OSV-2020-254 Heap-buffer-overflow in pixReadFromTiffStream

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23654 Crash type: Heap-buffer-overflow READ 1 Crash state: pixReadFromTiffStream pixReadMemTiff pixReadMem...

OSV-2020-247 Use-of-uninitialized-value in WavpackDeleteTagItem

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20060 Crash type: Use-of-uninitialized-value Crash state: WavpackDeleteTagItem WavpackAppendTagItem fuzzer.cc...

OSV-2020-248 Heap-use-after-free in LocalizedText_clear

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20061 Crash type: Heap-use-after-free READ 8 Crash state: LocalizedTextclear Variantclear UAclear...

OSV-2020-250 UNKNOWN READ in Sass::Inspect::operator

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19988 Crash type: UNKNOWN READ Crash state: Sass::Inspect::operator Sass::Output::operator Sass::Output::operator...

OSV-2020-249 Heap-buffer-overflow in cipher_generic_initiv

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19926 Crash type: Heap-buffer-overflow READ 16 Crash state: ciphergenericinitiv ciphergenericinitinternal cryptofuzz::module::OpenSSL::OpSymmetricDecryptEVP...

OSV-2020-243 Heap-buffer-overflow in OT::VarRegionList::serialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19956 Crash type: Heap-buffer-overflow READ 12 Crash state: OT::VarRegionList::serialize OT::VariationStore::serialize bool OT::HVARVVAR::subset...

OSV-2020-245 Heap-use-after-free in ndpi_http_check_content

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23046 Crash type: Heap-use-after-free READ 3 Crash state: ndpihttpcheckcontent checkcontenttypeandchangeprotocol ndpicheckhttptcp...

OSV-2020-240 UNKNOWN READ in perfetto::trace_processor::TraceStorage::GetIdForVariadicType

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19999 Crash type: UNKNOWN READ Crash state: perfetto::traceprocessor::TraceStorage::GetIdForVariadicType perfetto::traceprocessor::GlobalArgsTracker::AddArgSet perfetto::traceprocessor::ArgsTracker::Flush...

OSV-2020-242 Heap-buffer-overflow in ndpi_workflow_process_packet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20089 Crash type: Heap-buffer-overflow READ 2 Crash state: ndpiworkflowprocesspacket fuzzndpireader.c...

OSV-2020-244 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20036 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::IndexArray::addindexesto...

OSV-2020-236 Heap-buffer-overflow in get_ndpi_flow_info6

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20091 Crash type: Heap-buffer-overflow READ 4 Crash state: getndpiflowinfo6 packetprocessing ndpiworkflowprocesspacket...

OSV-2020-238 Heap-use-after-free in copy_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19990 Crash type: Heap-use-after-free READ 1 Crash state: copystring douncompressblock processblock...

OSV-2020-233 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20022 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int decltype...

OSV-2020-231 UNKNOWN WRITE in gen_mftr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20081 Crash type: UNKNOWN WRITE Crash state: genmftr...

OSV-2020-232 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20021 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::ArrayOf...

OSV-2020-214 Heap-use-after-free in String_clear

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20437 Crash type: Heap-use-after-free READ 8 Crash state: Stringclear clearStructure Variantclear...

OSV-2020-218 Heap-buffer-overflow in __libcpp_strstr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23145 Crash type: Heap-buffer-overflow READ 13 Crash state: libcppstrstr strstr pcpp::SipRequestFirstLine::parseVersion...

OSV-2020-227 Heap-double-free in spng__free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22720 Crash type: Heap-double-free Crash state: spngfree spnginflatestream readnonidatchunks...

OSV-2020-208 Use-of-uninitialized-value in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22235 Crash type: Use-of-uninitialized-value Crash state: std::1::basicstring, std::1::allocator, std::1::allocatorch pcpp::IDnsResource::IDnsResource...

OSV-2020-213 Heap-buffer-overflow in Op_YCbCr422_to_RGB_16bit::convert_colorspace

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21114 Crash type: Heap-buffer-overflow READ Crash state: OpYCbCr422toRGB16bit::convertcolorspace heif::ColorConversionPipeline::convertimage heif::convertcolorspace...

OSV-2020-209 Stack-buffer-overflow in coolkey_rsa_op

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22392 Crash type: Stack-buffer-overflow READ Crash state: coolkeyrsaop coolkeycomputecrypt scdecipher...

OSV-2020-215 Use-of-uninitialized-value in xmlStrdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23144 Crash type: Use-of-uninitialized-value Crash state: xmlStrdup xmlRaiseError xmlErrValidNode...

OSV-2020-225 Heap-buffer-overflow in dname_pkt_compare

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20308 Crash type: Heap-buffer-overflow READ 1 Crash state: dnamepktcompare scrubnormalize scrubmessage...

OSV-2020-224 Use-of-uninitialized-value in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23038 Crash type: Use-of-uninitialized-value Crash state: std::1::basicstring, std::1::allocator, std::1::allocatorch pcpp::IDnsResource::IDnsResource...

OSV-2020-211 Heap-buffer-overflow in res2_inverse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22298 Crash type: Heap-buffer-overflow READ 4 Crash state: res2inverse mapping0inverse vorbissynthesis1...

OSV-2020-223 Heap-use-after-free in CRYPTO_DOWN_REF

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21550 Crash type: Heap-use-after-free WRITE 4 Crash state: CRYPTODOWNREF DHfree evppkeyfreelegacy...

OSV-2020-189 Stack-buffer-overflow in tvb_get_ipv4_addr_with_prefix_len

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21718 Crash type: Stack-buffer-overflow READ 4 Crash state: tvbgetipv4addrwithprefixlen dissectlspextipreachabilityclv isisdissectclvs...

OSV-2020-201 Use-of-uninitialized-value in fuzzing::memory::memory_test_msan

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22453 Crash type: Use-of-uninitialized-value Crash state: fuzzing::memory::memorytestmsan cryptofuzz::ExecutorBase::postp cryptofuzz::ExecutorBase::Run...

OSV-2020-187 UNKNOWN READ in arrow::ipc::MessageDecoder::MessageDecoderImpl::ConsumeDataBufferInt32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21680 Crash type: UNKNOWN READ Crash state: arrow::ipc::MessageDecoder::MessageDecoderImpl::ConsumeDataBufferInt32 arrow::ipc::MessageDecoder::MessageDecoderImpl::ConsumeInitialBuffer...

OSV-2020-207 Heap-buffer-overflow in pcpp::IPv6Layer::parseExtensions

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22232 Crash type: Heap-buffer-overflow READ 1 Crash state: pcpp::IPv6Layer::parseExtensions pcpp::IPv6Layer::IPv6Layer pcpp::Packet::createFirstLayer...

OSV-2020-204 Negative-size-param in parquet::ColumnReaderImplBase<parquet::PhysicalType<

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20698 Crash type: Negative-size-param Crash state: parquet::ColumnReaderImplBaseparquet::PhysicalType parquet::internal::TypedRecordReaderparquet::PhysicalType parquet::arrow::LeafReader::NextBatch...

OSV-2020-194 Heap-buffer-overflow in check_ymsg

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20856 Crash type: Heap-buffer-overflow READ 4 Crash state: checkymsg ndpisearchyahootcp ndpisearchyahoo...

OSV-2020-200 Heap-buffer-overflow in spng_decode_scanline

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22595 Crash type: Heap-buffer-overflow WRITE 2 Crash state: spngdecodescanline spngdecoderow spngdecodeimage...

OSV-2020-188 Heap-buffer-overflow in BEInt<short, 2>::operator short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20924 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator short OT::IntType::operator int OT::TupleVarHeader::calculatescalar...

OSV-2020-196 Heap-use-after-free in Pe64_r_bin_pe_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21630 Crash type: Heap-use-after-free READ 8 Crash state: Pe64rbinpefree rbinfilefree rlistdelete...

OSV-2020-197 Heap-buffer-overflow in jbig2_image_get_pixels_fast

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20358 Crash type: Heap-buffer-overflow READ 1 Crash state: jbig2imagegetpixelsfast jbig2decodegenerictemplate0TPGDON jbig2immediategenericregion...

OSV-2020-190 Use-of-uninitialized-value in file_vprintf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20729 Crash type: Use-of-uninitialized-value Crash state: filevprintf fileprintf filebuffer...

OSV-2020-181 Heap-buffer-overflow in get_ndpi_flow_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20162 Crash type: Heap-buffer-overflow READ 2 Crash state: getndpiflowinfo packetprocessing ndpiworkflowprocesspacket...

OSV-2020-185 Heap-buffer-overflow in ndpi_search_kerberos

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22419 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpisearchkerberos checkndpiudpflowfunc ndpicheckflowfunc...

OSV-2020-183 Global-buffer-overflow in hb_array_t<OT::IntType<unsigned char, 1u> const> hb_array_t<OT::IntType<unsigned

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20321 Crash type: Global-buffer-overflow READ 1 Crash state: hbarrayt const hbarrayt ::copy OT::SBIXGlyph::copy...

OSV-2020-178 Heap-buffer-overflow in concat_hash_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21257 Crash type: Heap-buffer-overflow READ 4 Crash state: concathashstring ndpisearchsshtcp searchsshagain...

OSV-2020-177 UNKNOWN in get_ndpi_flow_info6

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20747 Crash type: UNKNOWN Crash state: getndpiflowinfo6 packetprocessing ndpiworkflowprocesspacket...

OSV-2020-170 Heap-buffer-overflow in populate_relocs_record

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21850 Crash type: Heap-buffer-overflow WRITE 4 Crash state: populaterelocsrecord relocs rbinobjectsetitems...

OSV-2020-171 Heap-buffer-overflow in ndpi_parse_packet_line_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23396 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpiparsepacketlineinfo ndpiintsearchbittorrenttcpzero ndpiintsearchbittorrenttcp...

OSV-2020-174 Heap-buffer-overflow in int arrow::BitUtil::BitReader::GetBatch<short>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21166 Crash type: Heap-buffer-overflow WRITE 8 Crash state: int arrow::BitUtil::BitReader::GetBatch int arrow::util::RleDecoder::GetBatch parquet::internal::TypedRecordReaderparquet::PhysicalType...

OSV-2020-182 Heap-buffer-overflow in hb_array_t<OT::IntType<unsigned char, 1u> const> hb_array_t<OT::IntType<unsigned

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20249 Crash type: Heap-buffer-overflow READ 1 Crash state: hbarrayt const hbarrayt ::copy OT::SBIXGlyph::copy...

OSV-2020-180 Heap-buffer-overflow in parquet::PlainByteArrayDecoder::DecodeArrowDense

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21009 Crash type: Heap-buffer-overflow READ 4 Crash state: parquet::PlainByteArrayDecoder::DecodeArrowDense parquet::PlainByteArrayDecoder::DecodeArrow parquet::internal::ByteArrayChunkedRecordReader::ReadValuesSpaced...

OSV-2020-184 Heap-buffer-overflow in file_strncmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23044 Crash type: Heap-buffer-overflow READ 13 Crash state: filestrncmp magiccheck match...

OSV-2020-166 Heap-buffer-overflow in ndpi_parse_packet_line_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22498 Crash type: Heap-buffer-overflow READ 2 Crash state: ndpiparsepacketlineinfo ndpiintsearchbittorrenttcpzero ndpiintsearchbittorrenttcp...

OSV-2020-176 UNKNOWN READ in OT::SBIXGlyph::copy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20223 Crash type: UNKNOWN READ Crash state: OT::SBIXGlyph::copy OT::SBIXStrike::subset OT::sbix::addstrike...