{"id":"OSV-2022-327","aliases":[],"status":"published","title":"Stack-use-after-return in QSemaphore::release","description":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46525\n\nThe issue already existed before oss-fuzz could reproduce it. oss-fuzz found\nit after qdrawhelper routines were made multithreaded. There might be ways to\ntrigger the issue before that.\n\n```\nCrash type: Stack-use-after-return WRITE 8\nCrash state:\nQSemaphore::release\nstd::__1::__function::__func\u003cvoid handleSpans\u003cBlendSrcGeneric\u003e\nFunctionRunnable::run\n```","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-04-10T00:01:12.2118Z","modified":"2022-04-27T22:12:36Z","affected":[{"source":"osv","ecosystem":"OSS-Fuzz","package":"qt","ranges":[{"type":"GIT","events":[{"introduced":"b18959ad7ebe2311993348f779087b214bd7a72b"},{"fixed":"da5a55e034c74a42485358cf704e75467a62696e"},{"fixed":"a210635b6d8f7b94453914d6798a83b41964e7ea"},{"fixed":"830b1550de303dd59c29a87c28e44fa41112b8f4"},{"fixed":"05ffea9775e75d7890c833bff3d2e9682072c736"},{"fixed":"fd8441a97cdd212098aeb214b2a5b2caaf108e3c"}]}]}],"references":[{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46525","tags":["report"]},{"url":"https://bugreports.qt.io/browse/QTBUG-102484","tags":["report"]},{"url":"https://codereview.qt-project.org/c/qt/qtbase/+/406260","tags":["fix"]},{"url":"https://codereview.qt-project.org/c/qt/qtbase/+/406261","tags":["fix"]},{"url":"https://codereview.qt-project.org/c/qt/qtbase/+/405857","tags":["fix"]}],"sources":{"osv":[{"id":"OSV-2022-327","title":"Stack-use-after-return in QSemaphore::release","description":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46525\n\nThe issue already existed before oss-fuzz could reproduce it. oss-fuzz found\nit after qdrawhelper routines were made multithreaded. There might be ways to\ntrigger the issue before that.\n\n```\nCrash type: Stack-use-after-return WRITE 8\nCrash state:\nQSemaphore::release\nstd::__1::__function::__func\u003cvoid handleSpans\u003cBlendSrcGeneric\u003e\nFunctionRunnable::run\n```\n","status":"published","published":"2022-04-10T00:01:12.2118Z","modified":"2022-04-27T22:12:36.132079Z","updated_at":"2026-11-02T15:52:49.275624Z"}]}}