OSV-2020-430 Stack-use-after-return in OSSL_PARAM_get_int32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15114 Crash type: Stack-use-after-return READ 4 Crash state: OSSLPARAMgetint32 md5sha1setparams ssl3finalfinishmac...

OSV-2020-438 Use-of-uninitialized-value in ARM_post_printer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13768 Crash type: Use-of-uninitialized-value Crash state: ARMpostprinter fillinsn csdisasm...

OSV-2020-441 Heap-buffer-overflow in r_buf_cpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14125 Crash type: Heap-buffer-overflow WRITE Crash state: rbufcpy getrelocs64 relocs...

OSV-2020-435 Heap-buffer-overflow in ares_parse_aaaa_reply

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15373 Crash type: Heap-buffer-overflow READ 16 Crash state: aresparseaaaareply ares-test-fuzz.c...

OSV-2020-439 UNKNOWN WRITE in ares-test-fuzz.c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15375 Crash type: UNKNOWN WRITE Crash state: ares-test-fuzz.c...

OSV-2020-424 Heap-buffer-overflow in sav_parse_long_string_missing_values_record

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13076 Crash type: Heap-buffer-overflow READ 1 Crash state: savparselongstringmissingvaluesrecord savparserecordspass2 readstatparsesav...

OSV-2020-416 Use-of-uninitialized-value in UA_ServerConfig_clean

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14848 Crash type: Use-of-uninitialized-value Crash state: UAServerConfigclean UAServerdelete fuzzbinarymessage.cc...

OSV-2020-412 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18503 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int decltype...

OSV-2020-413 Stack-buffer-overflow in ot::NetworkData::NetworkDataTlv::GetNext

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14401 Crash type: Stack-buffer-overflow READ 1 Crash state: ot::NetworkData::NetworkDataTlv::GetNext ot::NetworkData::Leader::IsStableUpdated ot::NetworkData::Leader::RegisterNetworkData...

OSV-2020-425 Heap-buffer-overflow in ihevcd_parse_coding_unit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17055 Crash type: Heap-buffer-overflow READ 1 Crash state: ihevcdparsecodingunit ihevcdparsecodingquadtree ihevcdparsecodingquadtree...

OSV-2020-414 Heap-use-after-free in WelsDec::MapColToList0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14035 Crash type: Heap-use-after-free READ 4 Crash state: WelsDec::MapColToList0 WelsDec::PredBDirectTemporal WelsDec::WelsDecodeMbCavlcBSlice...

OSV-2020-418 Use-of-uninitialized-value in isMatchAtCPBoundary

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15505 Crash type: Use-of-uninitialized-value Crash state: isMatchAtCPBoundary ustrFindFirst64 icu64::UnicodeString::indexOf...

OSV-2020-420 UNKNOWN WRITE in uffd_cleanup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15156 Crash type: UNKNOWN WRITE Crash state: uffdcleanup netCDFDataset::netCDFDataset netCDFDataset::netCDFDataset...

OSV-2020-417 Heap-buffer-overflow in idn2_to_ascii_4i

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12420 Crash type: Heap-buffer-overflow WRITE Crash state: idn2toascii4i libidn2toascii8zfuzzer.c...

OSV-2020-427 Stack-buffer-overflow in Mat_uint32Swap

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17113 Crash type: Stack-buffer-overflow READ 4 Crash state: Matuint32Swap MatVarReadNextInfo5 MatGetDir...

OSV-2020-423 Heap-buffer-overflow in stdalloc__strdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18356 Crash type: Heap-buffer-overflow READ Crash state: stdallocstrdup parsehunkbody parsepatchhunks...

OSV-2020-429 Heap-buffer-overflow in MEM_read32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14368 Crash type: Heap-buffer-overflow READ 4 Crash state: MEMread32 ZSTDv05decodeSequence ZSTDv05decompressSequences...

OSV-2020-406 Global-buffer-overflow in lwan_strbuf_append_str

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18448 Crash type: Global-buffer-overflow READ Crash state: lwanstrbufappendstr parsesection parsesectionshorthand...

OSV-2020-398 Stack-buffer-overflow in ihevcd_ref_list

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17029 Crash type: Stack-buffer-overflow WRITE 4 Crash state: ihevcdreflist ihevcdparsesliceheader ihevcdnalunit...

OSV-2020-408 Heap-buffer-overflow in _iri_unescape_inline

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14428 Crash type: Heap-buffer-overflow READ 1 Crash state: iriunescapeinline wgetiriparse test...

OSV-2020-396 UNKNOWN READ in ot::TaskletScheduler::PopTasklet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13370 Crash type: UNKNOWN READ Crash state: ot::TaskletScheduler::PopTasklet ot::TaskletScheduler::ProcessQueuedTasklets radioreceivedone.cpp...

OSV-2020-405 Stack-buffer-overflow in ZSTD_decodeLiteralsBlock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16445 Crash type: Stack-buffer-overflow WRITE Crash state: ZSTDdecodeLiteralsBlock ZSTDdecompressBlock ZSTDdecompressDCtx...

OSV-2020-410 Global-buffer-overflow in lex_multiline_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18455 Crash type: Global-buffer-overflow READ 1 Crash state: lexmultilinestring lexnext parseconfig...

OSV-2020-399 Heap-use-after-free in sdb_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13704 Crash type: Heap-use-after-free READ 8 Crash state: sdbfree nsfree sdbnsfree...

OSV-2020-407 Heap-double-free in opt_cleanup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15178 Crash type: Heap-double-free Crash state: optcleanup bpfoptimize pcapcompile...

OSV-2020-392 Stack-buffer-overflow in nc4_get_att

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15143 Crash type: Stack-buffer-overflow WRITE Crash state: nc4getatt nc4getatttc ncgetatttext...

OSV-2020-389 Use-of-uninitialized-value in smtp_state_ehlo_resp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16918 Crash type: Use-of-uninitialized-value Crash state: smtpstateehloresp smtpstatemachact Curlppstatemach...

OSV-2020-381 Use-of-uninitialized-value in crc32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17262 Crash type: Use-of-uninitialized-value Crash state: crc32 htpgzipdecompressordecompress htptxresprocessbodydataex...

OSV-2020-386 Heap-buffer-overflow in OPENSSL_strlcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16107 Crash type: Heap-buffer-overflow WRITE 1 Crash state: OPENSSLstrlcpy OPENSSLstrlcat ERRadderrorvdata...

OSV-2020-394 Global-buffer-overflow in parse_headers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14529 Crash type: Global-buffer-overflow WRITE 8 Crash state: parseheaders parsehttprequest fuzzparsehttprequest...

OSV-2020-377 Heap-buffer-overflow in symbols

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15004 Crash type: Heap-buffer-overflow READ 4 Crash state: symbols rbinobjectsetitems rbinobjectnew...

OSV-2020-391 Use-of-uninitialized-value in mprint

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13453 Crash type: Use-of-uninitialized-value Crash state: mprint match filesoftmagic...

OSV-2020-384 Heap-buffer-overflow in agentx_parse_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14481 Crash type: Heap-buffer-overflow READ Crash state: agentxparsestring agentxparse agentxparsefuzzer.c...

OSV-2020-393 Heap-buffer-overflow in Elf32_r_bin_elf_compiler

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13858 Crash type: Heap-buffer-overflow WRITE 1 Crash state: Elf32rbinelfcompiler info rbinobjectsetitems...

OSV-2020-380 Stack-buffer-overflow in ot::MeshCoP::ChannelMaskEntry::GetMask

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13619 Crash type: Stack-buffer-overflow READ 4 Crash state: ot::MeshCoP::ChannelMaskEntry::GetMask ot::MeshCoP::ChannelMaskTlv::GetChannelMask ot::MeshCoP::ChannelMaskTlv::GetChannelMask...

OSV-2020-383 Stack-buffer-overflow in ot::NetworkData::Leader::IsStableUpdated

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15971 Crash type: Stack-buffer-overflow READ 8 Crash state: ot::NetworkData::Leader::IsStableUpdated ot::NetworkData::Leader::RegisterNetworkData ot::NetworkData::Leader::HandleServerData...

OSV-2020-388 Stack-use-after-return in bool OT::Coverage::serialize<hb_map_iter_t<hb_map_iter_t<hb_filter_iter_t<OT::Co

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14786 Crash type: Stack-use-after-return READ 4 Crash state: bool OT::Coverage::serializehbmapiterthbmapiterthbfilteritertOT::Co bool OT::SingleSubstFormat1::serializehbmapiterthbmapiterthbfilterite bool...

OSV-2020-379 Heap-buffer-overflow in UA_unbase64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14621 Crash type: Heap-buffer-overflow WRITE 1 Crash state: UAunbase64 ByteStringdecodeJson decodeFields...

OSV-2020-369 UNKNOWN READ in ot::TimerScheduler::Remove

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13383 Crash type: UNKNOWN READ Crash state: ot::TimerScheduler::Remove ot::Mle::Mle::Stop otThreadSetEnabled...

OSV-2020-374 Heap-use-after-free in wmem_strbuf_get_str

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17305 Crash type: Heap-use-after-free READ 8 Crash state: wmemstrbufgetstr dissectrrcPLMNIdentityWithOptionalMCCr6 dissectperconstrainedsequenceof...

OSV-2020-373 UNKNOWN READ in url_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14501 Crash type: UNKNOWN READ Crash state: urldecode parsekeyvalues fuzzparsehttprequest...

OSV-2020-366 UNKNOWN READ in bebytes2ushort

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19039 Crash type: UNKNOWN READ Crash state: bebytes2ushort coolkeyv0getattributelen coolkeyv0getattributerecordlen...

OSV-2020-372 Heap-buffer-overflow in circular_memcpy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13435 Crash type: Heap-buffer-overflow READ Crash state: circularmemcpy rune8e9filter runfilter...

OSV-2020-365 UNKNOWN READ in fuzzshark_ip_proto-udp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16442 Crash type: UNKNOWN READ Crash state: fuzzsharkipproto-udp ghashtablelookup dissecttls...

OSV-2020-370 Heap-use-after-free in ih264_inter_pred_luma_horz_hpel_vert_qpel_ssse3

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18595 Crash type: Heap-use-after-free READ 16 Crash state: ih264interpredlumahorzhpelvertqpelssse3 ih264dmotioncompensatemp ih264ddecoderecontfrnmb...

OSV-2020-376 Heap-buffer-overflow in perfetto::trace_processor::fuchsia_trace_utils::ReadTimestamp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14767 Crash type: Heap-buffer-overflow READ 8 Crash state: perfetto::traceprocessor::fuchsiatraceutils::ReadTimestamp perfetto::traceprocessor::FuchsiaTraceParser::ParseTracePacket...

OSV-2020-364 Stack-use-after-return in ihevcd_process_thread

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17601 Crash type: Stack-use-after-return READ 4 Crash state: ihevcdprocessthread clone...

OSV-2020-360 Heap-use-after-free in read_chunks_after_idat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16081 Crash type: Heap-use-after-free READ Crash state: readchunksafteridat spngdecodeimage spngreadfuzzer.cc...

OSV-2020-345 Index-out-of-bounds in yara_yyparse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18942 Crash type: Index-out-of-bounds Crash state: yarayyparse yrlexparserulesstring rulesfuzzer.cc...

OSV-2020-357 Heap-buffer-overflow in r_read_le32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12685 Crash type: Heap-buffer-overflow READ 1 Crash state: rreadle32 dexmethodsignature2 dexparsedebugitem...