack-buffer-overflow READ 1 Crash state: ot::NetworkData::NetworkDataTlv::GetNext ot::NetworkData::Leader::IsStableUpdated ot::NetworkData::Leader::RegisterNetworkData...

OSV-2020-417 Heap-buffer-overflow in idn2_to_ascii_4i

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12420 Crash type: Heap-buffer-overflow WRITE Crash state: idn2toascii4i libidn2toascii8zfuzzer.c...

OSV-2020-414 Heap-use-after-free in WelsDec::MapColToList0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14035 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::MapColToList0 WelsDec::PredBDirectTemporal WelsDec::WelsDecodeMbCavlcBSlice...

OSV-2020-423 Heap-buffer-overflow in stdalloc__strdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18356 Crash type: Heap-buffer-overflow READ Crash state: stdallocstrdup parsehunkbody parsepatchhunks...

OSV-2020-412 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18503 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int decltype...

OSV-2020-429 Heap-buffer-overflow in MEM_read32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14368 Crash type: Heap-buffer-overflow READ 4 Crash state: MEMread32 ZSTDv05decodeSequence ZSTDv05decompressSequences...

OSV-2020-424 Heap-buffer-overflow in sav_parse_long_string_missing_values_record

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13076 Crash type: Heap-buffer-overflow READ 1 Crash state: savparselongstringmissingvaluesrecord savparserecordspass2 readstatparsesav...

OSV-2020-425 Heap-buffer-overflow in ihevcd_parse_coding_unit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17055 Crash type: Heap-buffer-overflow READ 1 Crash state: ihevcdparsecodingunit ihevcdparsecodingquadtree ihevcdparsecodingquadtree...

OSV-2020-427 Stack-buffer-overflow in Mat_uint32Swap

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17113 Crash type: Stack-buffer-overflow READ 4 Crash state: Matuint32Swap MatVarReadNextInfo5 MatGetDir...

OSV-2020-405 Stack-buffer-overflow in ZSTD_decodeLiteralsBlock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16445 Crash type: Stack-buffer-overflow WRITE Crash state: ZSTDdecodeLiteralsBlock ZSTDdecompressBlock ZSTDdecompressDCtx...

OSV-2020-398 Stack-buffer-overflow in ihevcd_ref_list

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17029 Crash type: Stack-buffer-overflow WRITE 4 Crash state: ihevcdreflist ihevcdparsesliceheader ihevcdnalunit...

OSV-2020-407 Heap-double-free in opt_cleanup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15178 Crash type: Heap-double-free Crash state: optcleanup bpfoptimize pcapcompile...

OSV-2020-410 Global-buffer-overflow in lex_multiline_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18455 Crash type: Global-buffer-overflow READ 1 Crash state: lexmultilinestring lexnext parseconfig...

OSV-2020-408 Heap-buffer-overflow in _iri_unescape_inline

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14428 Crash type: Heap-buffer-overflow READ 1 Crash state: iriunescapeinline wgetiriparse test...

OSV-2020-396 UNKNOWN READ in ot::TaskletScheduler::PopTasklet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13370 Crash type: UNKNOWN READ Crash state: ot::TaskletScheduler::PopTasklet ot::TaskletScheduler::ProcessQueuedTasklets radioreceivedone.cpp...

OSV-2020-399 Heap-use-after-free in sdb_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13704 Crash type: Heap-use-after-free READ 8 Crash state: sdbfree nsfree sdbnsfree...

OSV-2020-406 Global-buffer-overflow in lwan_strbuf_append_str

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18448 Crash type: Global-buffer-overflow READ Crash state: lwanstrbufappendstr parsesection parsesectionshorthand...

OSV-2020-379 Heap-buffer-overflow in UA_unbase64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14621 Crash type: Heap-buffer-overflow WRITE 1 Crash state: UAunbase64 ByteStringdecodeJson decodeFields...