OSV-2020-130 Use-of-uninitialized-value in OT::TupleVarHeader::calculate_scalar

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20919 Crash type: Use-of-uninitialized-value Crash state: OT::TupleVarHeader::calculatescalar OT::gvar::acceleratort::applydeltastopoints bool OT::glyf::Glyph::getpointsbool OT::glyf::acceleratort::getpointsOT::gl...

OSV-2020-124 Dynamic-stack-buffer-overflow in RetrieveFPForSig

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21758 Crash type: Dynamic-stack-buffer-overflow WRITE 4 Crash state: RetrieveFPForSig DetectSetFastPatternAndItsId SigGroupBuild...

OSV-2020-125 Negative-size-param in parquet::PlainByteArrayDecoder::DecodeArrowDense

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20669 Crash type: Negative-size-param Crash state: parquet::PlainByteArrayDecoder::DecodeArrowDense parquet::PlainByteArrayDecoder::DecodeArrow parquet::internal::ByteArrayChunkedRecordReader::ReadValuesSpaced...

OSV-2020-122 Heap-buffer-overflow in ndpi_strnstr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22022 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpistrnstr ndpisearchnatstcp checkndpitcpflowfunc...

OSV-2020-138 Heap-buffer-overflow in org::apache::arrow::flatbuf::Message::Verify

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21681 Crash type: Heap-buffer-overflow READ 4 Crash state: org::apache::arrow::flatbuf::Message::Verify arrow::ipc::CheckMetadataAndGetBodyLength arrow::ipc::MessageDecoder::MessageDecoderImpl::ConsumeMetadata...

OSV-2020-109 UNKNOWN READ in arrow::BufferBuilder::Append

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20721 Crash type: UNKNOWN READ Crash state: arrow::BufferBuilder::Append arrow::BaseBinaryBuilder::Append parquet::ArrowBinaryHelper::Append...

OSV-2020-101 UNKNOWN READ in apache::thrift::transport::TMemoryBuffer::readSlow

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20681 Crash type: UNKNOWN READ Crash state: apache::thrift::transport::TMemoryBuffer::readSlow apache::thrift::transport::TBufferBase::read unsigned int apache::thrift::transport::readAllapache::thrift::transport::TBuff...

OSV-2020-102 Heap-use-after-free in vips_buf_vappendf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20843 Crash type: Heap-use-after-free READ 2 Crash state: vipsbufvappendf vipsverror vipserror...

OSV-2020-107 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20944 Crash type: Heap-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::gvar::getoffset...

OSV-2020-111 Heap-use-after-free in int std::__1::__cxx_atomic_fetch_sub<int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21604 Crash type: Heap-use-after-free WRITE 4 Crash state: int std::1::cxxatomicfetchsub std::1::atomicbase::operator-- Object::free...

OSV-2020-110 Heap-buffer-overflow in parquet::internal::RecordReader::Make

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20989 Crash type: Heap-buffer-overflow READ 8 Crash state: parquet::internal::RecordReader::Make parquet::arrow::LeafReader::LeafReader parquet::arrow::GetReader...

OSV-2020-115 UNKNOWN WRITE in arrow::BaseBinaryBuilder<arrow::BinaryType>::UnsafeAppend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21106 Crash type: UNKNOWN WRITE Crash state: arrow::BaseBinaryBuilder::UnsafeAppend parquet::PlainByteArrayDecoder::DecodeArrowDenseNonNull parquet::PlainByteArrayDecoder::DecodeArrow...

OSV-2020-104 Heap-buffer-overflow in void arrow::util::internal::ByteStreamSlitDecodeSSE2<double>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21420 Crash type: Heap-buffer-overflow READ 1 Crash state: void arrow::util::internal::ByteStreamSlitDecodeSSE2 virtual thunk to parquet::ByteStreamSplitDecoderparquet::PhysicalType parquet::TypedDecoderparquet::PhysicalType...

OSV-2020-113 Heap-buffer-overflow in vorbis_book_decodev_add

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22207 Crash type: Heap-buffer-overflow READ 4 Crash state: vorbisbookdecodevadd 01inverse res1inverse...

OSV-2020-114 Use-of-uninitialized-value in read_non_idat_chunks

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22646 Crash type: Use-of-uninitialized-value Crash state: readnonidatchunks readchunks spnggetplte...

OSV-2020-112 Heap-buffer-overflow in u8_read_escape_sequence

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22180 Crash type: Heap-buffer-overflow READ 1 Crash state: u8readescapesequence flbunescapestringutf8 logfmtparser...

OSV-2020-105 Segv on unknown address in cbor_typeof

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21387 Crash type: Segv on unknown address Crash state: cbortypeof cbornesteddescribe cbornesteddescribe...

OSV-2020-82 Heap-buffer-overflow in template_image_compose_opt

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20332 Crash type: Heap-buffer-overflow WRITE 1 Crash state: templateimagecomposeopt jbig2imagecomposeoptREPLACE jbig2imagecompose...

OSV-2020-88 Segv on unknown address in cbor_decref

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21386 Crash type: Segv on unknown address Crash state: cbordecref cbordecref cborload...

OSV-2020-97 Use-of-uninitialized-value in file_vprintf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20702 Crash type: Use-of-uninitialized-value Crash state: filevprintf fileprintf mget...

OSV-2020-95 Use-of-uninitialized-value in jbig2_arith_decode

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20493 Crash type: Use-of-uninitialized-value Crash state: jbig2arithdecode jbig2decodegenerictemplate0TPGDON jbig2immediategenericregion...

OSV-2020-86 Heap-buffer-overflow in bool arrow::util::RleDecoder::NextCounts<int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20735 Crash type: Heap-buffer-overflow WRITE Crash state: bool arrow::util::RleDecoder::NextCounts parquet::DictByteArrayDecoderImpl::DecodeArrowDense parquet::DictByteArrayDecoderImpl::DecodeArrow...

OSV-2020-92 Heap-buffer-overflow in ndpi_parse_packet_line_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22169 Crash type: Heap-buffer-overflow READ 2 Crash state: ndpiparsepacketlineinfo ndpisearchmailsmtptcp checkndpitcpflowfunc...

OSV-2020-78 Heap-buffer-overflow in ndpi_check_spotify

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22912 Crash type: Heap-buffer-overflow READ 7 Crash state: ndpicheckspotify ndpisearchspotify checkndpiudpflowfunc...

OSV-2020-85 Dynamic-stack-buffer-overflow in janus_rtcp_incoming_transport_cc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20529 Crash type: Dynamic-stack-buffer-overflow READ 2 Crash state: janusrtcpincomingtransportcc janusrtcpfixssrc rtcpfuzzer.c...

OSV-2020-79 Use-of-uninitialized-value in check_exif

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22714 Crash type: Use-of-uninitialized-value Crash state: checkexif readnonidatchunks readchunks...

OSV-2020-76 Heap-use-after-free in pixAverageRasterScans

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22760 Crash type: Heap-use-after-free READ 1 Crash state: pixAverageRasterScans pixExtractBarcodeCrossings pixExtractBarcodeWidths1...

OSV-2020-89 Heap-use-after-free in __xmlRaiseError

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23120 Crash type: Heap-use-after-free READ 2 Crash state: xmlRaiseError xmlErrValidNode xmlValidateRef...

OSV-2020-77 Use-of-uninitialized-value in jbig2_text_region

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21571 Crash type: Use-of-uninitialized-value Crash state: jbig2textregion jbig2parsesegment jbig2completepage...

OSV-2020-96 Heap-buffer-overflow in logfmt_parser

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21953 Crash type: Heap-buffer-overflow READ 1 Crash state: logfmtparser flbparserlogfmtdo parselogfmtfuzzer.c...

OSV-2020-87 Heap-buffer-overflow in Fax3Decode2D

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21044 Crash type: Heap-buffer-overflow WRITE 4 Crash state: Fax3Decode2D TIFFReadEncodedStrip GTiffDataset::ReadStrile...

OSV-2020-64 Heap-buffer-overflow in read_reloc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21835 Crash type: Heap-buffer-overflow WRITE 8 Crash state: readreloc populaterelocsrecordfromdynamic populaterelocsrecord...

OSV-2020-59 Heap-buffer-overflow in ndpi_add_connection_as_bittorrent

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20777 Crash type: Heap-buffer-overflow READ Crash state: ndpiaddconnectionasbittorrent ndpiintsearchbittorrenttcpzero checkndpitcpflowfunc...

OSV-2020-73 UNKNOWN WRITE in vips_foreign_load_gif_render

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20613 Crash type: UNKNOWN WRITE Crash state: vipsforeignloadgifrender vipsforeignloadgifnextpage vipsforeignloadgifgenerate...

OSV-2020-60 Heap-buffer-overflow in get_ndpi_flow_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20109 Crash type: Heap-buffer-overflow READ 2 Crash state: getndpiflowinfo getndpiflowinfo6 packetprocessing...

OSV-2020-75 Index-out-of-bounds in der_tag

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20753 Crash type: Index-out-of-bounds Crash state: dertag dercmp magiccheck...

OSV-2020-65 Heap-use-after-free in std::__1::vector<unsigned long, std::__1::allocator<unsigned long> >::begin

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21908 Crash type: Heap-use-after-free READ 8 Crash state: std::1::vector ::begin perfetto::traceprocessor::TrackTracker::ResolveDescriptorTrack perfetto::traceprocessor::TrackTracker::GetDescriptorTrackImpl...

OSV-2020-57 Stack-buffer-overflow in ot::NetworkData::PrefixTlv::GetPrefixLength

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23267 Crash type: Stack-buffer-overflow READ 1 Crash state: ot::NetworkData::PrefixTlv::GetPrefixLength ot::NetworkData::NetworkData::FindPrefix ot::NetworkData::Leader::Validate...

OSV-2020-55 Stack-buffer-overflow in tcos_decipher

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22967 Crash type: Stack-buffer-overflow WRITE Crash state: tcosdecipher scdecipher usekey...

OSV-2020-66 Heap-buffer-overflow in CPLErr GDALResampleChunk32R_AverageT<unsigned char, int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21558 Crash type: Heap-buffer-overflow READ 1 Crash state: CPLErr GDALResampleChunk32RAverageT GDALResampleChunk32RAverage GDALRasterBand::RasterIOResampled...

OSV-2020-72 Use-of-uninitialized-value in print_crl

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21153 Crash type: Use-of-uninitialized-value Crash state: printcrl gnutlsx509crlprint gnutlsx509crlparserfuzzer.c...

OSV-2020-71 Heap-buffer-overflow in ndpi_parse_packet_line_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22167 Crash type: Heap-buffer-overflow READ 8 Crash state: ndpiparsepacketlineinfo ndpichecksteamhttp ndpisearchsteam...

OSV-2020-62 Stack-buffer-overflow in tvb_get_ipv4_addr_with_prefix_len

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21715 Crash type: Stack-buffer-overflow READ 4 Crash state: tvbgetipv4addrwithprefixlen decodepathprefix4 decodeprefixMP...

OSV-2020-68 Heap-double-free in ares_parse_soa_reply

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21176 Crash type: Heap-double-free Crash state: aresparsesoareply ares-test-fuzz.c aresparsesoareply...

OSV-2020-58 Heap-buffer-overflow in asn1_get_next

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20373 Crash type: Heap-buffer-overflow READ 1 Crash state: asn1getnext x509parseextcertificatepolicies x509parseextensiondata...

OSV-2020-70 Heap-buffer-overflow in ndpi_handle_ipv6_extension_headers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21719 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpihandleipv6extensionheaders ndpiworkflowprocesspacket fuzzndpireader.c...

OSV-2020-67 Heap-buffer-overflow in ndpi_workflow_process_packet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21348 Crash type: Heap-buffer-overflow READ 2 Crash state: ndpiworkflowprocesspacket fuzzndpireader.c...

OSV-2020-63 UNKNOWN READ in arrow::BaseBinaryBuilder<arrow::BinaryType>::UnsafeAppend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20697 Crash type: UNKNOWN READ Crash state: arrow::BaseBinaryBuilder::UnsafeAppend parquet::PlainByteArrayDecoder::DecodeArrowDense parquet::PlainByteArrayDecoder::DecodeArrow...

OSV-2020-42 Heap-buffer-overflow in bool arrow::util::RleDecoder::NextCounts<int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20695 Crash type: Heap-buffer-overflow WRITE Crash state: bool arrow::util::RleDecoder::NextCounts int arrow::util::RleDecoder::GetBatchWithDictSpaced virtual thunk to parquet::DictDecoderImplparquet::PhysicalType...

OSV-2020-49 Heap-buffer-overflow in ndpi_netbios_name_interpret

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21365 Crash type: Heap-buffer-overflow READ 1 Crash state: ndpinetbiosnameinterpret ndpiintnetbiosaddconnection checkndpiudpflowfunc...