Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2018-20459: Out-of-bounds Read (CWE-125)
value: In radare2 through 3.1.3, the armass_assemble function in libr/asm/arch/arm/armass.c allows attackers to cause a denial-of-service (application crash by out-of-bounds read) by crafting an arm assembly input because a loop uses an incorrect index in armass.c and certain length validation is missing in armass64.c, a related issue to CVE-2018-20457.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2018-12-25T19:29Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/asm/arch/arm/armass.c, libr/asm/arch/arm/armass64.c
Commit date: 2018-12-10 16:42:02 +0100
Commit message: Fix #12417/#12418 (arm assembler heap overflows)


Diff: diff --git a/libr/asm/arch/arm/armass.c b/libr/asm/arch/arm/armass.c
index 6b752c0463..dc1b05e9c3 100644
--- a/libr/asm/arch/arm/armass.c
+++ b/libr/asm/arch/arm/armass.c
@@ -6543,11 +6543,11 @@ static AssembleFunction assemble[2] = { &arm_assemble, &thumb_assemble };
 
 ut32 armass_assemble(const char *str, ut64 off, int thumb) {
 	int i, j;
 	char buf[128];
 	ArmOpcode aop = {.off = off};
-	for (i = j = 0; i < sizeof (buf) - 1 && str[i]; i++, j++) {
+	for (i = j = 0; i < sizeof (buf) - 1 && str[j]; i++, j++) {
 		if (str[j] == '#') {
 			i--; continue;
 		}
 		buf[i] = tolower ((const ut8)str[j]);
 	}
diff --git a/libr/asm/arch/arm/armass64.c b/libr/asm/arch/arm/armass64.c
index 91bd4282a7..f66eba9d0c 100644
--- a/libr/asm/arch/arm/armass64.c
+++ b/libr/asm/arch/arm/armass64.c
@@ -754,11 +754,11 @@ static bool parseOperands(char* str, ArmOp *op) {
 		} else if (!strncmp (token, "lsr", 3)) {
 			op->operands[operand].shift = ARM_LSR;
 		} else if (!strncmp (token, "asr", 3)) {
 			op->operands[operand].shift = ARM_ASR;
 		}
-		if (op->operands[operand].shift != ARM_NO_SHIFT) {
+		if (strlen (token) > 4 && op->operands[operand].shift != ARM_NO_SHIFT) {
 			op->operands_count ++;
 			op->operands[operand].shift_amount = r_num_math (NULL, token + 4);
 			if (op->operands[operand].shift_amount > 63) {
 				return false;
 			}

Vulnerable code: 	for (i = j = 0; i < sizeof (buf) - 1 && str[i]; i++, j++) {
		if (op->operands[operand].shift != ARM_NO_SHIFT) {
Fixed code: 	for (i = j = 0; i < sizeof (buf) - 1 && str[j]; i++, j++) {
		if (strlen (token) > 4 && op->operands[operand].shift != ARM_NO_SHIFT) {
CVE-2019-16718: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: In radare2 before 3.9.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to an insufficient fix for CVE-2019-14745 and improper handling of symbol names embedded in executables.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 7.8
Published: 2019-09-23T14:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/core/cbin.c
Commit date: 2019-09-09 15:10:38 +0200
Commit message: More fixes for the CVE-2019-14745

Diff: diff --git a/libr/core/cbin.c b/libr/core/cbin.c
index 2d0fa61b20..8373826a3d 100644
--- a/libr/core/cbin.c
+++ b/libr/core/cbin.c
@@ -65,10 +65,12 @@ static char *__filterQuotedShell(const char *arg) {
 	char *b = a;
 	while (*arg) {
 		switch (*arg) {
 		case ' ':
 		case '=':
+		case '"':
+		case '\\':
 		case '\r':
 		case '\n':
 			break;
 		default:
 			*b++ = *arg;
@@ -86,19 +88,21 @@ static char *__filterShell(const char *arg) {
 	if (!a) {
 		return NULL;
 	}
 	char *b = a;
 	while (*arg) {
-		switch (*arg) {
+		char ch = *arg;
+		switch (ch) {
 		case '@':
 		case '`':
 		case '|':
 		case ';':
+		case '=':
 		case '\n':
 			break;
 		default:
-			*b++ = *arg;
+			*b++ = ch;
 			break;
 		}
 		arg++;
 	}
 	*b = 0;
@@ -2223,14 +2227,14 @@ static int bin_symbols(RCore *r, int mode, ut64 laddr, int va, ut64 at, const ch
 					if (p && strstr (module, "imp.")) {
 						char *symname = __filterShell (p + 5);
 						char *m = __filterShell (module);
 						*p = 0;
 						if (r->bin->prefix) {
-							r_cons_printf ("k bin/pe/%s/%d=%s.%s\n",
+							r_cons_printf ("\"k bin/pe/%s/%d=%s.%s\"\n",
 								module, symbol->ordinal, r->bin->prefix, symname);
 						} else {
-							r_cons_printf ("k bin/pe/%s/%d=%s\n",
+							r_cons_printf ("\"k bin/pe/%s/%d=%s\"\n",
 								module, symbol->ordinal, symname);
 						}
 						free (symname);
 						free (m);
 					}

Vulnerable code: 		switch (*arg) {
			*b++ = *arg;
							r_cons_printf ("k bin/pe/%s/%d=%s.%s\n",
							r_cons_printf ("k bin/pe/%s/%d=%s\n",
Fixed code: 		case '"':
		case '\\':
		char ch = *arg;
		switch (ch) {
		case '=':
			*b++ = ch;
							r_cons_printf ("\"k bin/pe/%s/%d=%s.%s\"\n",
							r_cons_printf ("\"k bin/pe/%s/%d=%s\"\n",
CVE-2019-16718: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: In radare2 before 3.9.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to an insufficient fix for CVE-2019-14745 and improper handling of symbol names embedded in executables.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 7.8
Published: 2019-09-23T14:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/core/cmd.c
Commit date: 2019-09-09 15:10:38 +0200
Commit message: Fix #14990 - multiple quoted command parsing issue ##core

	> "?e hello""?e world"
	hello
	world"
	> "?e hello";"?e world"
	hello
	world

Diff: diff --git a/libr/core/cmd.c b/libr/core/cmd.c
index 9fd43c9d40..7c48a6482b 100644
--- a/libr/core/cmd.c
+++ b/libr/core/cmd.c
@@ -2578,10 +2578,11 @@ static int r_core_cmd_subst_i(RCore *core, char *cmd, char *colon, bool *tmpseek
 					break;
 				}
 				cmd = sc + 1;
 				continue;
 			}
+			char op0 = 0;
 			if (*p) {
 				// workaround :D
 				if (p[0] == '@') {
 					p--;
 				}
@@ -2589,10 +2590,11 @@ static int r_core_cmd_subst_i(RCore *core, char *cmd, char *colon, bool *tmpseek
 					p++;
 				}
 				if (p[1] == '@' || (p[1] && p[2] == '@')) {
 					char *q = strchr (p + 1, '"');
 					if (q) {
+						op0 = *q;
 						*q = 0;
 					}
 					haveQuote = q != NULL;
 					oseek = core->offset;
 					r_core_seek (core, r_num_math (core->num, p + 2), 1);
@@ -2642,13 +2644,13 @@ static int r_core_cmd_subst_i(RCore *core, char *cmd, char *colon, bool *tmpseek
 			if (haveQuote) {
 				if (*p == ';') {
 					cmd = p + 1;
 				} else {
 					if (*p == '"') {
-						cmd = p + 1;
+						cmd = p;
 					} else {
-						*p = '"';
+						*p = op0;
 						cmd = p;
 					}
 				}
 			} else {
 				cmd = p + 1;

Vulnerable code: 						cmd = p + 1;
						*p = '"';
Fixed code: 			char op0 = 0;
						op0 = *q;
						cmd = p;
						*p = op0;
CVE-2020-27793: Off-by-one Error (CWE-193)
value: An off-by-one overflow flaw was found in radare2 due to mismatched array length in core_java.c. This could allow an attacker to cause a crash, and perform a denail of service attack.
CWE description: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CVSS v3 base score: 7.5
Published: 2022-08-19T23:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/core/p/core_java.c
Commit date: 2020-03-26 12:02:43 +0100
Commit message: Fix unmatched array length in core_java.c (issue #16304) (#16313)


Diff: diff --git a/libr/core/p/core_java.c b/libr/core/p/core_java.c
index 42762dc44ff..55d75748418 100644
--- a/libr/core/p/core_java.c
+++ b/libr/core/p/core_java.c
@@ -1463,11 +1463,11 @@ static int r_cmd_java_call(void *user, const char *input) {
 		return false;
 	}
 	if (input[4] != ' ') {
 		return r_cmd_java_handle_help (core, input);
 	}
-	for (; i < END_CMDS; i++) {
+	for (; i < END_CMDS - 1; i++) {
 		//IFDBG r_cons_printf ("Checking cmd: %s %d %s\n", JAVA_CMDS[i].name, JAVA_CMDS[i].name_len, p);
 		IFDBG r_cons_printf ("Checking cmd: %s %d\n", JAVA_CMDS[i].name,
 			strncmp (input+5, JAVA_CMDS[i].name, JAVA_CMDS[i].name_len));
 		if (!strncmp (input + 5, JAVA_CMDS[i].name, JAVA_CMDS[i].name_len)) {
 			const char *cmd = input + 5 + JAVA_CMDS[i].name_len;

Vulnerable code: 	for (; i < END_CMDS; i++) {
Fixed code: 	for (; i < END_CMDS - 1; i++) {
CVE-2020-27794: Double Free (CWE-415)
value: A double free issue was discovered in radare2 in cmd_info.c:cmd_info(). Successful exploitation could lead to modification of unexpected memory locations and potentially causing a crash.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 9.1
Published: 2022-08-19T23:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/core/core.c
Commit date: 2020-03-26 12:28:50 +0100
Commit message: Fix #16303 - c->table_query double free (#16318)


Diff: diff --git a/libr/core/core.c b/libr/core/core.c
index 5896e8537e4..35e777e24f0 100644
--- a/libr/core/core.c
+++ b/libr/core/core.c
@@ -2840,11 +2840,11 @@ R_API void r_core_fini(RCore *c) {
 	r_num_free (c->num);
 	// TODO: sync or not? sdb_sync (c->sdb);
 	// TODO: sync all dbs?
 	//r_core_file_free (c->file);
 	//c->file = NULL;
-	free (c->table_query);
+	R_FREE (c->table_query);
 	r_list_free (c->files);
 	r_list_free (c->watchers);
 	r_list_free (c->scriptstack);
 	r_core_task_scheduler_fini (&c->tasks);
 	c->rcmd = r_cmd_free (c->rcmd);

Vulnerable code: 	free (c->table_query);
Fixed code: 	R_FREE (c->table_query);
CVE-2020-27795: Use of Uninitialized Resource (CWE-908)
value: A segmentation fault was discovered in radare2 with adf command. In libr/core/cmd_anal.c, when command "adf" has no or wrong argument, anal_fcn_data (core, input + 1) --> RAnalFunction *fcn = r_anal_get_fcn_in (core->anal, core->offset, -1); returns null pointer for fcn causing segmentation fault later in ensure_fcn_range (fcn).
CWE description: The product uses or accesses a resource that has not been initialized.
CVSS v3 base score: 7.5
Published: 2022-08-19T23:15Z
Repository: https://github.com/radareorg/radare2
Language: Other
Files changed: libr/core/cmd_anal.c, test/new/db/anal/x86_32
Commit date: 2020-03-16 17:03:22 +0100
Commit message: Fix segfault in adf  (#16230)


Diff: diff --git a/libr/core/cmd_anal.c b/libr/core/cmd_anal.c
index 80cdb2f0155..777764644e5 100644
--- a/libr/core/cmd_anal.c
+++ b/libr/core/cmd_anal.c
@@ -9233,16 +9233,16 @@ static int cmd_anal_all(RCore *core, const char *input) {
 
 	return true;
 }
 
 static bool anal_fcn_data (RCore *core, const char *input) {
-	RAnalFunction *fcn = r_anal_get_fcn_in (core->anal, core->offset, -1);
-	ut32 fcn_size = r_anal_function_size_from_entry (fcn);
+	RAnalFunction *fcn = r_anal_get_fcn_in (core->anal, core->offset, R_ANAL_FCN_TYPE_ANY);
 	if (fcn) {
 		int i;
 		bool gap = false;
 		ut64 gap_addr = UT64_MAX;
+		ut32 fcn_size = r_anal_function_size_from_entry (fcn);
 		char *bitmap = calloc (1, fcn_size);
 		if (bitmap) {
 			RAnalBlock *b;
 			RListIter *iter;
 			r_list_foreach (fcn->bbs, iter, b) {
diff --git a/test/new/db/anal/x86_32 b/test/new/db/anal/x86_32
index d6ead6b38d7..6c16d5b03ec 100644
--- a/test/new/db/anal/x86_32
+++ b/test/new/db/anal/x86_32
@@ -255,10 +255,18 @@ EXPECT=<<EOF
 |           0x08048441      ff75f4         push dword [var_ch]
 EOF
 CMDS=aa ; s sym.fastcaslled ; afc fastcall ; afva ; ?e ; pdf~arg,var
 RUN
 
+NAME=adf bug #16215
+FILE=-
+EXPECT=<<EOF
+EOF
+CMDS=<<EOF
+adf
+EOF
+
 NAME=adf analysis on an obfuscated executable
 FILE=../bins/pe/cmd_adf_sample0.exe
 BROKEN=1
 EXPECT=<<EOF
 0x00560e67      push esi

Vulnerable code: 	RAnalFunction *fcn = r_anal_get_fcn_in (core->anal, core->offset, -1);
	ut32 fcn_size = r_anal_function_size_from_entry (fcn);
Fixed code: 	RAnalFunction *fcn = r_anal_get_fcn_in (core->anal, core->offset, R_ANAL_FCN_TYPE_ANY);
		ut32 fcn_size = r_anal_function_size_from_entry (fcn);
NAME=adf bug #16215
FILE=-
EXPECT=<<EOF
EOF
CMDS=<<EOF
adf
EOF
CVE-2021-32494: Divide By Zero (CWE-369)
value: Radare2 has a division by zero vulnerability in Mach-O parser's rebase_buffer function. This allow attackers to create malicious inputs that can cause denial of service.



CWE description: The product divides a value by zero.
CVSS v3 base score: 7.5
Published: 2023-07-07T19:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/bin/p/bin_mach0.c
Commit date: 2021-05-07 18:44:49 +0200
Commit message: Fix #18667 - division by zero in the macho parser ##bin

Diff: diff --git a/libr/bin/p/bin_mach0.c b/libr/bin/p/bin_mach0.c
index 207828f5f42..ee0eb29b97d 100644
--- a/libr/bin/p/bin_mach0.c
+++ b/libr/bin/p/bin_mach0.c
@@ -1,6 +1,6 @@
-/* radare - LGPL - Copyright 2009-2019 - pancake */
+/* radare - LGPL - Copyright 2009-2021 - pancake */
 
 #include <r_types.h>
 #include <r_util.h>
 #include <r_lib.h>
 #include <r_bin.h>
@@ -769,11 +769,14 @@ static void rebase_buffer(struct MACH0_(obj_t) *obj, ut64 off, RIODesc *fd, ut8
 	int i = 0;
 	for (; i < obj->nsegs; i++) {
 		if (!obj->chained_starts[i]) {
 			continue;
 		}
-		ut64 page_size = obj->chained_starts[i]->page_size;
+		int page_size = obj->chained_starts[i]->page_size;
+		if (page_size < 1) {
+			page_size = 4096;
+		}
 		ut64 start = obj->segs[i].fileoff;
 		ut64 end = start + obj->segs[i].filesize;
 		if (end >= off && start <= eob) {
 			ut64 page_idx = (R_MAX (start, off) - start) / page_size;
 			ut64 page_end_idx = (R_MIN (eob, end) - start) / page_size;

Vulnerable code: /* radare - LGPL - Copyright 2009-2019 - pancake */
		ut64 page_size = obj->chained_starts[i]->page_size;
Fixed code: /* radare - LGPL - Copyright 2009-2021 - pancake */
		int page_size = obj->chained_starts[i]->page_size;
		if (page_size < 1) {
			page_size = 4096;
		}
CVE-2021-32495: Use After Free (CWE-416)
value: Radare2 has a use-after-free vulnerability in pyc parser's get_none_object function. Attacker can read freed memory afterwards. This will allow attackers to cause denial of service.


CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 9.1
Published: 2023-07-07T19:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/bin/format/pyc/marshal.c
Commit date: 2021-05-07 21:09:59 +0200
Commit message: Fix #18666 - uaf in python bin parser

Diff: diff --git a/libr/bin/format/pyc/marshal.c b/libr/bin/format/pyc/marshal.c
index f8a4c0c3d73..d9b1b4b2f64 100644
--- a/libr/bin/format/pyc/marshal.c
+++ b/libr/bin/format/pyc/marshal.c
@@ -1,6 +1,6 @@
-/* radare - LGPL3 - Copyright 2016-2020 - Matthieu (c0riolis) Tardy - l0stb1t*/
+/* radare - LGPL3 - Copyright 2016-2021 - Matthieu (c0riolis) Tardy - l0stb1t*/
 
 #include <r_io.h>
 #include <r_bin.h>
 #include "marshal.h"
 #include "pyc_magic.h"
@@ -86,13 +86,11 @@ static ut8 *get_bytes(RBuffer *buffer, ut32 size) {
 	}
 	return ret;
 }
 
 static pyc_object *get_none_object(void) {
-	pyc_object *ret;
-
-	ret = R_NEW0 (pyc_object);
+	pyc_object *ret = R_NEW0 (pyc_object);
 	if (!ret) {
 		return NULL;
 	}
 	ret->type = TYPE_NONE;
 	ret->data = strdup ("None");
@@ -1135,11 +1133,13 @@ static pyc_object *get_object(RBuffer *buffer) {
 		free_object (ret);
 		return NULL;
 	}
 
 	if (flag && ref_idx) {
-		free_object (ref_idx->data);
+		if (ref_idx->data != ret) {
+			free_object (ref_idx->data);
+		}
 		ref_idx->data = copy_object (ret);
 	}
 	return ret;
 }
 

Vulnerable code: /* radare - LGPL3 - Copyright 2016-2020 - Matthieu (c0riolis) Tardy - l0stb1t*/
	pyc_object *ret;

	ret = R_NEW0 (pyc_object);
		free_object (ref_idx->data);
Fixed code: /* radare - LGPL3 - Copyright 2016-2021 - Matthieu (c0riolis) Tardy - l0stb1t*/
	pyc_object *ret = R_NEW0 (pyc_object);
		if (ref_idx->data != ret) {
			free_object (ref_idx->data);
		}
CVE-2021-32613: Double Free (CWE-415)
value: In radare2 through 5.3.0 there is a double free vulnerability in the pyc parse via a crafted file which can lead to DoS.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 5.5
Published: 2021-05-14T13:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/bin/p/bin_mach0.c
Commit date: 2021-05-07 18:44:49 +0200
Commit message: Fix #18667 - division by zero in the macho parser ##bin

Diff: diff --git a/libr/bin/p/bin_mach0.c b/libr/bin/p/bin_mach0.c
index 207828f5f42..ee0eb29b97d 100644
--- a/libr/bin/p/bin_mach0.c
+++ b/libr/bin/p/bin_mach0.c
@@ -1,6 +1,6 @@
-/* radare - LGPL - Copyright 2009-2019 - pancake */
+/* radare - LGPL - Copyright 2009-2021 - pancake */
 
 #include <r_types.h>
 #include <r_util.h>
 #include <r_lib.h>
 #include <r_bin.h>
@@ -769,11 +769,14 @@ static void rebase_buffer(struct MACH0_(obj_t) *obj, ut64 off, RIODesc *fd, ut8
 	int i = 0;
 	for (; i < obj->nsegs; i++) {
 		if (!obj->chained_starts[i]) {
 			continue;
 		}
-		ut64 page_size = obj->chained_starts[i]->page_size;
+		int page_size = obj->chained_starts[i]->page_size;
+		if (page_size < 1) {
+			page_size = 4096;
+		}
 		ut64 start = obj->segs[i].fileoff;
 		ut64 end = start + obj->segs[i].filesize;
 		if (end >= off && start <= eob) {
 			ut64 page_idx = (R_MAX (start, off) - start) / page_size;
 			ut64 page_end_idx = (R_MIN (eob, end) - start) / page_size;

Vulnerable code: /* radare - LGPL - Copyright 2009-2019 - pancake */
		ut64 page_size = obj->chained_starts[i]->page_size;
Fixed code: /* radare - LGPL - Copyright 2009-2021 - pancake */
		int page_size = obj->chained_starts[i]->page_size;
		if (page_size < 1) {
			page_size = 4096;
		}
CVE-2021-32613: Double Free (CWE-415)
value: In radare2 through 5.3.0 there is a double free vulnerability in the pyc parse via a crafted file which can lead to DoS.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 5.5
Published: 2021-05-14T13:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/bin/format/pyc/marshal.c
Commit date: 2021-05-07 21:09:59 +0200
Commit message: Fix #18666 - uaf in python bin parser

Diff: diff --git a/libr/bin/format/pyc/marshal.c b/libr/bin/format/pyc/marshal.c
index f8a4c0c3d73..d9b1b4b2f64 100644
--- a/libr/bin/format/pyc/marshal.c
+++ b/libr/bin/format/pyc/marshal.c
@@ -1,6 +1,6 @@
-/* radare - LGPL3 - Copyright 2016-2020 - Matthieu (c0riolis) Tardy - l0stb1t*/
+/* radare - LGPL3 - Copyright 2016-2021 - Matthieu (c0riolis) Tardy - l0stb1t*/
 
 #include <r_io.h>
 #include <r_bin.h>
 #include "marshal.h"
 #include "pyc_magic.h"
@@ -86,13 +86,11 @@ static ut8 *get_bytes(RBuffer *buffer, ut32 size) {
 	}
 	return ret;
 }
 
 static pyc_object *get_none_object(void) {
-	pyc_object *ret;
-
-	ret = R_NEW0 (pyc_object);
+	pyc_object *ret = R_NEW0 (pyc_object);
 	if (!ret) {
 		return NULL;
 	}
 	ret->type = TYPE_NONE;
 	ret->data = strdup ("None");
@@ -1135,11 +1133,13 @@ static pyc_object *get_object(RBuffer *buffer) {
 		free_object (ret);
 		return NULL;
 	}
 
 	if (flag && ref_idx) {
-		free_object (ref_idx->data);
+		if (ref_idx->data != ret) {
+			free_object (ref_idx->data);
+		}
 		ref_idx->data = copy_object (ret);
 	}
 	return ret;
 }
 

Vulnerable code: /* radare - LGPL3 - Copyright 2016-2020 - Matthieu (c0riolis) Tardy - l0stb1t*/
	pyc_object *ret;

	ret = R_NEW0 (pyc_object);
		free_object (ref_idx->data);
Fixed code: /* radare - LGPL3 - Copyright 2016-2021 - Matthieu (c0riolis) Tardy - l0stb1t*/
	pyc_object *ret = R_NEW0 (pyc_object);
		if (ref_idx->data != ret) {
			free_object (ref_idx->data);
		}
CVE-2022-0139: Use After Free (CWE-416)
value: Use After Free in GitHub repository radareorg/radare2 prior to 5.6.0.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 9.8
Published: 2022-02-08T19:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/io/io_bank.c
Commit date: 2022-01-06 21:57:58 +0100
Commit message: Fix use-after-free in iobank rbtree usage ##io

* See havoc4 bin for reproducer
* Reported via huntr.dev by 'Cen Zhang'

Diff: diff --git a/libr/io/io_bank.c b/libr/io/io_bank.c
index 228e422d656..882dfc48d18 100644
--- a/libr/io/io_bank.c
+++ b/libr/io/io_bank.c
@@ -228,11 +228,14 @@ R_API bool r_io_bank_map_add_top(RIO *io, const ut32 bankid, const ut32 mapid) {
 	}
 	while (entry && r_io_submap_to (((RIOSubMap *)entry->data)) <= r_io_submap_to (sm)) {
 		//delete all submaps that are completly included in sm
 		RRBNode *next = r_rbnode_next (entry);
 		// this can be optimized, there is no need to do search here
-		r_crbtree_delete (bank->submaps, entry->data, _find_sm_by_from_vaddr_cb, NULL);
+		bool a = r_crbtree_delete (bank->submaps, entry->data, _find_sm_by_from_vaddr_cb, NULL);
+		if (!a) {
+			break;
+		}
 		entry = next;
 	}
 	if (entry && r_io_submap_from (((RIOSubMap *)entry->data)) <= r_io_submap_to (sm)) {
 		bd = (RIOSubMap *)entry->data;
 		r_io_submap_set_from (bd, r_io_submap_to (sm) + 1);

Vulnerable code: 		r_crbtree_delete (bank->submaps, entry->data, _find_sm_by_from_vaddr_cb, NULL);
Fixed code: 		bool a = r_crbtree_delete (bank->submaps, entry->data, _find_sm_by_from_vaddr_cb, NULL);
		if (!a) {
			break;
		}
CVE-2022-0173: Out-of-bounds Read (CWE-125)
value: radare2 is vulnerable to Out-of-bounds Read
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2022-01-11T17:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/io/io_bank.c
Commit date: 2022-01-06 21:57:58 +0100
Commit message: Fix use-after-free in iobank rbtree usage ##io

* See havoc4 bin for reproducer
* Reported via huntr.dev by 'Cen Zhang'

Diff: diff --git a/libr/io/io_bank.c b/libr/io/io_bank.c
index 228e422d656..882dfc48d18 100644
--- a/libr/io/io_bank.c
+++ b/libr/io/io_bank.c
@@ -228,11 +228,14 @@ R_API bool r_io_bank_map_add_top(RIO *io, const ut32 bankid, const ut32 mapid) {
 	}
 	while (entry && r_io_submap_to (((RIOSubMap *)entry->data)) <= r_io_submap_to (sm)) {
 		//delete all submaps that are completly included in sm
 		RRBNode *next = r_rbnode_next (entry);
 		// this can be optimized, there is no need to do search here
-		r_crbtree_delete (bank->submaps, entry->data, _find_sm_by_from_vaddr_cb, NULL);
+		bool a = r_crbtree_delete (bank->submaps, entry->data, _find_sm_by_from_vaddr_cb, NULL);
+		if (!a) {
+			break;
+		}
 		entry = next;
 	}
 	if (entry && r_io_submap_from (((RIOSubMap *)entry->data)) <= r_io_submap_to (sm)) {
 		bd = (RIOSubMap *)entry->data;
 		r_io_submap_set_from (bd, r_io_submap_to (sm) + 1);

Vulnerable code: 		r_crbtree_delete (bank->submaps, entry->data, _find_sm_by_from_vaddr_cb, NULL);
Fixed code: 		bool a = r_crbtree_delete (bank->submaps, entry->data, _find_sm_by_from_vaddr_cb, NULL);
		if (!a) {
			break;
		}
CVE-2022-0419: NULL Pointer Dereference (CWE-476)
value: NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.0.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2022-02-01T11:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/bin/p/bin_xnu_kernelcache.c
Commit date: 2022-01-31 02:32:50 +0100
Commit message: Fix null deref in xnu.kernelcache ##crash

* Reported by @xshad3 via huntr.dev

Diff: diff --git a/libr/bin/p/bin_xnu_kernelcache.c b/libr/bin/p/bin_xnu_kernelcache.c
index 36b1c2db087..df5b1fe7d0c 100644
--- a/libr/bin/p/bin_xnu_kernelcache.c
+++ b/libr/bin/p/bin_xnu_kernelcache.c
@@ -240,11 +240,13 @@ static bool load_buffer(RBinFile *bf, void **bin_obj, RBuffer *buf, ut64 loadadd
 
 	return true;
 
 beach:
 	r_buf_free (fbuf);
-	obj->cache_buf = NULL;
+	if (obj) {
+		obj->cache_buf = NULL;
+	}
 	MACH0_(mach0_free) (main_mach0);
 	return false;
 }
 
 static void ensure_kexts_initialized(RKernelCacheObj *obj, RBinFile *bf) {

Vulnerable code: 	obj->cache_buf = NULL;
Fixed code: 	if (obj) {
		obj->cache_buf = NULL;
	}
CVE-2022-0518: Out-of-bounds Write (CWE-787)
value: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.2.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.1
Published: 2022-02-08T21:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: shlr/java/class.c
Commit date: 2022-02-07 23:58:09 +0100
Commit message: Fix oobread segfault in java arith8.class ##crash

* Reported by Cen Zhang via huntr.dev

Diff: diff --git a/shlr/java/class.c b/shlr/java/class.c
index abdee3bf46d..2fe6465b6cc 100644
--- a/shlr/java/class.c
+++ b/shlr/java/class.c
@@ -3731,21 +3731,25 @@ R_API RBinJavaAttrInfo *r_bin_java_inner_classes_attr_new(RBinJavaObj *bin, ut8
 	RBinJavaCPTypeObj *obj;
 	ut32 i = 0;
 	ut64 offset = 0, curpos;
 	attr = r_bin_java_default_attr_new (bin, buffer, sz, buf_offset);
 	offset += 6;
+	if (buf_offset + offset + 8 > sz) {
+		eprintf ("Invalid amount of inner classes\n");
+		return NULL;
+	}
 	if (attr == NULL) {
 		// TODO eprintf
 		return attr;
 	}
 	attr->type = R_BIN_JAVA_ATTR_TYPE_INNER_CLASSES_ATTR;
 	attr->info.inner_classes_attr.number_of_classes = R_BIN_JAVA_USHORT (buffer, offset);
 	offset += 2;
 	attr->info.inner_classes_attr.classes = r_list_newf (r_bin_java_inner_classes_attr_entry_free);
 	for (i = 0; i < attr->info.inner_classes_attr.number_of_classes; i++) {
 		curpos = buf_offset + offset;
-		if (offset + 8 > sz) {
+		if (buf_offset + offset + 8 > sz) {
 			eprintf ("Invalid amount of inner classes\n");
 			break;
 		}
 		icattr = R_NEW0 (RBinJavaClassesAttribute);
 		if (!icattr) {

Vulnerable code: 		if (offset + 8 > sz) {
Fixed code: 	if (buf_offset + offset + 8 > sz) {
		eprintf ("Invalid amount of inner classes\n");
		return NULL;
	}
		if (buf_offset + offset + 8 > sz) {
CVE-2022-0520: Use After Free (CWE-416)
value: Use After Free in NPM radare2.js prior to 5.6.2.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.8
Published: 2022-02-08T21:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/bin/format/pyc/marshal.c
Commit date: 2022-02-07 23:58:09 +0100
Commit message: Fix bins/*/rep8 - UAF crash in pyc parser ##crash

* Reported by Cen Zhang via huntr.dev

Diff: diff --git a/libr/bin/format/pyc/marshal.c b/libr/bin/format/pyc/marshal.c
index 4245a178249..728bf737019 100644
--- a/libr/bin/format/pyc/marshal.c
+++ b/libr/bin/format/pyc/marshal.c
@@ -1096,11 +1096,11 @@ static pyc_object *get_object(RBuffer *buffer) {
 	case TYPE_ELLIPSIS:
 		ret = R_NEW0 (pyc_object);
 		break;
 	case TYPE_UNKNOWN:
 		eprintf ("Get not implemented for type 0x%x\n", type);
-		r_list_pop (refs);
+		// r_list_pop (refs);
 		free_object (ret);
 		return NULL;
 	case 0:
 		// nop
 		break;

Vulnerable code: 		r_list_pop (refs);
Fixed code: 		// r_list_pop (refs);
CVE-2022-0522: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Access of Memory Location Before Start of Buffer in NPM radare2.js prior to 5.6.2.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.1
Published: 2022-02-08T21:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/anal/p/anal_arm_cs.c
Commit date: 2022-02-07 23:58:09 +0100
Commit message: Fix negative index in anal.arm64.cs ##crash

* Reported by Cen Zhang via huntr.dev

Diff: diff --git a/libr/anal/p/anal_arm_cs.c b/libr/anal/p/anal_arm_cs.c
index 24d3aa3ce43..ee57d55df78 100644
--- a/libr/anal/p/anal_arm_cs.c
+++ b/libr/anal/p/anal_arm_cs.c
@@ -1013,11 +1013,11 @@ static const char *arg(RAnal *a, csh *handle, cs_insn *insn, char *buf, int n) {
 
 #define ARG(x) arg(a, handle, insn, str[x], x)
 
 #define VEC64(n) insn->detail->arm64.operands[n].vess
 #define VEC64_APPEND(sb, n, i) vector64_append(sb, handle, insn, n, i)
-#define VEC64_MASK(sh, sz) (bitmask_by_width[63]^(bitmask_by_width[sz-1]<<sh))
+#define VEC64_MASK(sh, sz) (bitmask_by_width[63]^(bitmask_by_width[sz>0?sz-1:0]<<sh))
 
 static void vector64_append(RStrBuf *sb, csh *handle, cs_insn *insn, int n, int i) {
 	cs_arm64_op op = INSOP64 (n);
 
 	if (op.vector_index != -1) {
@@ -1077,11 +1077,10 @@ static void vector64_dst_append(RStrBuf *sb, csh *handle, cs_insn *insn, int n,
 		ut64 mask = bitmask_by_width[index];
 		if (shift >= 64) {
 			shift -= 64;
 			regc = "h";
 		}
-
 		if (shift > 0 && shift < 64) {
 			r_strbuf_appendf (sb, "%d,SWAP,0x%"PFMT64x",&,<<,%s%s,0x%"PFMT64x",&,|,%s%s",
 				shift, mask, REG64 (n), regc, VEC64_MASK (shift, size), REG64 (n), regc);
 		} else {
 			int dimsize = size % 64;

Vulnerable code: #define VEC64_MASK(sh, sz) (bitmask_by_width[63]^(bitmask_by_width[sz-1]<<sh))

Fixed code: #define VEC64_MASK(sh, sz) (bitmask_by_width[63]^(bitmask_by_width[sz>0?sz-1:0]<<sh))
CVE-2022-0712: NULL Pointer Dereference (CWE-476)
value: NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.4.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2022-02-22T18:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/bin/p/bin_symbols.c
Commit date: 2022-02-21 18:47:11 +0100
Commit message: Fix null deref in bin.symbols ##crash

* Reported by cnitlrt via huntr.dev

Diff: diff --git a/libr/bin/p/bin_symbols.c b/libr/bin/p/bin_symbols.c
index 394736cfffb..183507d2d2b 100644
--- a/libr/bin/p/bin_symbols.c
+++ b/libr/bin/p/bin_symbols.c
@@ -1,6 +1,6 @@
-/* radare - LGPL - Copyright 2018 - pancake */
+/* radare - LGPL - Copyright 2018-2022 - pancake */
 
 #include <r_types.h>
 #include <r_util.h>
 #include <r_lib.h>
 #include <r_bin.h>
@@ -359,10 +359,13 @@ static RList *symbols(RBinFile *bf) {
 		return res;
 	}
 	bool found = false;
 	for (i = 0; i < element->hdr->n_lined_symbols; i++) {
 		RCoreSymCacheElementSymbol *sym = (RCoreSymCacheElementSymbol *)&element->lined_symbols[i];
+		if (!sym) {
+			break;
+		}
 		ht_uu_find (hash, sym->paddr, &found);
 		if (found) {
 			continue;
 		}
 		RBinSymbol *s = bin_symbol_from_symbol (element, sym);

Vulnerable code: /* radare - LGPL - Copyright 2018 - pancake */
Fixed code: /* radare - LGPL - Copyright 2018-2022 - pancake */
		if (!sym) {
			break;
		}
CVE-2022-0713: Out-of-bounds Write (CWE-787)
value: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.1
Published: 2022-02-22T19:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/bin/format/mach0/coresymbolication.c
Commit date: 2022-02-21 19:25:02 +0100
Commit message: Fix oobread in macho core symbolication ##crash

* Reported by @cnitlrt via huntr.dev

Diff: diff --git a/libr/bin/format/mach0/coresymbolication.c b/libr/bin/format/mach0/coresymbolication.c
index 5385509f324..f350199550b 100644
--- a/libr/bin/format/mach0/coresymbolication.c
+++ b/libr/bin/format/mach0/coresymbolication.c
@@ -220,11 +220,11 @@ RCoreSymCacheElement *r_coresym_cache_element_new(RBinFile *bf, RBuffer *buf, ut
 		if (!result->segments) {
 			goto beach;
 		}
 		size_t i;
 		ut8 *cursor = b + R_CS_EL_OFF_SEGS;
-		for (i = 0; i < hdr->n_segments && cursor < end; i++) {
+		for (i = 0; i < hdr->n_segments && cursor + sizeof (RCoreSymCacheElementSegment) < end; i++) {
 			RCoreSymCacheElementSegment *seg = &result->segments[i];
 			seg->paddr = seg->vaddr = r_read_le64 (cursor);
 			cursor += 8;
 			if (cursor >= end) {
 				break;

Vulnerable code: 		for (i = 0; i < hdr->n_segments && cursor < end; i++) {
Fixed code: 		for (i = 0; i < hdr->n_segments && cursor + sizeof (RCoreSymCacheElementSegment) < end; i++) {
CVE-2022-1061: Out-of-bounds Write (CWE-787)
value: Heap Buffer Overflow in parseDragons in GitHub repository radareorg/radare2 prior to 5.6.8.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2022-03-24T10:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/bin/p/bin_symbols.c
Commit date: 2022-03-24 10:12:05 +0100
Commit message: Fix oobread in symbols header parsing ##bin

Diff: diff --git a/libr/bin/p/bin_symbols.c b/libr/bin/p/bin_symbols.c
index 2036dc092b6..779e36940ff 100644
--- a/libr/bin/p/bin_symbols.c
+++ b/libr/bin/p/bin_symbols.c
@@ -179,18 +179,21 @@ static RBinSymbol *bin_symbol_from_symbol(RCoreSymCacheElement *element, RCoreSy
 	return sym;
 }
 
 static RCoreSymCacheElement *parseDragons(RBinFile *bf, RBuffer *buf, int off, int bits, R_OWN char *file_name) {
 	D eprintf ("Dragons at 0x%x\n", off);
-	ut64 size = r_buf_size (buf);
+	st64 size = r_buf_size (buf);
 	if (off >= size) {
 		return NULL;
 	}
 	size -= off;
 	if (!size) {
 		return NULL;
 	}
+	if (size < 32) {
+		return NULL;
+	}
 	ut8 *b = malloc (size);
 	if (!b) {
 		return NULL;
 	}
 	int available = r_buf_read_at (buf, off, b, size);

Vulnerable code: 	ut64 size = r_buf_size (buf);
Fixed code: 	st64 size = r_buf_size (buf);
	if (size < 32) {
		return NULL;
	}
CVE-2022-1238: Out-of-bounds Write (CWE-787)
value: Out-of-bounds Write in libr/bin/format/ne/ne.c in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is heap overflow and may be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html).
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2022-04-06T10:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/bin/format/ne/ne.c
Commit date: 2022-04-05 19:10:49 +0200
Commit message: Fix another oobread segfault in the NE bin parser ##crash

* Reported by @han0nly via huntr.dev
* Reproducers: sample1 sample2 sample3
* BountyID: 47422cdf-aad2-4405-a6a1-6f63a3a93200

Diff: diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c
index 210fe036925f..ad7c86be17f4 100644
--- a/libr/bin/format/ne/ne.c
+++ b/libr/bin/format/ne/ne.c
@@ -372,10 +372,13 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) {
 		entry->paddr = bin->ne_header->ipEntryPoint + (s? s->paddr: 0);
 		r_list_append (entries, entry);
 	}
 	int off = 0;
 	while (off < bin->ne_header->EntryTableLength) {
+		if (bin->entry_table + off + 32 >= r_buf_size (bin->buf)) {
+			break;
+		}
 		ut8 bundle_length = *(ut8 *)(bin->entry_table + off);
 		if (!bundle_length) {
 			break;
 		}
 		off++;
@@ -396,11 +399,13 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) {
 			} else if (bundle_type == 0xFF) { // Moveable
 				off += 2;
 				ut8 segnum = *(bin->entry_table + off);
 				off++;
 				ut16 segoff = *(ut16 *)(bin->entry_table + off);
-				entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff;
+				if (segnum > 0) {
+					entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff;
+				}
 			} else { // Fixed
 				entry->paddr = (ut64)bin->segment_entries[bundle_type - 1].offset * bin->alignment + *(ut16 *)(bin->entry_table + off);
 			}
 			off += 2;
 			r_list_append (entries, entry);

Vulnerable code: 				entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff;
Fixed code: 		if (bin->entry_table + off + 32 >= r_buf_size (bin->buf)) {
			break;
		}
				if (segnum > 0) {
					entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff;
				}
CVE-2022-1240: Out-of-bounds Write (CWE-787)
value: Heap buffer overflow in libr/bin/format/mach0/mach0.c in GitHub repository radareorg/radare2 prior to 5.8.6. If address sanitizer is disabled during the compiling, the program should executes into the `r_str_ncpy` function. Therefore I think it is very likely to be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html).
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2022-04-06T11:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/bin/format/mach0/mach0.c
Commit date: 2022-04-05 12:11:05 +0200
Commit message: Fix oobread in the macho parser ##crash

* Reported by @Han0nly via huntr.dev
* Reproducers: heapoverflow1
* BountyID: e589bd97-4c74-4e79-93b5-0951a281facc

Diff: diff --git a/libr/bin/format/mach0/mach0.c b/libr/bin/format/mach0/mach0.c
index 1bf09233ab45..8aaf3f49a18b 100644
--- a/libr/bin/format/mach0/mach0.c
+++ b/libr/bin/format/mach0/mach0.c
@@ -3176,11 +3176,11 @@ static void parse_relocation_info(struct MACH0_(obj_t) *bin, RSkipList *relocs,
 
 	size_t i;
 	for (i = 0; i < num; i++) {
 		struct relocation_info a_info = info[i];
 		ut32 sym_num = a_info.r_symbolnum;
-		if (sym_num > bin->nsymtab) {
+		if (sym_num >= bin->nsymtab) {
 			continue;
 		}
 
 		ut32 stridx = bin->symtab[sym_num].n_strx;
 		char *sym_name = get_name (bin, stridx, false);

Vulnerable code: 		if (sym_num > bin->nsymtab) {
Fixed code: 		if (sym_num >= bin->nsymtab) {
CVE-2022-1244: Heap-based Buffer Overflow (CWE-122)
value: heap-buffer-overflow in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 5.5
Published: 2022-04-05T19:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/bin/format/mach0/dyldcache.h, libr/bin/p/bin_dyldcache.c
Commit date: 2022-04-05 19:51:03 +0200
Commit message: Fix oobread in dyldcache ##crash

* Reported by @hdthky via huntr.dev
* Reproducers: poc1
* BountyID: 8ae2c61a-2220-47a5-bfe8-fe6d41ab1f82

Diff: diff --git a/libr/bin/format/mach0/dyldcache.h b/libr/bin/format/mach0/dyldcache.h
index 9f00182cd2d4..21e598abb31c 100644
--- a/libr/bin/format/mach0/dyldcache.h
+++ b/libr/bin/format/mach0/dyldcache.h
@@ -1,6 +1,6 @@
-/* radare - LGPL - Copyright 2009-2010 nibble<.ds@gmail.com> */
+/* radare - LGPL - Copyright 2009-2022 nibble, pancake */
 
 #include <r_types.h>
 #include "mach0_specs.h"
 
 #ifndef _INCLUDE_R_BIN_DYLDCACHE_H_
diff --git a/libr/bin/p/bin_dyldcache.c b/libr/bin/p/bin_dyldcache.c
index 0dc9d16a6dee..0d9af87a9fff 100644
--- a/libr/bin/p/bin_dyldcache.c
+++ b/libr/bin/p/bin_dyldcache.c
@@ -1245,11 +1245,12 @@ static RList *create_cache_bins(RBinFile *bf, RDyldCache *cache) {
 
 		for (j = 0; j < hdr->imagesCount; j++) {
 			if (deps && !deps[j]) {
 				continue;
 			}
-			ut64 pa = va2pa (img[j].address, hdr->mappingCount, &cache->maps[maps_index], cache->buf, 0, NULL, NULL);
+			// ut64 pa = va2pa (img[j].address, hdr->mappingCount, &cache->maps[maps_index], cache->buf, 0, NULL, NULL);
+			ut64 pa = va2pa (img[j].address, cache->n_maps, &cache->maps[maps_index], cache->buf, 0, NULL, NULL);
 			if (pa == UT64_MAX) {
 				continue;
 			}
 			ut8 magicbytes[4];
 			r_buf_read_at (cache->buf, pa, magicbytes, 4);

Vulnerable code: /* radare - LGPL - Copyright 2009-2010 nibble<.ds@gmail.com> */
			ut64 pa = va2pa (img[j].address, hdr->mappingCount, &cache->maps[maps_index], cache->buf, 0, NULL, NULL);
Fixed code: /* radare - LGPL - Copyright 2009-2022 nibble, pancake */
			// ut64 pa = va2pa (img[j].address, hdr->mappingCount, &cache->maps[maps_index], cache->buf, 0, NULL, NULL);
			ut64 pa = va2pa (img[j].address, cache->n_maps, &cache->maps[maps_index], cache->buf, 0, NULL, NULL);
CVE-2022-1283: NULL Pointer Dereference (CWE-476)
value: NULL Pointer Dereference in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability allows attackers to cause a denial of service (application crash).
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2022-04-08T18:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/bin/format/ne/ne.c
Commit date: 2022-04-08 19:49:21 +0200
Commit message: Fix null deref in the ne parser ##crash

* Reported by @hmsec via huntr.dev
* Reproducer: nepoc00
* BountyID: bfeb8fb8-644d-4587-80d4-cb704c404013

Diff: diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c
index f080e937fc9b..ee2df871ac87 100644
--- a/libr/bin/format/ne/ne.c
+++ b/libr/bin/format/ne/ne.c
@@ -113,11 +113,11 @@ RList *r_bin_ne_get_symbols(r_bin_ne_obj_t *bin) {
 	if (!symbols) {
 		return NULL;
 	}
 	RList *entries = r_bin_ne_get_entrypoints (bin);
 	bool resident = true, first = true;
-	while (true) {
+	while (entries) {
 		ut8 sz = r_buf_read8_at (bin->buf, off);
 		if (!sz) {
 			first = true;
 			if (resident) {
 				resident = false;
@@ -350,10 +350,13 @@ RList *r_bin_ne_get_imports(r_bin_ne_obj_t *bin) {
 	bin->imports = imports;
 	return imports;
 }
 
 RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) {
+	if (!bin->entry_table) {
+		return NULL;
+	}
 	RList *entries = r_list_newf (free);
 	if (!entries) {
 		return NULL;
 	}
 	RList *segments = r_bin_ne_get_segments (bin);

Vulnerable code: 	while (true) {
Fixed code: 	while (entries) {
	if (!bin->entry_table) {
		return NULL;
	}
CVE-2022-1284: Use After Free (CWE-416)
value: heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 5.5
Published: 2022-04-08T19:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/core/canal.c
Commit date: 2022-04-08 20:39:43 +0200
Commit message: Fix UAF in `aaef` ##crash

* Reported by @hdthky
* Reproducer: uaf-aef
* BountyID: e98ad92c-3a64-48fb-84d4-d13afdbcbdd7

Diff: diff --git a/libr/core/canal.c b/libr/core/canal.c
index fb53e75fc3cc..610cd22f219d 100644
--- a/libr/core/canal.c
+++ b/libr/core/canal.c
@@ -5293,14 +5293,10 @@ R_API void r_core_anal_esil(RCore *core, const char *str, const char *target) {
 	if (!strcmp (core->anal->cur->arch, "mips")) {
 		gp_reg = "gp";
 		arch = R2_ARCH_MIPS;
 	}
 
-	const char *sn = r_reg_get_name (core->anal->reg, R_REG_NAME_SN);
-	if (!sn) {
-		eprintf ("Warning: No SN reg alias for current architecture.\n");
-	}
 	r_reg_arena_push (core->anal->reg);
 
 	IterCtx ictx = { start, end, fcn, NULL };
 	size_t i = addr - start;
 	size_t i_old = 0;
@@ -5407,10 +5403,14 @@ R_API void r_core_anal_esil(RCore *core, const char *str, const char *target) {
 			case R_ANAL_OP_TYPE_POP:
 				i += op.size - 1;
 				goto repeat;
 			}
 		}
+		const char *sn = r_reg_get_name (core->anal->reg, R_REG_NAME_SN);
+		if (!sn) {
+			eprintf ("Warning: No SN reg alias for current architecture.\n");
+		}
 		if (sn && op.type == R_ANAL_OP_TYPE_SWI) {
 			r_strf_buffer (64);
 			r_flag_space_set (core->flags, R_FLAGS_FS_SYSCALLS);
 			int snv = (arch == R2_ARCH_THUMB)? op.val: (int)r_reg_getv (core->anal->reg, sn);
 			RSyscallItem *si = r_syscall_get (core->anal->syscall, snv, -1);

Vulnerable code: 	const char *sn = r_reg_get_name (core->anal->reg, R_REG_NAME_SN);
	if (!sn) {
		eprintf ("Warning: No SN reg alias for current architecture.\n");
	}
Fixed code: 		const char *sn = r_reg_get_name (core->anal->reg, R_REG_NAME_SN);
		if (!sn) {
			eprintf ("Warning: No SN reg alias for current architecture.\n");
		}
CVE-2022-1297: Out-of-bounds Read (CWE-125)
value: Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability may allow attackers to read sensitive information or cause a crash.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2022-04-11T12:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/bin/format/ne/ne.c
Commit date: 2022-04-11 13:46:41 +0200
Commit message: Fix oobread and unaligned casts in the NE entrypoint logic ##crash

* Reported by @hmsec via huntr.dev
* Reproducer: nepocaligns
* BountyID: ec538fa4-06c6-4050-a141-f60153ddeaac

Diff: diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c
index b907d56e93b1..32aa589e8b7d 100644
--- a/libr/bin/format/ne/ne.c
+++ b/libr/bin/format/ne/ne.c
@@ -406,18 +406,25 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) {
 				break;
 			} else if (bundle_type == 0xff) { // moveable
 				off += 2;
 				ut8 segnum = *(bin->entry_table + off);
 				off++;
-				ut16 segoff = *(ut16 *)(bin->entry_table + off);
-				if (segnum > 0) {
+				if (off > bin->ne_header->EntryTableLength) {
+					break;
+				}
+				ut16 segoff = r_read_le16 (bin->entry_table + off);
+				if (segnum > 0 && segnum < bin->ne_header->SegCount) {
 					entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff;
 				}
 			} else { // Fixed
+				if (off + 2 >= bin->ne_header->EntryTableLength) {
+					break;
+				}
+				ut16 delta = r_read_le16 (bin->entry_table + off);
 				if (bundle_type < bin->ne_header->SegCount) {
 					entry->paddr = (ut64)bin->segment_entries[bundle_type - 1].offset
-						* bin->alignment + *(ut16 *)(bin->entry_table + off);
+						* bin->alignment + delta;
 				}
 			}
 			off += 2;
 			r_list_append (entries, entry);
 		}

Vulnerable code: 				ut16 segoff = *(ut16 *)(bin->entry_table + off);
				if (segnum > 0) {
						* bin->alignment + *(ut16 *)(bin->entry_table + off);
Fixed code: 				if (off > bin->ne_header->EntryTableLength) {
					break;
				}
				ut16 segoff = r_read_le16 (bin->entry_table + off);
				if (segnum > 0 && segnum < bin->ne_header->SegCount) {
				if (off + 2 >= bin->ne_header->EntryTableLength) {
					break;
				}
				ut16 delta = r_read_le16 (bin->entry_table + off);
						* bin->alignment + delta;