@@ -13,6 +13,9 @@ description: A corrupted object.
1313 Attempting a malloc for the section could
1414 succeed or might fail, resulting in
1515 Denial Of Service.
16+ <pre>
17+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41240
18+ </pre>
1619datefixed: 2021-11-21
1720references: regressiontests/ ossfuzz41240/clusterfuzz-testcase-minimized-fuzz_init_path-5929343686148096
1821gitfixid: a120c808234060c3c9b1872ab9a059aa1ac70b1d
@@ -29,6 +32,9 @@ product: libdwarf
2932description: A corrupted object.
3033 Several Elf section sizes and section offsets are larger than
3134 the file size.
35+ <pre>
36+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40896
37+ </pre>
3238datefixed: 2021-11-12
3339references: regressiontests/ossfuzz40896/clusterfuzz-testcase-fuzz_init_path-5337872492789760
3440 regressiontests/ossfuzz40896/clusterfuzz-testcase-minimized-fuzz_init_path-5337872492789760
@@ -45,6 +51,9 @@ vulnerability: Out-of-memory in fuzz_init_binary
4551product: libdwarf
4652description: A corrupted object.
4753 Some Elf section sizes are larger than the file size.
54+ <pre>
55+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40895
56+ </pre>
4857datefixed: 2021-11-12
4958references: regressiontests/ossfuzz40895/clusterfuzz-testcase-fuzz_init_binary-4805508242997248
5059 regressiontests/ossfuzz40895/clusterfuzz-testcase-minimized-fuzz_init_binary-4805508242997248
@@ -78,6 +87,9 @@ description: A corrupted object.
7887 The error handling code in dwarf_object_init_b
7988 was not properly dealing with a NULL pointer
8089 Dwarf_Error *errp in the test code.
90+ <pre>
91+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40802
92+ </pre>
8193datefixed: 2021-11-19
8294references: regressiontests/ossfuzz40802/ clusterfuzz-testcase-fuzz_init_binary-5538015955517440.fuzz
8395 regressiontests/ossfuzz40802/clusterfuzz-testcase-minimized-fuzz_init_binary-5538015955517440.fuzz
@@ -96,6 +108,9 @@ reportedby: David Korczynski
96108vulnerability: Timeout in fuzz_init_path
97109product: libdwarf
98110description: A corrupted object. libdwarf detects it quickly now.
111+ <pre>
112+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40801
113+ </pre>
99114datefixed: 2021-11-07
100115references: regressiontests/ossfuzz801/clusterfuzz-testcase-fuzz_init_path-5443517279764480
101116 regressiontests/ossfuzz40801/clusterfuzz-testcase-minimized-fuzz_init_path-5443517279764480
@@ -115,6 +130,9 @@ description: A corrupted object.
115130 Gigantic section sizes or offsets were provoking
116131 a large malloc. Now these are detected and
117132 no malloc is attempted (an error is returned).
133+ <pre>
134+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40799
135+ </pre>
118136datefixed: 2021-11-07
119137references: regressiontests/ossfuzz40799/clusterfuzz-testcase-fuzz_init_path-5245778948390912
120138 regressiontests/ossfuzz40799/clusterfuzz-testcase-minimized-fuzz_init_path-5245778948390912
@@ -133,6 +151,9 @@ vulnerability: Abrt in _dwarf_error_string
133151product: libdwarf
134152description: The Elf object file has some corruption. The
135153 read now stops with an error.
154+ <pre>
155+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40627
156+ </pre>
136157datefixed: 2021-11-07
137158references: regressiontests/ossfuzz40627/clusterfuzz-testcase-fuzz_init_path-5186858573758464
138159 regressiontests/ossfuzz40627/clusterfuzz-testcase-minimized-fuzz_init_path-5186858573758464
@@ -153,6 +174,9 @@ description: The object file (macho 64 bit) has some
153174 tried a gigantic malloc..
154175 Now the library code catches the error before malloc and
155176 returns an error code.
177+ <pre>
178+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40729
179+ </pre>
156180datefixed: 2021-11-07
157181references: regressiontests/ossfuzz40729/clusterfuzz-testcase-minimized-fuzz_init_binary-4791627277795328
158182gitfixid: 94dece3ce0f030d06da442a103bd6a5301410b25
@@ -168,6 +192,9 @@ vulnerability: Out-of-memory in fuzz_init_binary
168192product: libdwarf
169193description: The fuzzed macho64 object has corrupted
170194 headers. The library notices and reports an error.
195+ <pre>
196+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40731
197+ </pre>
171198datefixed: 2021-11-07
172199references: regressiontests/ossfuzz40731/clusterfuzz-testcase-fuzz_init_binary-5983147574034432
173200gitfixid: 94dece3ce0f030d06da442a103bd6a5301410b25
@@ -183,6 +210,10 @@ reportedby: David Korczynski
183210vulnerability: Heap-buffer-overflow in _dwarf_elf_setup_all_section_groups
184211product: libdwarf
185212description: Object file has corrupt section group information.
213+ Results in buffer overflow.
214+ <pre>
215+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40674#c6
216+ </pre>
186217datefixed: 2021-11-07
187218references: regressiontests/ossfuzz40674/clusterfuzz-testcase-minimized-fuzz_init_path-6557751518560256
188219gitfixid: 94dece3ce0f030d06da442a103bd6a5301410b25
@@ -199,6 +230,9 @@ product: libdwarf
199230description: The macho object has corrupted headers
200231 and now mentions that and stops.
201232 Verified as fixed by oss-fuzz 2021-11-03
233+ <pre>
234+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40673
235+ </pre>
202236datefixed: 2021-11-05
203237references: regressiontests/ossfuzz40673/clusterfuzz-testcase-minimized-fuzz_init_path-6240961391362048.fuzz
204238gitfixid: 94dece3ce0f030d06da442a103bd6a5301410b25
@@ -218,6 +252,9 @@ description: The test code is calling a libdwarf-internal
218252 When building libdwarf as an archive there is no
219253 means to enforce this rule)
220254 doc/libdwarf.mm/pdf now documents this rule.
255+ <pre>
256+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40671
257+ </pre>
221258datefixed: 2021-11-05
222259references: regressiontests/oss40671/clusterfuzz-testcase-fuzz_init_path-5455557297831936
223260 regressiontests/oss40671/clusterfuzz-testcase-minimized-fuzz_init_path-5455557297831936
@@ -239,6 +276,9 @@ description: Corrupted MachO object can crash caller.b
239276 could lead to excessive malloc and or a caller
240277 segmentation violation. Fixed by DW202111-001.
241278 Verified as fixed by oss-fuzz
279+ <pre>
280+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40669
281+ </pre>
242282datefixed: 2021-11-04
243283references: regressiontests/ossfuzz40669/clusterfuzz-testcase-minimized-fuzz_init_path-5399726397194240
244284 regressiontests/clusterfuzz-testcase-fuzz_init_path-5399726397194240
@@ -263,6 +303,9 @@ description: Corrupted MachO object can crash caller
263303 Verified by oss-fuzz as fixed.
264304 The testcase has illegal libdwarf call
265305 and improper include statements.
306+ <pre>
307+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40663
308+ </pre>
266309datefixed: 2021-11-04
267310references: regressiontests/ossfuzz40663/clusterfuzz-testcase-minimized-fuzz_init_path-6122542432124928
268311gitfixid: b40f7e291216e771185f62292dd6304b5a662926
@@ -271,7 +314,7 @@ endrec: DW202111-001
271314
272315
273316id: DW202010-003
274- cve: a cve id requested 29 Oct 2020
317+ cve: CVE-202-28163
275318datereported: 2020-10-27
276319reportedby: Casper Sun
277320vulnerability: Passing null to %s due to corrupt line table header.
@@ -292,7 +335,7 @@ endrec: DW202010-003
292335
293336
294337id: DW202010-002
295- cve: a cve id requested 29 Oct 2020
338+ cve: CVE- 2020-28162
296339datereported: 2020-10-27
297340reportedby: Casper Sun
298341vulnerability: A very deep DIE tree can corrupt random data.
@@ -317,7 +360,7 @@ tarrelease:
317360endrec: DW202010-002
318361
319362id: DW202010-001
320- cve: waiting for cve id to be granted
363+ cve: CVE-2020-27545
321364datereported: 2020-10-10
322365reportedby: Casper Sun
323366vulnerability: A carefully corrupted line table can crash calling app
@@ -332,6 +375,11 @@ description: A carefully crafted object with an
332375 so an invalid dereference could occur.
333376 Now the test code is correct and the error
334377 is detected resulting in a normal error return.
378+ <pre>
379+ This should be visible after redhat makes it public.
380+ Filed on bugzilla.redhat 22 November 2021.
381+ bugzilla.redhat.com/show_bug.cgi?id=2025694
382+ </pre>
335383datefixed: 2020-10-17
336384references: regressiontests/c-sun/poc
337385gitfixid: 95f634808c01f1c61bbec56ed2395af997f397ea
0 commit comments