OSV-2020-32 Heap-buffer-overflow in read_bits_16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20459 Crash type: Heap-buffer-overflow READ 1 Crash state: readbits16 decodenumber douncompressblock...

OSV-2020-40 Heap-buffer-overflow in ndpi_workflow_process_packet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20766 Crash type: Heap-buffer-overflow READ 2 Crash state: ndpiworkflowprocesspacket fuzzndpireader.c...

OSV-2020-45 Use-of-uninitialized-value in pcpp::tbp_my_own_strnlen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22829 Crash type: Use-of-uninitialized-value Crash state: pcpp::tbpmyownstrnlen pcpp::HeaderField::HeaderField pcpp::TextBasedProtocolMessage::parseFields...

OSV-2020-38 Heap-buffer-overflow in OGRFeatureFormatDateTimeBuffer

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23417 Crash type: Heap-buffer-overflow WRITE 2 Crash state: OGRFeatureFormatDateTimeBuffer OGRFeature::GetFieldAsString OGRMemLayer::AlterFieldDefn...

OSV-2020-39 Heap-use-after-free in ndpi_http_check_content

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22899 Crash type: Heap-use-after-free READ 1 Crash state: ndpihttpcheckcontent ndpiinthttpaddconnection ndpicheckhttptcp...

OSV-2020-52 Heap-buffer-overflow in int arrow::util::RleDecoder::GetBatchWithDictSpaced<double>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20665 Crash type: Heap-buffer-overflow READ 8 Crash state: int arrow::util::RleDecoder::GetBatchWithDictSpaced virtual thunk to parquet::DictDecoderImplparquet::PhysicalType...

OSV-2020-54 Heap-buffer-overflow in OT::HintingDevice* hb_serialize_context_t::embed<OT::HintingDevice>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20211 Crash type: Heap-buffer-overflow READ Crash state: OT::HintingDevice hbserializecontextt::embed OT::HintingDevice::copy OT::Device::copy...

OSV-2020-53 Index-out-of-bounds in parse_exp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22925 Crash type: Index-out-of-bounds Crash state: parseexp parsebranch parsealts...

OSV-2020-50 Bad-cast to pcpp::IDnsResource from invalid vptr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22872 Crash type: Bad-cast Crash state: Bad-cast to pcpp::IDnsResource from invalid vptr pcpp::DnsLayer::DnsLayer pcpp::DnsLayer::DnsLayer...

OSV-2020-48 UNKNOWN READ in decode_fast

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20448 Crash type: UNKNOWN READ Crash state: decodefast unpackdsdsamples WavpackUnpackSamples...

OSV-2020-34 UNKNOWN READ in parquet::LevelDecoder::SetData

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20666 Crash type: UNKNOWN READ Crash state: parquet::LevelDecoder::SetData parquet::ColumnReaderImplBaseparquet::PhysicalType parquet::ColumnReaderImplBaseparquet::PhysicalType...

OSV-2020-29 Heap-use-after-free in CRYPTO_DOWN_REF

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20816 Crash type: Heap-use-after-free WRITE 4 Crash state: CRYPTODOWNREF DHfree evppkeyfreeit...

OSV-2020-12 Use-of-uninitialized-value in ndpi_parse_packet_line_info

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23058 Crash type: Use-of-uninitialized-value Crash state: ndpiparsepacketlineinfo ndpicheckhttptcp ndpisearchhttptcp...

OSV-2020-26 UNKNOWN READ in parquet::DictDecoderImpl<parquet::PhysicalType<

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21567 Crash type: UNKNOWN READ Crash state: parquet::DictDecoderImplparquet::PhysicalType parquet::ColumnReaderImplBaseparquet::PhysicalType parquet::ColumnReaderImplBaseparquet::PhysicalType...

OSV-2020-18 Heap-buffer-overflow in ndpi_search_openvpn

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22244 Crash type: Heap-buffer-overflow READ 8 Crash state: ndpisearchopenvpn checkndpiudpflowfunc ndpidetectionprocesspacket...

OSV-2020-11 Heap-buffer-overflow in jbig2_image_get_pixel_fast

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20440 Crash type: Heap-buffer-overflow READ 1 Crash state: jbig2imagegetpixelfast jbig2decodegenerictemplate0TPGDON jbig2immediategenericregion...

OSV-2020-14 Stack-buffer-overflow in fmt_setup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22507 Crash type: Stack-buffer-overflow WRITE 1 Crash state: fmtsetup mrbstrformat mrbfsprintf...

OSV-2020-31 Heap-use-after-free in AES_wrap_key

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23014 Crash type: Heap-use-after-free READ 8 Crash state: AESwrapkey aeswrapcipher EVPEncryptUpdate...

OSV-2020-16 Heap-use-after-free in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20906 Crash type: Heap-use-after-free READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int OT::GlyphVarData::hasdata...

OSV-2020-19 Heap-use-after-free in htp_connp_is_line_terminator

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21712 Crash type: Heap-use-after-free READ 1 Crash state: htpconnpislineterminator htpconnpREQHEADERS htpconnpreqdata...

OSV-2020-22 Container-overflow in parquet::schema::Unflatten

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20897 Crash type: Container-overflow READ 4 Crash state: parquet::schema::Unflatten parquet::FileMetaData::FileMetaDataImpl::FileMetaDataImpl parquet::FileMetaData::FileMetaData...

OSV-2020-15 UNKNOWN READ in _01inverse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22245 Crash type: UNKNOWN READ Crash state: 01inverse res1inverse mapping0inverse...

OSV-2020-28 Heap-buffer-overflow in get16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20712 Crash type: Heap-buffer-overflow READ 2 Crash state: get16 searchvaliddns ndpisearchdns...

OSV-2020-27 Heap-buffer-overflow in parquet::LevelDecoder::SetData

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20940 Crash type: Heap-buffer-overflow READ 4 Crash state: parquet::LevelDecoder::SetData parquet::ColumnReaderImplBaseparquet::PhysicalType parquet::internal::TypedRecordReaderparquet::PhysicalType...

OSV-2020-21 UNKNOWN WRITE in arrow::internal::unpack32

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20711 Crash type: UNKNOWN WRITE Crash state: arrow::internal::unpack32 int arrow::BitUtil::BitReader::GetBatch parquet::DictByteArrayDecoderImpl::DecodeArrowDense...

OSV-2020-24 Heap-buffer-overflow in pcpp::SSLCertificateRequestMessage::SSLCertificateRequestMessage

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23026 Crash type: Heap-buffer-overflow READ 1 Crash state: pcpp::SSLCertificateRequestMessage::SSLCertificateRequestMessage pcpp::SSLHandshakeMessage::createHandhakeMessage pcpp::SSLHandshakeLayer::SSLHandshakeLayer...

OSV-2020-10 Heap-use-after-free in ndpi_workflow_process_packet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20164 Crash type: Heap-use-after-free READ 2 Crash state: ndpiworkflowprocesspacket fuzzndpireader.c noderelease...

OSV-2020-5 Heap-buffer-overflow in virtual thunk to parquet::ByteStreamSplitDecoder<parquet::PhysicalType<

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21453 Crash type: Heap-buffer-overflow READ 1 Crash state: virtual thunk to parquet::ByteStreamSplitDecoderparquet::PhysicalType parquet::TypedDecoderparquet::PhysicalType parquet::internal::TypedRecordReaderparquet::PhysicalT...

OSV-2020-4 Use-of-uninitialized-value in ndpi_check_dga_name

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23524 Crash type: Use-of-uninitialized-value Crash state: ndpicheckdganame ndpisearchdns checkndpiudpflowfunc...

OSV-2020-8 Heap-buffer-overflow in findNextBorderPixel

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23433 Crash type: Heap-buffer-overflow READ 4 Crash state: findNextBorderPixel pixGetHoleBorder pixGetCCBorders...

OSV-2020-7 Segv on unknown address in pvector_free_elem

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22734 Crash type: Segv on unknown address Crash state: pvectorfreeelem vectorfreeelems rvectorclear...

OSV-2020-1 Use-of-uninitialized-value in numaCrossingsByThreshold

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22764 Crash type: Use-of-uninitialized-value Crash state: numaCrossingsByThreshold numaSelectCrossingThreshold pixExtractBarcodeCrossings...

OSV-2020-3 UNKNOWN WRITE in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22962 Crash type: UNKNOWN WRITE Crash state: std::1::basicstring, std::1::allocator, std::1::allocatorch pcpp::IDnsResource::IDnsResource...