OSV-2020-308 Heap-buffer-overflow in UA_copy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15152 Crash type: Heap-buffer-overflow WRITE Crash state: UAcopy RefTreeadd OperationBrowse...

OSV-2020-307 Heap-buffer-overflow in spng_decode_image

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16830 Crash type: Heap-buffer-overflow READ 1 Crash state: spngdecodeimage spngreadfuzzer.cc...

OSV-2020-305 Stack-buffer-overflow in ot::NetworkData::Leader::SendCommissioningGetResponse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17297 Crash type: Stack-buffer-overflow READ 1 Crash state: ot::NetworkData::Leader::SendCommissioningGetResponse ot::NetworkData::Leader::HandleCommissioningGet ot::Coap::CoapBase::ProcessReceivedRequest...

OSV-2020-300 Heap-buffer-overflow in sas_read4

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12978 Crash type: Heap-buffer-overflow READ 4 Crash state: sasread4 sas7bdatparsepagepass2 sas7bdatparseallpagespass2...

OSV-2020-303 UNKNOWN READ in dav1d_put_bilin_avx2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16954 Crash type: UNKNOWN READ Crash state: dav1dputbilinavx2...

OSV-2020-294 Heap-buffer-overflow in ihevcd_process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18058 Crash type: Heap-buffer-overflow READ 4 Crash state: ihevcdprocess ihevcdprocessthread clone...

OSV-2020-299 Bad-free in sig_destroyed

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17160 Crash type: Bad-free Crash state: sigdestroyed signalemitreal signalemit...

OSV-2020-287 Heap-use-after-free in condition_free_list_type

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13882 Crash type: Heap-use-after-free READ 8 Crash state: conditionfreelisttype configparsenetcondition nextassignment...

OSV-2020-289 Stack-buffer-overflow in ot::Message::Write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17147 Crash type: Stack-buffer-overflow READ Crash state: ot::Message::Write ot::Message::Append ot::Mle::Mle::AppendNetworkData...

OSV-2020-286 Use-of-uninitialized-value in ZSTD_loadCEntropy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19146 Crash type: Use-of-uninitialized-value Crash state: ZSTDloadCEntropy ZSTDloadZstdDictionary ZSTDcompressinsertDictionary...

OSV-2020-290 Use-of-uninitialized-value in rawspeed::RawImageData::checkMemIsInitialized

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18877 Crash type: Use-of-uninitialized-value Crash state: rawspeed::RawImageData::checkMemIsInitialized PhaseOneDecompressor.cpp posixmemalign...

OSV-2020-288 Heap-use-after-free in pixReadMemBmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19723 Crash type: Heap-use-after-free READ Crash state: pixReadMemBmp pixReadMem pixrotateshearfuzzer.cc...

OSV-2020-280 Null-dereference READ

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15458 Crash type: Null-dereference READ Crash state: NULL...

OSV-2020-279 Global-buffer-overflow in lex_multiline_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18562 Crash type: Global-buffer-overflow READ 3 Crash state: lexmultilinestring lexnext parsekeyvalue...

OSV-2020-278 Heap-buffer-overflow in ih264d_decode_slice_thread

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19027 Crash type: Heap-buffer-overflow READ 4 Crash state: ih264ddecodeslicethread ih264ddecodepicturethread clone...

OSV-2020-273 Heap-use-after-free in copy_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19509 Crash type: Heap-use-after-free READ 1 Crash state: copystring douncompressblock processblock...

OSV-2020-263 Heap-use-after-free in dotnet_parse_tilde_2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19179 Crash type: Heap-use-after-free READ 2 Crash state: dotnetparsetilde2 dotnetparsetilde dotnetparsecom...

OSV-2020-261 Use-of-uninitialized-value in WelsDec::CWelsDecoder::ReleaseBufferedReadyPicture

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18744 Crash type: Use-of-uninitialized-value Crash state: WelsDec::CWelsDecoder::ReleaseBufferedReadyPicture WelsDec::CWelsDecoder::ReorderPicturesInDisplay WelsDec::CWelsDecoder::DecodeFrame2WithCtx...

OSV-2020-258 Stack-buffer-overflow in ot::Message::Write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19338 Crash type: Stack-buffer-overflow READ 11 Crash state: ot::Message::Write ot::Message::Append ot::Mle::Mle::AppendResponse...

OSV-2020-257 Heap-use-after-free in ihevcd_jobq_lock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17553 Crash type: Heap-use-after-free READ 4 Crash state: ihevcdjobqlock ihevcdjobqyield ihevcdjobqdequeue...

OSV-2020-256 Global-buffer-overflow in dissect_wassp_sub_tlv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20004 Crash type: Global-buffer-overflow READ 8 Crash state: dissectwasspsubtlv dissectwasspsubtlv dissectwassptlv...

OSV-2020-252 Global-buffer-overflow in json_tokener_parse_ex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23619 Crash type: Global-buffer-overflow READ 4 Crash state: jsontokenerparseex tokenerparseexfuzzer.cc...

OSV-2020-255 Heap-buffer-overflow in dname_pkt_copy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20093 Crash type: Heap-buffer-overflow READ 1 Crash state: dnamepktcopy pktstrictsub scrubnormalize...

OSV-2020-253 Stack-buffer-overflow in mrb_str_len_to_dbl

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19902 Crash type: Stack-buffer-overflow WRITE 1 Crash state: mrbstrlentodbl mrbstrlentoinum mrbstrtoi...

OSV-2020-254 Heap-buffer-overflow in pixReadFromTiffStream

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23654 Crash type: Heap-buffer-overflow READ 1 Crash state: pixReadFromTiffStream pixReadMemTiff pixReadMem...

OSV-2020-250 UNKNOWN READ in Sass::Inspect::operator

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19988 Crash type: UNKNOWN READ Crash state: Sass::Inspect::operator Sass::Output::operator Sass::Output::operator...

OSV-2020-248 Heap-use-after-free in LocalizedText_clear

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20061 Crash type: Heap-use-after-free READ 8 Crash state: LocalizedTextclear Variantclear UAclear...

OSV-2020-247 Use-of-uninitialized-value in WavpackDeleteTagItem

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20060 Crash type: Use-of-uninitialized-value Crash state: WavpackDeleteTagItem WavpackAppendTagItem fuzzer.cc...

OSV-2020-249 Heap-buffer-overflow in cipher_generic_initiv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19926 Crash type: Heap-buffer-overflow READ 16 Crash state: ciphergenericinitiv ciphergenericinitinternal cryptofuzz::module::OpenSSL::OpSymmetricDecryptEVP...

OSV-2020-240 UNKNOWN READ in perfetto::trace_processor::TraceStorage::GetIdForVariadicType

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19999 Crash type: UNKNOWN READ Crash state: perfetto::traceprocessor::TraceStorage::GetIdForVariadicType perfetto::traceprocessor::GlobalArgsTracker::AddArgSet perfetto::traceprocessor::ArgsTracker::Flush...

OSV-2020-243 Heap-buffer-overflow in OT::VarRegionList::serialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19956 Crash type: Heap-buffer-overflow READ 12 Crash state: OT::VarRegionList::serialize OT::VariationStore::serialize bool OT::HVARVVAR::subset...

OSV-2020-245 Heap-use-after-free in ndpi_http_check_content

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23046 Crash type: Heap-use-after-free READ 3 Crash state: ndpihttpcheckcontent checkcontenttypeandchangeprotocol ndpicheckhttptcp...

OSV-2020-244 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20036 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::IndexArray::addindexesto...

OSV-2020-242 Heap-buffer-overflow in ndpi_workflow_process_packet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20089 Crash type: Heap-buffer-overflow READ 2 Crash state: ndpiworkflowprocesspacket fuzzndpireader.c...

OSV-2020-236 Heap-buffer-overflow in get_ndpi_flow_info6

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20091 Crash type: Heap-buffer-overflow READ 4 Crash state: getndpiflowinfo6 packetprocessing ndpiworkflowprocesspacket...

OSV-2020-238 Heap-use-after-free in copy_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19990 Crash type: Heap-use-after-free READ 1 Crash state: copystring douncompressblock processblock...

OSV-2020-233 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20022 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int decltype...

OSV-2020-231 UNKNOWN WRITE in gen_mftr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20081 Crash type: UNKNOWN WRITE Crash state: genmftr...

OSV-2020-232 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20021 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::ArrayOf...

OSV-2020-225 Heap-buffer-overflow in dname_pkt_compare

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20308 Crash type: Heap-buffer-overflow READ 1 Crash state: dnamepktcompare scrubnormalize scrubmessage...

OSV-2020-208 Use-of-uninitialized-value in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22235 Crash type: Use-of-uninitialized-value Crash state: std::1::basicstring, std::1::allocator, std::1::allocatorch pcpp::IDnsResource::IDnsResource...

OSV-2020-223 Heap-use-after-free in CRYPTO_DOWN_REF

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21550 Crash type: Heap-use-after-free WRITE 4 Crash state: CRYPTODOWNREF DHfree evppkeyfreelegacy...

OSV-2020-213 Heap-buffer-overflow in Op_YCbCr422_to_RGB_16bit::convert_colorspace

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21114 Crash type: Heap-buffer-overflow READ Crash state: OpYCbCr422toRGB16bit::convertcolorspace heif::ColorConversionPipeline::convertimage heif::convertcolorspace...

OSV-2020-214 Heap-use-after-free in String_clear

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20437 Crash type: Heap-use-after-free READ 8 Crash state: Stringclear clearStructure Variantclear...

OSV-2020-218 Heap-buffer-overflow in __libcpp_strstr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23145 Crash type: Heap-buffer-overflow READ 13 Crash state: libcppstrstr strstr pcpp::SipRequestFirstLine::parseVersion...

OSV-2020-224 Use-of-uninitialized-value in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23038 Crash type: Use-of-uninitialized-value Crash state: std::1::basicstring, std::1::allocator, std::1::allocatorch pcpp::IDnsResource::IDnsResource...

OSV-2020-227 Heap-double-free in spng__free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22720 Crash type: Heap-double-free Crash state: spngfree spnginflatestream readnonidatchunks...

OSV-2020-211 Heap-buffer-overflow in res2_inverse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22298 Crash type: Heap-buffer-overflow READ 4 Crash state: res2inverse mapping0inverse vorbissynthesis1...

OSV-2020-215 Use-of-uninitialized-value in xmlStrdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23144 Crash type: Use-of-uninitialized-value Crash state: xmlStrdup xmlRaiseError xmlErrValidNode...

OSV-2020-209 Stack-buffer-overflow in coolkey_rsa_op

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22392 Crash type: Stack-buffer-overflow READ Crash state: coolkeyrsaop coolkeycomputecrypt scdecipher...