{"id":"OSV-2022-327","summary":"Stack-use-after-return in QSemaphore::release","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46525\n\nThe issue already existed before oss-fuzz could reproduce it. oss-fuzz found\nit after qdrawhelper routines were made multithreaded. There might be ways to\ntrigger the issue before that.\n\n```\nCrash type: Stack-use-after-return WRITE 8\nCrash state:\nQSemaphore::release\nstd::__1::__function::__func\u003cvoid handleSpans\u003cBlendSrcGeneric\u003e\nFunctionRunnable::run\n```\n","modified":"2022-04-27T22:12:36.132079Z","published":"2022-04-10T00:01:12.211800Z","references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46525"},{"type":"REPORT","url":"https://bugreports.qt.io/browse/QTBUG-102484"},{"type":"FIX","url":"https://codereview.qt-project.org/c/qt/qtbase/+/406260"},{"type":"FIX","url":"https://codereview.qt-project.org/c/qt/qtbase/+/406261"},{"type":"FIX","url":"https://codereview.qt-project.org/c/qt/qtbase/+/405857"}],"affected":[{"package":{"name":"qt","ecosystem":"OSS-Fuzz","purl":"pkg:generic/qt"},"ranges":[{"type":"GIT","repo":"git://code.qt.io/qt/qtbase.git","events":[{"introduced":"b18959ad7ebe2311993348f779087b214bd7a72b"},{"fixed":"da5a55e034c74a42485358cf704e75467a62696e"},{"fixed":"a210635b6d8f7b94453914d6798a83b41964e7ea"},{"fixed":"830b1550de303dd59c29a87c28e44fa41112b8f4"},{"fixed":"05ffea9775e75d7890c833bff3d2e9682072c736"},{"fixed":"fd8441a97cdd212098aeb214b2a5b2caaf108e3c"}]}],"ecosystem_specific":{"severity":null},"database_specific":{"fixed_range":"88532603ff2836249e576e902d322585fc2b3ed2:05ffea9775e75d7890c833bff3d2e9682072c736","source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qt/OSV-2022-327.yaml"}}],"schema_version":"1.7.3"}