Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2013-6465: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in JBPM KIE Workbench 6.0.x allow remote authenticated users to inject arbitrary web script or HTML via vectors related to task name html inputs.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2017-12-19T19:29Z
Repository: https://github.com/kiegroup/jbpm-wb
Language: Java
Files changed: jbpm-console-ng-human-tasks/jbpm-console-ng-human-tasks-client/src/main/java/org/jbpm/console/ng/ht/client/editors/taskdetailsmulti/TaskDetailsMultiPresenter.java
Commit date: 2014-01-08 15:17:25 -0300
Commit message: BZ-1049109: escaping task name html inputs

Diff: diff --git a/jbpm-console-ng-human-tasks/jbpm-console-ng-human-tasks-client/src/main/java/org/jbpm/console/ng/ht/client/editors/taskdetailsmulti/TaskDetailsMultiPresenter.java b/jbpm-console-ng-human-tasks/jbpm-console-ng-human-tasks-client/src/main/java/org/jbpm/console/ng/ht/client/editors/taskdetailsmulti/TaskDetailsMultiPresenter.java
index ac933cde..d52b0c28 100644
--- a/jbpm-console-ng-human-tasks/jbpm-console-ng-human-tasks-client/src/main/java/org/jbpm/console/ng/ht/client/editors/taskdetailsmulti/TaskDetailsMultiPresenter.java
+++ b/jbpm-console-ng-human-tasks/jbpm-console-ng-human-tasks-client/src/main/java/org/jbpm/console/ng/ht/client/editors/taskdetailsmulti/TaskDetailsMultiPresenter.java
@@ -18,10 +18,11 @@ package org.jbpm.console.ng.ht.client.editors.taskdetailsmulti;
 import com.github.gwtbootstrap.client.ui.Heading;
 import javax.enterprise.context.Dependent;
 import javax.inject.Inject;
 
 import com.google.gwt.core.client.GWT;
+import com.google.gwt.safehtml.shared.SafeHtmlUtils;
 import com.google.gwt.user.client.ui.HTMLPanel;
 import com.google.gwt.user.client.ui.IsWidget;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Set;
@@ -115,11 +116,11 @@ public class TaskDetailsMultiPresenter {
     
     public void onTaskSelectionEvent(@Observes TaskSelectionEvent event){
         selectedTaskId = event.getTaskId();
         selectedTaskName = event.getTaskName();
         
-        view.getTaskIdAndName().setText(String.valueOf(selectedTaskId) + " - "+selectedTaskName);
+        view.getTaskIdAndName().setText(SafeHtmlUtils.htmlEscape(String.valueOf(selectedTaskId) + " - "+selectedTaskName));
         
         view.getContent().clear();
         
         String placeToGo;
         if(event.getPlace() != null && !event.getPlace().equals("")){

Vulnerable code:         view.getTaskIdAndName().setText(String.valueOf(selectedTaskId) + " - "+selectedTaskName);
Fixed code: import com.google.gwt.safehtml.shared.SafeHtmlUtils;
        view.getTaskIdAndName().setText(SafeHtmlUtils.htmlEscape(String.valueOf(selectedTaskId) + " - "+selectedTaskName));
CVE-2020-28458: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 7.3
Published: 2020-12-16T11:15Z
Repository: https://github.com/DataTables/DataTablesSrc
Language: JavaScript
Files changed: js/core/core.data.js
Commit date: 2020-10-25 10:00:54 +0000
Commit message: Fix: Possible prototype pollution if `constructor` were used in a data property name

https://github.com/418sec/huntr/pull/827
Diff: diff --git a/js/core/core.data.js b/js/core/core.data.js
index 46ba8049..d08a2099 100644
--- a/js/core/core.data.js
+++ b/js/core/core.data.js
@@ -355,11 +355,11 @@ function _fnSetObjectDataFn( mSource )
 			var arrayNotation, funcNotation, o, innerSrc;
 
 			for ( var i=0, iLen=a.length-1 ; i<iLen ; i++ )
 			{
 				// Protect against prototype pollution
-				if (a[i] === '__proto__') {
+				if (a[i] === '__proto__' || a[i] === 'constructor') {
 					throw new Error('Cannot set prototype values');
 				}
 
 				// Check if we are dealing with an array notation request
 				arrayNotation = a[i].match(__reArray);

Vulnerable code: 				if (a[i] === '__proto__') {
Fixed code: 				if (a[i] === '__proto__' || a[i] === 'constructor') {
CVE-2016-7969: Out-of-bounds Read (CWE-125)
value: The wrap_lines_smart function in ass_render.c in libass before 0.13.4 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to "0/3 line wrapping equalization."
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2017-03-03T16:59Z
Repository: https://github.com/libass/libass
Language: C
Files changed: libass/ass_render.c
Commit date: 2016-10-05 00:38:35 +0200
Commit message: Fix line wrapping mode 0/3 bugs

This fixes two separate bugs:

a) Don't move a linebreak into the first symbol. This results in a empty
   line at the front, which does not help to equalize line lengths at all.
   Instead, merge line with the second one.
b) When moving a linebreak into a symbol that already is a break, the
   number of lines must be decremented. Otherwise, uninitialized memory
   is possibly used for later layout operations.

Found by fuzzer test case
id:000085,sig:11,src:003377+003350,op:splice,rep:8.

This might also affect and hopefully fix libass#229.

v2: change semantics according to review

Diff: diff --git a/libass/ass_render.c b/libass/ass_render.c
index 8790408..1d3c0c5 100644
--- a/libass/ass_render.c
+++ b/libass/ass_render.c
@@ -1606,11 +1606,14 @@ wrap_lines_smart(ASS_Renderer *render_priv, double max_text_width)
                     l2_new = d6_to_double(
                         ((s3 - 1)->bbox.xMax + (s3 - 1)->pos.x) -
                         (w->bbox.xMin + w->pos.x));
 
                     if (DIFF(l1_new, l2_new) < DIFF(l1, l2)) {
-                        w->linebreak = 1;
+                        if (w->linebreak || w == text_info->glyphs)
+                            text_info->n_lines--;
+                        if (w != text_info->glyphs)
+                            w->linebreak = 1;
                         s2->linebreak = 0;
                         exit = 0;
                     }
                 }
             }

Vulnerable code:                         w->linebreak = 1;
Fixed code:                         if (w->linebreak || w == text_info->glyphs)
                            text_info->n_lines--;
                        if (w != text_info->glyphs)
                            w->linebreak = 1;
CVE-2020-36430: Out-of-bounds Write (CWE-787)
value: libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and process_text) because the wrong integer data type is used for subtraction.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2021-07-20T07:15Z
Repository: https://github.com/libass/libass
Language: C
Files changed: libass/ass.c
Commit date: 2020-10-27 15:50:23 +0200
Commit message: decode_font: fix subtraction broken by change to unsigned type

This caused a one-byte buffer overwrite and an assertion failure.

Regression in commit 910211f1c0078e37546f73e95306724358b89be2.

Discovered by OSS-Fuzz.

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26674.
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26678.

Diff: diff --git a/libass/ass.c b/libass/ass.c
index 428a332..5be09a7 100644
--- a/libass/ass.c
+++ b/libass/ass.c
@@ -855,11 +855,11 @@ static int decode_font(ASS_Track *track)
     size = track->parser_priv->fontdata_used;
     if (size % 4 == 1) {
         ass_msg(track->library, MSGL_ERR, "Bad encoded data size");
         goto error_decode_font;
     }
-    buf = malloc(size / 4 * 3 + FFMAX(size % 4 - 1, 0));
+    buf = malloc(size / 4 * 3 + FFMAX(size % 4, 1) - 1);
     if (!buf)
         goto error_decode_font;
     q = buf;
     for (i = 0, p = (unsigned char *) track->parser_priv->fontdata;
          i < size / 4; i++, p += 4) {
@@ -869,11 +869,11 @@ static int decode_font(ASS_Track *track)
         q = decode_chars(p, q, 2);
     } else if (size % 4 == 3) {
         q = decode_chars(p, q, 3);
     }
     dsize = q - buf;
-    assert(dsize == size / 4 * 3 + FFMAX(size % 4 - 1, 0));
+    assert(dsize == size / 4 * 3 + FFMAX(size % 4, 1) - 1);
 
     if (track->library->extract_fonts) {
         ass_add_font(track->library, track->parser_priv->fontname,
                      (char *) buf, dsize);
     }

Vulnerable code:     buf = malloc(size / 4 * 3 + FFMAX(size % 4 - 1, 0));
    assert(dsize == size / 4 * 3 + FFMAX(size % 4 - 1, 0));
Fixed code:     buf = malloc(size / 4 * 3 + FFMAX(size % 4, 1) - 1);
    assert(dsize == size / 4 * 3 + FFMAX(size % 4, 1) - 1);
CVE-2021-32702: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including `1.4.1` are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the `error` query parameter which is then processed by the callback handler as an error message. You are affected by this vulnerability if you are using `@auth0/nextjs-auth0` version `1.4.1` or lower **unless** you are using custom error handling that does not return the error message in an HTML response. Upgrade to version `1.4.1` to resolve. The fix adds basic HTML escaping to the error message and it should not impact your users.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-06-25T17:15Z
Repository: https://github.com/auth0/nextjs-auth0
Language: Unknown
Commit date: 2021-06-24 15:03:50 -0500
Commit message: Merge pull request from GHSA-954c-jjx6-cxv7

Fix reflected XSS from the callback handler's error query parameter
CVE-2015-5688: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Published: 2015-09-04T15:59Z
Repository: https://github.com/geddy/geddy
Language: Unknown
Commit date: 2015-07-28 04:17:52 +0900
Commit message: Merge pull request #699 from phanect/v13-security

Prevent directory traversal for static file
CVE-2021-3805: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 7.5
Published: 2021-09-17T06:15Z
Repository: https://github.com/mariocasciaro/object-path
Language: JSON
Files changed: package-lock.json, package.json
Commit date: 2021-09-16 13:00:33 +0200
Commit message: 0.11.8

Diff: diff --git a/package-lock.json b/package-lock.json
index 91770d1..b67fdad 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,13 +1,13 @@
 {
   "name": "object-path",
-  "version": "0.11.7",
+  "version": "0.11.8",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
-      "version": "0.11.7",
+      "version": "0.11.8",
       "license": "MIT",
       "devDependencies": {
         "@mariocasciaro/benchpress": "^0.1.3",
         "chai": "^4.3.4",
         "coveralls": "^3.1.1",
diff --git a/package.json b/package.json
index f582c70..90213b9 100644
--- a/package.json
+++ b/package.json
@@ -1,9 +1,9 @@
 {
   "name": "object-path",
   "description": "Access deep object properties using a path",
-  "version": "0.11.7",
+  "version": "0.11.8",
   "author": {
     "name": "Mario Casciaro"
   },
   "homepage": "https://github.com/mariocasciaro/object-path",
   "repository": {

Vulnerable code:   "version": "0.11.7",
      "version": "0.11.7",
  "version": "0.11.7",
Fixed code:   "version": "0.11.8",
      "version": "0.11.8",
  "version": "0.11.8",
CVE-2018-20140: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Zenphoto 1.4.14 has multiple cross-site scripting (XSS) vulnerabilities via different URL parameters.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-03-21T16:00Z
Repository: https://github.com/zenphoto/zenphoto
Language: PHP
Files changed: zp-core/template-functions.php
Commit date: 2018-12-11 19:36:16 +0100
Commit message: Some html encoding

Diff: diff --git a/zp-core/template-functions.php b/zp-core/template-functions.php
index 16670958..8b04fa16 100644
--- a/zp-core/template-functions.php
+++ b/zp-core/template-functions.php
@@ -4129,15 +4129,15 @@ function printSearchForm($prevtext = NULL, $id = 'search', $buttonSource = NULL,
 							?>
 							<ul>
         <li><label><input type="checkbox" name="checkall_searchfields" id="checkall_searchfields" checked="checked">* <?php echo gettext('Check/uncheck all'); ?> *</label></li>
 								<?php
 								foreach ($fields as $display => $key) {
-									echo '<li><label><input id="SEARCH_' . $key . '" name="SEARCH_' . $key . '" type="checkbox"';
+									echo '<li><label><input id="SEARCH_' . html_encode($key) . '" name="SEARCH_' . html_encode($key) . '" type="checkbox"';
 									if (in_array($key, $query_fields)) {
 										echo ' checked="checked" ';
 									}
-									echo ' value="' . $key . '"  /> ' . $display . "</label></li>" . "\n";
+									echo ' value="' . html_encode($key) . '"  /> ' . $display . "</label></li>" . "\n";
 								}
 								?>
 							</ul>
 							<?php
 						}

Vulnerable code: 									echo '<li><label><input id="SEARCH_' . $key . '" name="SEARCH_' . $key . '" type="checkbox"';
									echo ' value="' . $key . '"  /> ' . $display . "</label></li>" . "\n";
Fixed code: 									echo '<li><label><input id="SEARCH_' . html_encode($key) . '" name="SEARCH_' . html_encode($key) . '" type="checkbox"';
									echo ' value="' . html_encode($key) . '"  /> ' . $display . "</label></li>" . "\n";
CVE-2018-20140: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Zenphoto 1.4.14 has multiple cross-site scripting (XSS) vulnerabilities via different URL parameters.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-03-21T16:00Z
Repository: https://github.com/zenphoto/zenphoto
Language: PHP
Files changed: zp-core/template-functions.php
Commit date: 2018-12-11 19:37:54 +0100
Commit message: Follow up…

Diff: diff --git a/zp-core/template-functions.php b/zp-core/template-functions.php
index 8b04fa169..4c90b337d 100644
--- a/zp-core/template-functions.php
+++ b/zp-core/template-functions.php
@@ -4133,11 +4133,11 @@ function printSearchForm($prevtext = NULL, $id = 'search', $buttonSource = NULL,
 								foreach ($fields as $display => $key) {
 									echo '<li><label><input id="SEARCH_' . html_encode($key) . '" name="SEARCH_' . html_encode($key) . '" type="checkbox"';
 									if (in_array($key, $query_fields)) {
 										echo ' checked="checked" ';
 									}
-									echo ' value="' . html_encode($key) . '"  /> ' . $display . "</label></li>" . "\n";
+									echo ' value="' . html_encode($key) . '"  /> ' . html_encode($display) . "</label></li>" . "\n";
 								}
 								?>
 							</ul>
 							<?php
 						}

Vulnerable code: 									echo ' value="' . html_encode($key) . '"  /> ' . $display . "</label></li>" . "\n";
Fixed code: 									echo ' value="' . html_encode($key) . '"  /> ' . html_encode($display) . "</label></li>" . "\n";
CVE-2016-1143: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in main.rb in Vine MV before 2015-11-08 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2016-01-30T15:59Z
Repository: https://github.com/ikeay/vinemv
Language: Other
Files changed: Gemfile, main.rb
Commit date: 2015-11-08 22:32:09 +0900
Commit message: Escape html to prevent XSS

Diff: diff --git a/Gemfile b/Gemfile
index 0c15556..a8e6acd 100644
--- a/Gemfile
+++ b/Gemfile
@@ -21,9 +21,12 @@ gem "engtagger"
 
 # HTTPクライアント
 gem "faraday"
 gem "faraday_middleware"
 
+# 自動HTMLエスケープ
+gem "erubis"
+
 # JSON
 gem "json"
 
 # --- ライブラリおわり ---
\ No newline at end of file
diff --git a/main.rb b/main.rb
index 2accc9a..0f647e5 100644
--- a/main.rb
+++ b/main.rb
@@ -5,10 +5,15 @@ require 'sinatra'
 if settings.development?
   require 'pry'
   require 'sinatra/reloader'
 end
 
+# ERBテンプレートで変数を自動エスケープ
+# cf. http://www.sinatrarb.com/faq.html#auto_escape_html
+require 'erubis'
+set :erb, :escape_html => true
+
 # クラス
 require './class/vine.rb'
 require './class/itunes.rb'
 require './class/extract.rb'
 

Fixed code: # 自動HTMLエスケープ
gem "erubis"

# ERBテンプレートで変数を自動エスケープ
# cf. http://www.sinatrarb.com/faq.html#auto_escape_html
require 'erubis'
set :erb, :escape_html => true
CVE-2020-5216: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 5.8
Published: 2020-01-23T03:15Z
Repository: https://github.com/twitter/secure_headers
Language: Unknown
Commit date: 2020-01-21 13:03:11 -1000
Commit message: Merge pull request from GHSA-w978-rmpf-qmwg

Filter and warn on newlines in configurations
CVE-2018-25058: Other (NVD-CWE-Other)
value: A vulnerability classified as problematic has been found in Twitter-Post-Fetcher up to 17.x. This affects an unknown part of the file js/twitterFetcher.js of the component Link Target Handler. The manipulation leads to use of web link to untrusted target with window.opener access. It is possible to initiate the attack remotely. Upgrading to version 18.0.0 is able to address this issue. The name of the patch is 7d281c6fb5acbc29a2cad295262c1f0c19ca56f3. It is recommended to upgrade the affected component. The identifier VDB-217017 was assigned to this vulnerability.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 6.1
Published: 2022-12-29T08:15Z
Repository: https://github.com/jasonmayes/Twitter-Post-Fetcher
Language: Unknown
Commit date: 2018-03-29 18:34:29 -0700
Commit message: Merge pull request #170 from lah7/master

Add rel=noopener to prevent a vulnerability in "_blank".
CVE-2022-24441: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed with the privileges of the application. This vulnerability may be triggered when running the the CLI tool directly, or when running a scan with one of the IDE plugins that invoke the Snyk CLI. Successful exploitation of this issue would likely require some level of social engineering - to coerce an untrusted project to be downloaded and analyzed via the Snyk CLI or opened in an IDE where a Snyk IDE plugin is installed and enabled. Additionally, if the IDE has a Trust feature then the target folder must be marked as ‘trusted’ in order to be vulnerable. **NOTE:** This issue is independent of the one reported in [CVE-2022-40764](https://security.snyk.io/vuln/SNYK-JS-SNYK-3037342), and upgrading to a fixed version for this addresses that issue as well. The affected IDE plugins and versions are: - VS Code - Affected: <=1.8.0, Fixed: 1.9.0 - IntelliJ - Affected: <=2.4.47, Fixed: 2.4.48 - Visual Studio - Affected: <=1.1.30, Fixed: 1.1.31 - Eclipse - Affected: <=v20221115.132308, Fixed: All subsequent versions - Language Server - Affected: <=v20221109.114426, Fixed: All subsequent versions
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2022-11-30T13:15Z
Repository: https://github.com/snyk/snyk-eclipse-plugin
Language: Unknown
Commit date: 2022-11-29 13:21:02 +0100
Commit message: Merge pull request #106 from snyk/feat/trust-feature

feat: add folder trust
CVE-2023-4434: Missing Authorization (CWE-862)
value: Missing Authorization in GitHub repository hamza417/inure prior to build88.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 6.1
Published: 2023-08-20T01:15Z
Repository: https://github.com/hamza417/inure
Language: Kotlin
Files changed: app/src/main/java/app/simple/inure/activities/association/TextViewerActivity.kt
Commit date: 2023-08-15 20:43:28 +0530
Commit message: Build88

  - Fixed Missing Authorization vulnerability

Diff: diff --git a/app/src/main/java/app/simple/inure/activities/association/TextViewerActivity.kt b/app/src/main/java/app/simple/inure/activities/association/TextViewerActivity.kt
index 44c1d77e..9caf2baa 100644
--- a/app/src/main/java/app/simple/inure/activities/association/TextViewerActivity.kt
+++ b/app/src/main/java/app/simple/inure/activities/association/TextViewerActivity.kt
@@ -1,21 +1,33 @@
 package app.simple.inure.activities.association
 
 import android.os.Bundle
+import android.util.Log
 import app.simple.inure.R
 import app.simple.inure.extensions.activities.BaseActivity
 import app.simple.inure.ui.association.Text
+import app.simple.inure.util.ConditionUtils.invert
 import app.simple.inure.util.NullSafety.isNull
 
 class TextViewerActivity : BaseActivity() {
 
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
         setContentView(R.layout.activity_main)
 
+        Log.d("TextViewerActivity", "onCreate: ${intent.data?.path}")
+
         if (savedInstanceState.isNull()) {
-            supportFragmentManager.beginTransaction()
-                .replace(R.id.app_container, Text.newInstance())
-                .commit()
+            if (hasAppPath().invert()) {
+                supportFragmentManager.beginTransaction()
+                    .replace(R.id.app_container, Text.newInstance())
+                    .commit()
+            } else {
+                showWarning("ERR: illegal action detected.")
+            }
         }
     }
+
+    private fun hasAppPath(): Boolean {
+        return intent.data?.path?.contains("data/data/$packageName")!!
+    }
 }

Vulnerable code:             supportFragmentManager.beginTransaction()
                .replace(R.id.app_container, Text.newInstance())
                .commit()
Fixed code: import android.util.Log
import app.simple.inure.util.ConditionUtils.invert
        Log.d("TextViewerActivity", "onCreate: ${intent.data?.path}")

            if (hasAppPath().invert()) {
                supportFragmentManager.beginTransaction()
                    .replace(R.id.app_container, Text.newInstance())
                    .commit()
            } else {
                showWarning("ERR: illegal action detected.")
            }

    private fun hasAppPath(): Boolean {
        return intent.data?.path?.contains("data/data/$packageName")!!
    }
CVE-2023-4877: Insufficient Information (NVD-CWE-noinfo)
value: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2023-09-10T01:15Z
Repository: https://github.com/hamza417/inure
Language: XML
Files changed: app/src/main/AndroidManifest.xml, app/src/main/assets/html/changelogs.html
Commit date: 2023-08-30 01:02:08 +0530
Commit message: Build92

  - Patched Android Manifest Misconfiguration Leading to Task Hijacking

Diff: diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index 84e4aaab0..8da51d08b 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -74,10 +74,11 @@
         android:roundIcon="@mipmap/ic_launcher_round"
         android:supportsRtl="true"
         android:theme="@style/Inure"
         android:windowSoftInputMode="adjustPan"
         tools:ignore="AllowBackup"
+        android:taskAffinity="app.simple.inure"
         tools:targetApi="tiramisu">
 
         <profileable android:shell="true" />
 
         <activity
@@ -105,11 +106,10 @@
             android:name=".terminal.Term"
             android:configChanges="keyboard|keyboardHidden|orientation"
             android:exported="true"
             android:label="@string/terminal"
             android:launchMode="singleTask"
-            android:taskAffinity="app.simple.inure"
             android:windowSoftInputMode="adjustResize" />
 
         <activity
             android:name=".terminal.TermAffinity"
             android:configChanges="keyboard|keyboardHidden|orientation"
diff --git a/app/src/main/assets/html/changelogs.html b/app/src/main/assets/html/changelogs.html
index edca9f5da..d24a94976 100644
--- a/app/src/main/assets/html/changelogs.html
+++ b/app/src/main/assets/html/changelogs.html
@@ -26,10 +26,12 @@
 <h4>Security</h4>
 
 <ul>
     <li>Patched <i>Exposure of Sensitive Information to an Unauthorized Actor</i> vulnerability.
     </li>
+    <li>Patched <i>Android Manifest Misconfiguration Leading to Task Hijacking</i> vulnerability.
+    </li>
 </ul>
 
 <br>
 <br>
 <div class="wrap-collapsible">

Vulnerable code:             android:taskAffinity="app.simple.inure"
Fixed code:         android:taskAffinity="app.simple.inure"
    <li>Patched <i>Android Manifest Misconfiguration Leading to Task Hijacking</i> vulnerability.
    </li>
CVE-2023-5862: Missing Authorization (CWE-862)
value: Missing Authorization in GitHub repository hamza417/inure prior to Build95.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 3.3
Published: 2023-10-31T01:15Z
Repository: https://github.com/hamza417/inure
Language: Kotlin
Files changed: app/src/main/java/app/simple/inure/activities/association/TextViewerActivity.kt
Commit date: 2023-10-12 23:47:38 +0530
Commit message: Patched improper input validation

FLAGS:
   - skip build apk

Diff: diff --git a/app/src/main/java/app/simple/inure/activities/association/TextViewerActivity.kt b/app/src/main/java/app/simple/inure/activities/association/TextViewerActivity.kt
index 6c7fa984a..e2c7785f4 100644
--- a/app/src/main/java/app/simple/inure/activities/association/TextViewerActivity.kt
+++ b/app/src/main/java/app/simple/inure/activities/association/TextViewerActivity.kt
@@ -1,14 +1,12 @@
 package app.simple.inure.activities.association
 
-import android.annotation.SuppressLint
 import android.os.Bundle
 import app.simple.inure.R
 import app.simple.inure.extensions.activities.BaseActivity
 import app.simple.inure.ui.association.Text
 import app.simple.inure.util.ConditionUtils.invert
-import app.simple.inure.util.NullSafety.isNotNull
 import app.simple.inure.util.NullSafety.isNull
 
 class TextViewerActivity : BaseActivity() {
 
     override fun onCreate(savedInstanceState: Bundle?) {
@@ -24,16 +22,9 @@ class TextViewerActivity : BaseActivity() {
                 showWarning("ERR: illegal action detected.")
             }
         }
     }
 
-    @SuppressLint("SdCardPath")
     private fun hasAppPath(): Boolean {
-        if (intent.data.isNotNull()) {
-            val appDataPath = "/data/data/$packageName/"
-            val normalizedIntentPath = intent.data?.path?.replace("//+".toRegex(), "/")
-            return normalizedIntentPath?.contains(appDataPath) == true
-        }
-
-        return false
+        return intent.data?.path?.contains(packageName)!!
     }
 }

Vulnerable code: import android.annotation.SuppressLint
import app.simple.inure.util.NullSafety.isNotNull
    @SuppressLint("SdCardPath")
        if (intent.data.isNotNull()) {
            val appDataPath = "/data/data/$packageName/"
            val normalizedIntentPath = intent.data?.path?.replace("//+".toRegex(), "/")
            return normalizedIntentPath?.contains(appDataPath) == true
        }

        return false
Fixed code:         return intent.data?.path?.contains(packageName)!!
CVE-2019-14750: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the execution of those queries. This can further lead to cookie stealing or other malicious actions.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-08-07T17:15Z
Repository: https://github.com/osTicket/osTicket
Language: PHP
Files changed: setup/inc/class.installer.php
Commit date: 2019-07-10 13:31:43 -0500
Commit message: xss: Install Form

This addresses an issue reported by Aishwarya Iyer where inserting `<img src
=x onerror = prompt(1)` into any text field on the install form will execute
in the browser after the system is installed and you log in. This is due to
us not sanitizing the content before it’s saved in the database. This adds
`Format::htmlchars()` to the installer to ensure the text field data is
sanitized properly.

Diff: diff --git a/setup/inc/class.installer.php b/setup/inc/class.installer.php
index 1a198325..8d10bd4f 100644
--- a/setup/inc/class.installer.php
+++ b/setup/inc/class.installer.php
@@ -186,12 +186,12 @@ class Installer extends SetupWizard {
             'isadmin' => 1,
             'max_page_size' => 25,
             'dept_id' => $dept_id,
             'role_id' => $role_id,
             'email' => $vars['admin_email'],
-            'firstname' => $vars['fname'],
-            'lastname' => $vars['lname'],
+            'firstname' => Format::htmlchars($vars['fname']),
+            'lastname' => Format::htmlchars($vars['lname']),
             'username' => $vars['username'],
         ));
         $staff->updatePerms(array(
             User::PERM_CREATE,
             User::PERM_EDIT,

Vulnerable code:             'firstname' => $vars['fname'],
            'lastname' => $vars['lname'],
Fixed code:             'firstname' => Format::htmlchars($vars['fname']),
            'lastname' => Format::htmlchars($vars['lname']),
CVE-2020-22608: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-06-28T19:15Z
Repository: https://github.com/osTicket/osTicket
Language: PHP
Files changed: include/ajax.search.php
Commit date: 2020-04-28 13:34:06 -0500
Commit message: xss: Saved Search Name

This mitigates an issue discovered by Matthew Aberegg where the Name field
for Saved Searches can be exploited via XSS to execute code. This sanitizes
the `$_POST['queue-name']` variable via `Format::htmlchars()` so we are
safe from any XSS attempts on creations and updates. All other Saved Search
content is parsed/sanitized correctly.

Diff: diff --git a/include/ajax.search.php b/include/ajax.search.php
index e2f3a6bab..0918ec84e 100644
--- a/include/ajax.search.php
+++ b/include/ajax.search.php
@@ -200,10 +200,11 @@ class SearchAjaxAPI extends AjaxController {
                 );
         $this->_tryAgain($search, null, null, $info);
     }
 
     function _saveSearch(SavedSearch $search) {
+        $_POST['queue-name'] = Format::htmlchars($_POST['queue-name']);
 
         // Validate the form.
         $form = $search->getForm($_POST);
         if ($this->_hasErrors($search, $form))
             return false;

Fixed code:         $_POST['queue-name'] = Format::htmlchars($_POST['queue-name']);
CVE-2020-22609: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross Site Scripting (XSS) vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-06-28T19:15Z
Repository: https://github.com/osTicket/osTicket
Language: PHP
Files changed: include/class.queue.php, scp/queues.php
Commit date: 2020-04-28 13:34:07 -0500
Commit message: xss: Queue Name

This mitigates an issue discovered by Matthew Aberegg where the Name field
for a Queue can be exploited via XSS to execute code. This sanitizes the
`$_POST['queue-name']` variable in a few places via `Format::htmlchars()` so
we are safe from any XSS attempts on creations and updates.

Diff: diff --git a/include/class.queue.php b/include/class.queue.php
index 05970a533..b4f9cab40 100644
--- a/include/class.queue.php
+++ b/include/class.queue.php
@@ -1202,18 +1202,18 @@ class CustomQueue extends VerySimpleModel {
 
         // Set basic search information
         if (!$vars['queue-name'])
             $errors['queue-name'] = __('A title is required');
         elseif (($q=CustomQueue::lookup(array(
-                        'title' => $vars['queue-name'],
+                        'title' => Format::htmlchars($vars['queue-name']),
                         'parent_id' => $vars['parent_id'] ?: 0,
                         'staff_id'  => $this->staff_id)))
                 && $q->getId() != $this->id
                 )
             $errors['queue-name'] = __('Saved queue with same name exists');
 
-        $this->title = $vars['queue-name'];
+        $this->title = Format::htmlchars($vars['queue-name']);
         $this->parent_id = @$vars['parent_id'] ?: 0;
         if ($this->parent_id && !$this->parent)
             $errors['parent_id'] = __('Select a valid queue');
 
         // Try to avoid infinite recursion determining ancestry
diff --git a/scp/queues.php b/scp/queues.php
index 37fc13e3e..4b79e85c4 100644
--- a/scp/queues.php
+++ b/scp/queues.php
@@ -41,11 +41,11 @@ if ($_POST) {
         break;
 
     case 'create':
         $queue = CustomQueue::create(array(
             'staff_id' => 0,
-            'title' => $_POST['queue-name'],
+            'title' => Format::htmlchars($_POST['queue-name']),
             'root' => 'T'
         ));
 
         if ($queue->update($_POST, $errors) && $queue->save(true)) {
             $msg = sprintf(__('Successfully added %s'),

Vulnerable code:                         'title' => $vars['queue-name'],
        $this->title = $vars['queue-name'];
            'title' => $_POST['queue-name'],
Fixed code:                         'title' => Format::htmlchars($vars['queue-name']),
        $this->title = Format::htmlchars($vars['queue-name']);
            'title' => Format::htmlchars($_POST['queue-name']),
CVE-2016-6354: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Heap-based buffer overflow in the yy_get_next_buffer function in Flex before 2.6.1 might allow context-dependent attackers to cause a denial of service or possibly execute arbitrary code via vectors involving num_to_read.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2016-09-21T14:25Z
Repository: https://github.com/westes/flex
Language: Other
Files changed: src/flex.skl
Commit date: 2016-02-27 11:56:05 -0500
Commit message: Fixed incorrect integer type

Diff: diff --git a/src/flex.skl b/src/flex.skl
index 36a526a..64f853d 100644
--- a/src/flex.skl
+++ b/src/flex.skl
@@ -1701,11 +1701,11 @@ int yyFlexLexer::yy_get_next_buffer()
 		 */
 		YY_CURRENT_BUFFER_LVALUE->yy_n_chars = YY_G(yy_n_chars) = 0;
 
 	else
 		{
-			yy_size_t num_to_read =
+			int num_to_read =
 			YY_CURRENT_BUFFER_LVALUE->yy_buf_size - number_to_move - 1;
 
 		while ( num_to_read <= 0 )
 			{ /* Not enough room in the buffer - grow it. */
 m4_ifdef( [[M4_YY_USES_REJECT]],

Vulnerable code: 			yy_size_t num_to_read =
Fixed code: 			int num_to_read =
CVE-2023-0210: Out-of-bounds Write (CWE-787)
value: A bug affects the Linux kernel’s ksmbd NTLMv2 authentication and is known to crash the OS immediately in Linux-based systems.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2023-03-27T22:15Z
Repository: https://github.com/cifsd-team/ksmbd
Language: C
Files changed: auth.c
Commit date: 2023-01-02 22:25:39 +0900
Commit message: ksmbd: check nt_len to be at least CIFS_ENCPWD_SIZE in ksmbd_decode_ntlmssp_auth_blob

"nt_len - CIFS_ENCPWD_SIZE" is passed directly from
ksmbd_decode_ntlmssp_auth_blob to ksmbd_auth_ntlmv2. Malicious requests
can set nt_len to less than CIFS_ENCPWD_SIZE, which results in a negative
number (or large unsigned value) used for a subsequent memcpy in
ksmbd_auth_ntlvm2 and can cause a panic.

Fixes: e2f3448 ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Signed-off-by: William Liu <will@willsroot.io>
Signed-off-by: Hrvoje Mišetić <misetichrvoje@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>

Diff: diff --git a/auth.c b/auth.c
index 992677f..ef62045 100644
--- a/auth.c
+++ b/auth.c
@@ -581,11 +581,12 @@ int ksmbd_decode_ntlmssp_auth_blob(struct authenticate_message *authblob,
 	nt_len = le16_to_cpu(authblob->NtChallengeResponse.Length);
 
 	dn_off = le32_to_cpu(authblob->DomainName.BufferOffset);
 	dn_len = le16_to_cpu(authblob->DomainName.Length);
 
-	if (blob_len < (u64)dn_off + dn_len || blob_len < (u64)nt_off + nt_len)
+	if (blob_len < (u64)dn_off + dn_len || blob_len < (u64)nt_off + nt_len ||
+	    nt_len < CIFS_ENCPWD_SIZE)
 		return -EINVAL;
 
 #ifdef CONFIG_SMB_INSECURE_SERVER
 	lm_off = le32_to_cpu(authblob->LmChallengeResponse.BufferOffset);
 	lm_len = le16_to_cpu(authblob->LmChallengeResponse.Length);

Vulnerable code: 	if (blob_len < (u64)dn_off + dn_len || blob_len < (u64)nt_off + nt_len)
Fixed code: 	if (blob_len < (u64)dn_off + dn_len || blob_len < (u64)nt_off + nt_len ||
	    nt_len < CIFS_ENCPWD_SIZE)
CVE-2017-6415: NULL Pointer Dereference (CWE-476)
value: The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DEX file.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2017-03-02T01:59Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/bin/p/bin_dex.c
Commit date: 2017-03-01 15:27:14 +0100
Commit message: fix #6872

Diff: diff --git a/libr/bin/p/bin_dex.c b/libr/bin/p/bin_dex.c
index 7293c389a..13a7b4543 100644
--- a/libr/bin/p/bin_dex.c
+++ b/libr/bin/p/bin_dex.c
@@ -375,10 +375,13 @@ static void dex_parse_debug_item(RBinFile *binfile, RBinDexObj *bin,
 			debug_locals[reg].live = true;
 		}
 		--parameters_size;
 	}
 
+	if (p4 <= 0) {
+		return;
+	}
 	ut8 opcode = *(p4++) & 0xff;
 	while (keep) {
 		switch (opcode) {
 		case 0x0: // DBG_END_SEQUENCE
 			keep = false;

Fixed code: 	if (p4 <= 0) {
		return;
	}
CVE-2018-14015: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The sdb_set_internal function in sdb.c in radare2 2.7.0 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted ELF file because of missing input validation in r_bin_dwarf_parse_comp_unit in libr/bin/dwarf.c.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 5.5
Published: 2018-07-12T20:29Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/bin/dwarf.c
Commit date: 2018-06-25 00:07:45 +0200
Commit message: Fix #10465 - Avoid string on low addresses (workaround) for corrupted dwarf (#10478)


Diff: diff --git a/libr/bin/dwarf.c b/libr/bin/dwarf.c
index edd062c7ba..7b9ca6bfc8 100644
--- a/libr/bin/dwarf.c
+++ b/libr/bin/dwarf.c
@@ -1359,11 +1359,15 @@ static const ut8 *r_bin_dwarf_parse_comp_unit(Sdb *s, const ut8 *obuf,
 					&da->decls[abbr_code - 1].specs[i],
 					&cu->dies[cu->length].attr_values[i],
 					&cu->hdr, debug_str, debug_str_len);
 			if (cu->dies[cu->length].attr_values[i].name == DW_AT_comp_dir) {
 				const char *name = cu->dies[cu->length].attr_values[i].encoding.str_struct.string;
-				sdb_set (s, "DW_AT_comp_dir", name, 0);
+				if (name > 1024) { // solve some null derefs
+					sdb_set (s, "DW_AT_comp_dir", name, 0);
+				} else {
+					eprintf ("Invalid string pointer at %p\n", name);
+				}
 			}
 			cu->dies[cu->length].length++;
 		}
 		cu->length++;
 	}

Vulnerable code: 				sdb_set (s, "DW_AT_comp_dir", name, 0);
Fixed code: 				if (name > 1024) { // solve some null derefs
					sdb_set (s, "DW_AT_comp_dir", name, 0);
				} else {
					eprintf ("Invalid string pointer at %p\n", name);
				}
CVE-2018-20457: Out-of-bounds Read (CWE-125)
value: In radare2 through 3.1.3, the assemble function inside libr/asm/p/asm_arm_cs.c allows attackers to cause a denial-of-service (application crash via an r_num_calc out-of-bounds read) by crafting an arm assembly input because a loop uses an incorrect index in armass.c and certain length validation is missing in armass64.c, a related issue to CVE-2018-20459.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2018-12-25T19:29Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/asm/arch/arm/armass.c, libr/asm/arch/arm/armass64.c
Commit date: 2018-12-10 16:42:02 +0100
Commit message: Fix #12417/#12418 (arm assembler heap overflows)


Diff: diff --git a/libr/asm/arch/arm/armass.c b/libr/asm/arch/arm/armass.c
index 6b752c0463..dc1b05e9c3 100644
--- a/libr/asm/arch/arm/armass.c
+++ b/libr/asm/arch/arm/armass.c
@@ -6543,11 +6543,11 @@ static AssembleFunction assemble[2] = { &arm_assemble, &thumb_assemble };
 
 ut32 armass_assemble(const char *str, ut64 off, int thumb) {
 	int i, j;
 	char buf[128];
 	ArmOpcode aop = {.off = off};
-	for (i = j = 0; i < sizeof (buf) - 1 && str[i]; i++, j++) {
+	for (i = j = 0; i < sizeof (buf) - 1 && str[j]; i++, j++) {
 		if (str[j] == '#') {
 			i--; continue;
 		}
 		buf[i] = tolower ((const ut8)str[j]);
 	}
diff --git a/libr/asm/arch/arm/armass64.c b/libr/asm/arch/arm/armass64.c
index 91bd4282a7..f66eba9d0c 100644
--- a/libr/asm/arch/arm/armass64.c
+++ b/libr/asm/arch/arm/armass64.c
@@ -754,11 +754,11 @@ static bool parseOperands(char* str, ArmOp *op) {
 		} else if (!strncmp (token, "lsr", 3)) {
 			op->operands[operand].shift = ARM_LSR;
 		} else if (!strncmp (token, "asr", 3)) {
 			op->operands[operand].shift = ARM_ASR;
 		}
-		if (op->operands[operand].shift != ARM_NO_SHIFT) {
+		if (strlen (token) > 4 && op->operands[operand].shift != ARM_NO_SHIFT) {
 			op->operands_count ++;
 			op->operands[operand].shift_amount = r_num_math (NULL, token + 4);
 			if (op->operands[operand].shift_amount > 63) {
 				return false;
 			}

Vulnerable code: 	for (i = j = 0; i < sizeof (buf) - 1 && str[i]; i++, j++) {
		if (op->operands[operand].shift != ARM_NO_SHIFT) {
Fixed code: 	for (i = j = 0; i < sizeof (buf) - 1 && str[j]; i++, j++) {
		if (strlen (token) > 4 && op->operands[operand].shift != ARM_NO_SHIFT) {