OSV-2020-347 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14825 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::AxisValue::sanitize...

OSV-2020-351 UNKNOWN READ in validate_past_idat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14935 Crash type: UNKNOWN READ Crash state: validatepastidat spngdecodeimage spngreadfuzzer.cc...

OSV-2020-352 Heap-buffer-overflow in searchObjectForKeyRec

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14619 Crash type: Heap-buffer-overflow READ 4 Crash state: searchObjectForKeyRec searchObjectForKeyRec searchObjectForKeyRec...

OSV-2020-341 Heap-buffer-overflow in post_process_template

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18952 Crash type: Heap-buffer-overflow READ 4 Crash state: postprocesstemplate parsershutdown parsestring...

OSV-2020-354 UNKNOWN READ in ot::Ip6::NetifUnicastAddress::GetNext

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13409 Crash type: UNKNOWN READ Crash state: ot::Ip6::NetifUnicastAddress::GetNext ot::Ip6::Netif::RemoveUnicastAddress ot::Mle::Mle::SetStateDetached...

OSV-2020-353 Stack-buffer-overflow in ot::MeshCoP::Commissioner::GeneratePskc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19386 Crash type: Stack-buffer-overflow WRITE Crash state: ot::MeshCoP::Commissioner::GeneratePskc ot::Ncp::NcpBase::HandlePropertySetSPINELPROPMESHCOPCOMMISSIONERGENERATEPS ot::Ncp::NcpBase::HandlePropertySetForSpecialPropert...

OSV-2020-342 UNKNOWN READ in ndpi_search_kerberos

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19175 Crash type: UNKNOWN READ Crash state: ndpisearchkerberos checkndpitcpflowfunc ndpidetectionprocesspacket...

OSV-2020-355 Use-of-uninitialized-value in LzmaDec_TryDummy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17189 Crash type: Use-of-uninitialized-value Crash state: LzmaDecTryDummy LzmaDecDecodeToDic LzmaDecDecodeToBuf...

OSV-2020-343 Stack-use-after-return in ot::MeshCoP::ChannelMaskEntryBase::GetChannelPage

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13741 Crash type: Stack-use-after-return READ 1 Crash state: ot::MeshCoP::ChannelMaskEntryBase::GetChannelPage ot::MeshCoP::ChannelMaskTlv::GetChannelMask ot::MeshCoP::ChannelMaskTlv::GetChannelMask...

OSV-2020-344 Heap-buffer-overflow in spng_decode_image

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16091 Crash type: Heap-buffer-overflow READ Crash state: spngdecodeimage spngreadfuzzer.cc...

OSV-2020-348 Heap-buffer-overflow in std::__1::vector<std::__1::vector<Sass::SharedImpl<Sass::ComplexSelector>, std::

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15893 Crash type: Heap-buffer-overflow READ 8 Crash state: std::1::vector, std:: Sass::ComplexSelector::resolveparentrefs Sass::SelectorList::resolveparentrefs...

OSV-2020-333 Heap-buffer-overflow in sas_read8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13262 Crash type: Heap-buffer-overflow READ 8 Crash state: sasread8 sas7bdatparsesubheaderpointer sas7bdatparsepagepass2...

OSV-2020-328 UNKNOWN READ in dotnet_parse_tilde_2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16448 Crash type: UNKNOWN READ Crash state: dotnetparsetilde2 dotnetparsetilde dotnetparsecom...

OSV-2020-334 Heap-buffer-overflow in _iri_unescape_inline

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14427 Crash type: Heap-buffer-overflow READ 1 Crash state: iriunescapeinline wgetiriparse addmirror...

OSV-2020-335 Global-buffer-overflow in template_fuzzer.cc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18988 Crash type: Global-buffer-overflow WRITE 1 Crash state: templatefuzzer.cc...

OSV-2020-337 Global-buffer-overflow in lex_multiline_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18626 Crash type: Global-buffer-overflow READ 1 Crash state: lexmultilinestring lexnext parsekeyvalue...

OSV-2020-336 Stack-buffer-overflow in ot::NetworkData::PrefixTlv::Init

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12589 Crash type: Stack-buffer-overflow READ Crash state: ot::NetworkData::PrefixTlv::Init ot::NetworkData::Local::AddOnMeshPrefix otError ot::Ncp::NcpBase::HandlePropertyInsert...

OSV-2020-317 Heap-buffer-overflow in r_core_lines_initcache

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15035 Crash type: Heap-buffer-overflow WRITE 8 Crash state: rcorelinesinitcache cblinesto rconfigseti...

OSV-2020-323 Use-of-uninitialized-value in ht_copy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15603 Crash type: Use-of-uninitialized-value Crash state: htcopy mrbhashdup mrbvmexec...

OSV-2020-324 Heap-buffer-overflow in av1_convolve_2d_copy_sr_sse2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12549 Crash type: Heap-buffer-overflow READ 16 Crash state: av1convolve2dcopysrsse2 av1convolve2dfacade av1makeinterpredictor...

OSV-2020-327 Heap-buffer-overflow in sas_read8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12662 Crash type: Heap-buffer-overflow READ 8 Crash state: sasread8 sas7bdatparsepagepass2 sas7bdatparseallpagespass2...

OSV-2020-319 Use-of-uninitialized-value in inv_txfm2d_add_facade

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12552 Crash type: Use-of-uninitialized-value Crash state: invtxfm2daddfacade av1invtxfm2dadd64x64c av1inversetransformblock...

OSV-2020-322 Negative-size-param in parse_proxy_protocol_v2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14455 Crash type: Negative-size-param Crash state: parseproxyprotocolv2 parsehttprequest fuzzparsehttprequest...

OSV-2020-325 Stack-buffer-overflow in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15159 Crash type: Stack-buffer-overflow READ Crash state: std::1::basicstring, std::1::allocatorch nccfdriver::attrf nccfdriver::getCFVersion...

OSV-2020-315 Heap-buffer-overflow in r_str_utf8_codepoint

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18122 Crash type: Heap-buffer-overflow READ 1 Crash state: rstrutf8codepoint rstrcharfullwidth rstrlenutf8...

OSV-2020-313 Heap-buffer-overflow in git_buf_decode_base85

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18882 Crash type: Heap-buffer-overflow READ 1 Crash state: gitbufdecodebase85 parsepatchbinaryside parsepatchbinary...

OSV-2020-307 Heap-buffer-overflow in spng_decode_image

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16830 Crash type: Heap-buffer-overflow READ 1 Crash state: spngdecodeimage spngreadfuzzer.cc...

OSV-2020-308 Heap-buffer-overflow in UA_copy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15152 Crash type: Heap-buffer-overflow WRITE Crash state: UAcopy RefTreeadd OperationBrowse...

OSV-2020-303 UNKNOWN READ in dav1d_put_bilin_avx2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16954 Crash type: UNKNOWN READ Crash state: dav1dputbilinavx2...

OSV-2020-305 Stack-buffer-overflow in ot::NetworkData::Leader::SendCommissioningGetResponse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17297 Crash type: Stack-buffer-overflow READ 1 Crash state: ot::NetworkData::Leader::SendCommissioningGetResponse ot::NetworkData::Leader::HandleCommissioningGet ot::Coap::CoapBase::ProcessReceivedRequest...

OSV-2020-300 Heap-buffer-overflow in sas_read4

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12978 Crash type: Heap-buffer-overflow READ 4 Crash state: sasread4 sas7bdatparsepagepass2 sas7bdatparseallpagespass2...

OSV-2020-294 Heap-buffer-overflow in ihevcd_process

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18058 Crash type: Heap-buffer-overflow READ 4 Crash state: ihevcdprocess ihevcdprocessthread clone...

OSV-2020-299 Bad-free in sig_destroyed

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17160 Crash type: Bad-free Crash state: sigdestroyed signalemitreal signalemit...

OSV-2020-288 Heap-use-after-free in pixReadMemBmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19723 Crash type: Heap-use-after-free READ Crash state: pixReadMemBmp pixReadMem pixrotateshearfuzzer.cc...

OSV-2020-286 Use-of-uninitialized-value in ZSTD_loadCEntropy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19146 Crash type: Use-of-uninitialized-value Crash state: ZSTDloadCEntropy ZSTDloadZstdDictionary ZSTDcompressinsertDictionary...

OSV-2020-289 Stack-buffer-overflow in ot::Message::Write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17147 Crash type: Stack-buffer-overflow READ Crash state: ot::Message::Write ot::Message::Append ot::Mle::Mle::AppendNetworkData...

OSV-2020-290 Use-of-uninitialized-value in rawspeed::RawImageData::checkMemIsInitialized

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18877 Crash type: Use-of-uninitialized-value Crash state: rawspeed::RawImageData::checkMemIsInitialized PhaseOneDecompressor.cpp posixmemalign...

OSV-2020-287 Heap-use-after-free in condition_free_list_type

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13882 Crash type: Heap-use-after-free READ 8 Crash state: conditionfreelisttype configparsenetcondition nextassignment...

OSV-2020-279 Global-buffer-overflow in lex_multiline_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18562 Crash type: Global-buffer-overflow READ 3 Crash state: lexmultilinestring lexnext parsekeyvalue...

OSV-2020-280 Null-dereference READ

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15458 Crash type: Null-dereference READ Crash state: NULL...

OSV-2020-278 Heap-buffer-overflow in ih264d_decode_slice_thread

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19027 Crash type: Heap-buffer-overflow READ 4 Crash state: ih264ddecodeslicethread ih264ddecodepicturethread clone...

OSV-2020-273 Heap-use-after-free in copy_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19509 Crash type: Heap-use-after-free READ 1 Crash state: copystring douncompressblock processblock...

OSV-2020-263 Heap-use-after-free in dotnet_parse_tilde_2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19179 Crash type: Heap-use-after-free READ 2 Crash state: dotnetparsetilde2 dotnetparsetilde dotnetparsecom...

OSV-2020-261 Use-of-uninitialized-value in WelsDec::CWelsDecoder::ReleaseBufferedReadyPicture

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18744 Crash type: Use-of-uninitialized-value Crash state: WelsDec::CWelsDecoder::ReleaseBufferedReadyPicture WelsDec::CWelsDecoder::ReorderPicturesInDisplay WelsDec::CWelsDecoder::DecodeFrame2WithCtx...

OSV-2020-258 Stack-buffer-overflow in ot::Message::Write

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19338 Crash type: Stack-buffer-overflow READ 11 Crash state: ot::Message::Write ot::Message::Append ot::Mle::Mle::AppendResponse...

OSV-2020-257 Heap-use-after-free in ihevcd_jobq_lock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17553 Crash type: Heap-use-after-free READ 4 Crash state: ihevcdjobqlock ihevcdjobqyield ihevcdjobqdequeue...

OSV-2020-256 Global-buffer-overflow in dissect_wassp_sub_tlv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20004 Crash type: Global-buffer-overflow READ 8 Crash state: dissectwasspsubtlv dissectwasspsubtlv dissectwassptlv...

OSV-2020-255 Heap-buffer-overflow in dname_pkt_copy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20093 Crash type: Heap-buffer-overflow READ 1 Crash state: dnamepktcopy pktstrictsub scrubnormalize...

OSV-2020-252 Global-buffer-overflow in json_tokener_parse_ex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23619 Crash type: Global-buffer-overflow READ 4 Crash state: jsontokenerparseex tokenerparseexfuzzer.cc...

OSV-2020-253 Stack-buffer-overflow in mrb_str_len_to_dbl

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19902 Crash type: Stack-buffer-overflow WRITE 1 Crash state: mrbstrlentodbl mrbstrlentoinum mrbstrtoi...