OSV-2020-197 Heap-buffer-overflow in jbig2_image_get_pixels_fast

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20358 Crash type: Heap-buffer-overflow READ 1 Crash state: jbig2imagegetpixelsfast jbig2decodegenerictemplate0TPGDON jbig2immediategenericregion...

OSV-2020-194 Heap-buffer-overflow in check_ymsg

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20856 Crash type: Heap-buffer-overflow READ 4 Crash state: checkymsg ndpisearchyahootcp ndpisearchyahoo...

OSV-2020-201 Use-of-uninitialized-value in fuzzing::memory::memory_test_msan

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22453 Crash type: Use-of-uninitialized-value Crash state: fuzzing::memory::memorytestmsan cryptofuzz::ExecutorBase::postp cryptofuzz::ExecutorBase::Run...

OSV-2020-196 Heap-use-after-free in Pe64_r_bin_pe_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21630 Crash type: Heap-use-after-free READ 8 Crash state: Pe64rbinpefree rbinfilefree rlistdelete...

OSV-2020-200 Heap-buffer-overflow in spng_decode_scanline

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22595 Crash type: Heap-buffer-overflow WRITE 2 Crash state: spngdecodescanline spngdecoderow spngdecodeimage...

OSV-2020-188 Heap-buffer-overflow in BEInt<short, 2>::operator short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20924 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator short OT::IntType::operator int OT::TupleVarHeader::calculatescalar...

OSV-2020-204 Negative-size-param in parquet::ColumnReaderImplBase<parquet::PhysicalType<

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20698 Crash type: Negative-size-param Crash state: parquet::ColumnReaderImplBaseparquet::PhysicalType parquet::internal::TypedRecordReaderparquet::PhysicalType parquet::arrow::LeafReader::NextBatch...

OSV-2020-187 UNKNOWN READ in arrow::ipc::MessageDecoder::MessageDecoderImpl::ConsumeDataBufferInt32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21680 Crash type: UNKNOWN READ Crash state: arrow::ipc::MessageDecoder::MessageDecoderImpl::ConsumeDataBufferInt32 arrow::ipc::MessageDecoder::MessageDecoderImpl::ConsumeInitialBuffer...

OSV-2020-189 Stack-buffer-overflow in tvb_get_ipv4_addr_with_prefix_len

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21718 Crash type: Stack-buffer-overflow READ 4 Crash state: tvbgetipv4addrwithprefixlen dissectlspextipreachabilityclv isisdissectclvs...

OSV-2020-190 Use-of-uninitialized-value in file_vprintf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20729 Crash type: Use-of-uninitialized-value Crash state: filevprintf fileprintf filebuffer...

OSV-2020-207 Heap-buffer-overflow in pcpp::IPv6Layer::parseExtensions

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22232 Crash type: Heap-buffer-overflow READ 1 Crash state: pcpp::IPv6Layer::parseExtensions pcpp::IPv6Layer::IPv6Layer pcpp::Packet::createFirstLayer...

OSV-2020-179 Heap-buffer-overflow in get16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20832 Crash type: Heap-buffer-overflow READ 2 Crash state: get16 searchvaliddns ndpisearchdns...

OSV-2020-171 Heap-buffer-overflow in ndpi_parse_packet_line_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23396 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpiparsepacketlineinfo ndpiintsearchbittorrenttcpzero ndpiintsearchbittorrenttcp...

OSV-2020-185 Heap-buffer-overflow in ndpi_search_kerberos

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22419 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpisearchkerberos checkndpiudpflowfunc ndpicheckflowfunc...

OSV-2020-170 Heap-buffer-overflow in populate_relocs_record

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21850 Crash type: Heap-buffer-overflow WRITE 4 Crash state: populaterelocsrecord relocs rbinobjectsetitems...

OSV-2020-174 Heap-buffer-overflow in int arrow::BitUtil::BitReader::GetBatch<short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21166 Crash type: Heap-buffer-overflow WRITE 8 Crash state: int arrow::BitUtil::BitReader::GetBatch int arrow::util::RleDecoder::GetBatch parquet::internal::TypedRecordReaderparquet::PhysicalType...

OSV-2020-182 Heap-buffer-overflow in hb_array_t<OT::IntType<unsigned char, 1u> const> hb_array_t<OT::IntType<unsigned

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20249 Crash type: Heap-buffer-overflow READ 1 Crash state: hbarrayt const hbarrayt ::copy OT::SBIXGlyph::copy...

OSV-2020-183 Global-buffer-overflow in hb_array_t<OT::IntType<unsigned char, 1u> const> hb_array_t<OT::IntType<unsigned

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20321 Crash type: Global-buffer-overflow READ 1 Crash state: hbarrayt const hbarrayt ::copy OT::SBIXGlyph::copy...

OSV-2020-184 Heap-buffer-overflow in file_strncmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23044 Crash type: Heap-buffer-overflow READ 13 Crash state: filestrncmp magiccheck match...

OSV-2020-166 Heap-buffer-overflow in ndpi_parse_packet_line_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22498 Crash type: Heap-buffer-overflow READ 2 Crash state: ndpiparsepacketlineinfo ndpiintsearchbittorrenttcpzero ndpiintsearchbittorrenttcp...

OSV-2020-180 Heap-buffer-overflow in parquet::PlainByteArrayDecoder::DecodeArrowDense

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21009 Crash type: Heap-buffer-overflow READ 4 Crash state: parquet::PlainByteArrayDecoder::DecodeArrowDense parquet::PlainByteArrayDecoder::DecodeArrow parquet::internal::ByteArrayChunkedRecordReader::ReadValuesSpaced...

OSV-2020-177 UNKNOWN in get_ndpi_flow_info6

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20747 Crash type: UNKNOWN Crash state: getndpiflowinfo6 packetprocessing ndpiworkflowprocesspacket...

OSV-2020-173 Use-of-uninitialized-value in BaseCryptStream::BaseCryptStream

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20200 Crash type: Use-of-uninitialized-value Crash state: BaseCryptStream::BaseCryptStream DecryptStream::DecryptStream Parser::getObj...

OSV-2020-181 Heap-buffer-overflow in get_ndpi_flow_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20162 Crash type: Heap-buffer-overflow READ 2 Crash state: getndpiflowinfo packetprocessing ndpiworkflowprocesspacket...

OSV-2020-176 UNKNOWN READ in OT::SBIXGlyph::copy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20223 Crash type: UNKNOWN READ Crash state: OT::SBIXGlyph::copy OT::SBIXStrike::subset OT::sbix::addstrike...

OSV-2020-178 Heap-buffer-overflow in concat_hash_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21257 Crash type: Heap-buffer-overflow READ 4 Crash state: concathashstring ndpisearchsshtcp searchsshagain...

OSV-2020-146 Heap-buffer-overflow in Json::OurReader::parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21916 Crash type: Heap-buffer-overflow READ 1 Crash state: Json::OurReader::parse Json::OurCharReader::parse fuzz.cpp...

OSV-2020-156 Heap-buffer-overflow in flb_unescape_string_utf8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22132 Crash type: Heap-buffer-overflow READ 1 Crash state: flbunescapestringutf8 logfmtparser flbparserlogfmtdo...

OSV-2020-144 Heap-use-after-free in int arrow::BitUtil::BitReader::GetBatch<short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20685 Crash type: Heap-use-after-free WRITE 2 Crash state: int arrow::BitUtil::BitReader::GetBatch parquet::LevelDecoder::Decode parquet::internal::TypedRecordReaderparquet::PhysicalType...

OSV-2020-165 UNKNOWN READ in apache::thrift::protocol::TCompactProtocolT<apache::thrift::transport::TMemoryBu

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20670 Crash type: UNKNOWN READ Crash state: apache::thrift::protocol::TCompactProtocolT...

OSV-2020-143 Heap-buffer-overflow in QSpecialInteger<QBigEndianStorageType<unsigned int> >::operator unsigned int

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21909 Crash type: Heap-buffer-overflow READ 4 Crash state: QSpecialInteger ::operator unsigned int QIcc::fromIccProfile QColorSpace::fromIccProfile...

OSV-2020-154 Heap-buffer-overflow in search_valid_dns

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21263 Crash type: Heap-buffer-overflow READ 1 Crash state: searchvaliddns ndpisearchdns checkndpiudpflowfunc...

OSV-2020-148 Use-of-uninitialized-value in AES_encrypt

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23015 Crash type: Use-of-uninitialized-value Crash state: AESencrypt AESwrapkey aeswrapcipher...

OSV-2020-160 Heap-buffer-overflow in populate_relocs_record

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21842 Crash type: Heap-buffer-overflow WRITE 4 Crash state: populaterelocsrecord relcachenew getimportaddr...

OSV-2020-147 Heap-buffer-overflow in BEInt<short, 2>::operator short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21026 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator short OT::IntType::operator int OT::TupleVarHeader::calculatescalar...

OSV-2020-149 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator=

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21580 Crash type: Heap-buffer-overflow WRITE 1 Crash state: BEInt::operator= OT::IntType::operator= bool OT::ClassDefFormat1::serializehbzipiterthbsortedarraytOT::HBGlyphI...

OSV-2020-161 Heap-use-after-free in jbig2_release_huffman_table

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21587 Crash type: Heap-use-after-free READ 8 Crash state: jbig2releasehuffmantable jbig2textregion jbig2datain...

OSV-2020-153 UNKNOWN WRITE in Variant_encodeJson

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20578 Crash type: UNKNOWN WRITE Crash state: VariantencodeJson VariantencodeJson VariantencodeJson...

OSV-2020-164 Stack-buffer-overflow in ot::NetworkData::NetworkData::FindService

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21762 Crash type: Stack-buffer-overflow READ Crash state: ot::NetworkData::NetworkData::FindService ot::NetworkData::Leader::Validate ot::NetworkData::Leader::RegisterNetworkData...

OSV-2020-150 Segv on unknown address in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20457 Crash type: Segv on unknown address Crash state: std::1::basicstring, std::1::allocator, std::1::allocatorch wabt::BinaryReaderIR::OnDataSymbol...

OSV-2020-142 Heap-use-after-free in ndpi_strncasestr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22816 Crash type: Heap-use-after-free READ 1 Crash state: ndpistrncasestr ndpihttpcheckcontent ndpiinthttpaddconnection...

OSV-2020-129 UNKNOWN READ in pcpp::Packet::setRawPacket

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23011 Crash type: UNKNOWN READ Crash state: pcpp::Packet::setRawPacket pcpp::Packet::Packet FuzzTarget.cpp...

OSV-2020-133 Heap-use-after-free in r_bin_object_rebuild_classes_ht

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21602 Crash type: Heap-use-after-free READ 8 Crash state: rbinobjectrebuildclassesht rbinobjectsetitems rbinobjectnew...

OSV-2020-136 Heap-buffer-overflow in ndpi_netbios_name_interpret

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20823 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpinetbiosnameinterpret ndpiintnetbiosaddconnection checkndpiudpflowfunc...

OSV-2020-137 UNKNOWN READ in dav1d_resize_ssse3

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21547 Crash type: UNKNOWN READ Crash state: dav1dresizessse3...

OSV-2020-134 Heap-buffer-overflow in pixFewColorsOctcubeQuantMixed

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22140 Crash type: Heap-buffer-overflow READ 1 Crash state: pixFewColorsOctcubeQuantMixed colorquantfuzzer.cc...

OSV-2020-121 Heap-buffer-overflow in BEInt<short, 2>::operator short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21092 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator short OT::IntType::operator int OT::SegmentMaps::map...

OSV-2020-141 Heap-use-after-free in pixcmapDestroy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22110 Crash type: Heap-use-after-free READ 8 Crash state: pixcmapDestroy colorquantfuzzer.cc pixcmapDestroy...

OSV-2020-132 Heap-buffer-overflow in asn1_parse_oid

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20363 Crash type: Heap-buffer-overflow READ 1 Crash state: asn1parseoid asn1getoid x509parseextcertificatepolicies...

OSV-2020-131 Heap-buffer-overflow in pixGetRGBComponentCmap

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22295 Crash type: Heap-buffer-overflow READ 1 Crash state: pixGetRGBComponentCmap pixGetRGBComponent pixUnsharpMasking...