Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-5948: Improper Authorization (CWE-285)
value: Improper Authorization in GitHub repository teamamaze/amazefileutilities prior to 1.91.
CWE description: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 5.5
Published: 2023-11-03T07:15Z
Repository: https://github.com/teamamaze/amazefileutilities
Language: Unknown
Commit date: 2023-10-09 11:24:09 +0530
Commit message: Merge pull request #127 from TeamAmaze/bugfix/welcomescreen

Monkeypatch WelcomePermissionScreen to prevent unintentional Intents
CVE-2022-2365: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.53.3.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-07-10T22:15Z
Repository: https://github.com/zadam/trilium
Language: JavaScript
Files changed: src/public/app/widgets/dialogs/export.js
Commit date: 2022-07-10 22:32:00 +0200
Commit message: fix note title escaping in export dialog

Diff: diff --git a/src/public/app/widgets/dialogs/export.js b/src/public/app/widgets/dialogs/export.js
index 5e4909b95..5727aa5e2 100644
--- a/src/public/app/widgets/dialogs/export.js
+++ b/src/public/app/widgets/dialogs/export.js
@@ -211,14 +211,11 @@ export default class ExportDialog extends BasicWidget {
         utils.openDialog(this.$widget);
 
         const {noteId, parentNoteId} = treeService.getNoteIdAndParentIdFromNotePath(notePath);
 
         this.branchId = await froca.getBranchId(parentNoteId, noteId);
-
-        const noteTitle = await treeService.getNoteTitle(noteId);
-
-        this.$noteTitle.html(noteTitle);
+        this.$noteTitle.text(await treeService.getNoteTitle(noteId));
     }
 
     exportBranch(branchId, type, format, version) {
         this.taskId = utils.randomString(10);
 

Vulnerable code: 
        const noteTitle = await treeService.getNoteTitle(noteId);

        this.$noteTitle.html(noteTitle);
Fixed code:         this.$noteTitle.text(await treeService.getNoteTitle(noteId));
CVE-2023-3067: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.59.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-06-02T16:15Z
Repository: https://github.com/zadam/trilium
Language: JavaScript
Files changed: src/services/search/services/search.js
Commit date: 2023-03-17 22:04:49 +0100
Commit message: fix sanitization of autocomplete against XSS

Diff: diff --git a/src/services/search/services/search.js b/src/services/search/services/search.js
index 06362b28c..beb0555d1 100644
--- a/src/services/search/services/search.js
+++ b/src/services/search/services/search.js
@@ -305,11 +305,11 @@ function highlightSearchResults(searchResults, highlightedTokens) {
     highlightedTokens.sort((a, b) => a.length > b.length ? -1 : 1);
 
     for (const result of searchResults) {
         const note = becca.notes[result.noteId];
 
-        result.highlightedNotePathTitle = result.notePathTitle.replace('/[<\{\}]/g', '');
+        result.highlightedNotePathTitle = result.notePathTitle.replace(/[<{}]/g, '');
 
         if (highlightedTokens.find(token => note.type.includes(token))) {
             result.highlightedNotePathTitle += ` "type: ${note.type}'`;
         }
 

Vulnerable code:         result.highlightedNotePathTitle = result.notePathTitle.replace('/[<\{\}]/g', '');
Fixed code:         result.highlightedNotePathTitle = result.notePathTitle.replace(/[<{}]/g, '');
CVE-2017-16880: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The dump function in Util/TemplateHelper.php in filp whoops before 2.1.13 has XSS.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-11-17T21:29Z
Repository: https://github.com/filp/whoops
Language: PHP
Files changed: src/Whoops/Util/TemplateHelper.php
Commit date: 2017-11-17 10:15:51 +0200
Commit message: TemplateHelper: fix XSS if Symfony dumper is not available

Diff: diff --git a/src/Whoops/Util/TemplateHelper.php b/src/Whoops/Util/TemplateHelper.php
index e701635..00f6ae4 100644
--- a/src/Whoops/Util/TemplateHelper.php
+++ b/src/Whoops/Util/TemplateHelper.php
@@ -181,11 +181,11 @@ class TemplateHelper
             $this->htmlDumperOutput->clear();
 
             return $output;
         }
 
-        return print_r($value, true);
+        return htmlspecialchars(print_r($value, true));
     }
 
     /**
      * Format the args of the given Frame as a human readable html string
      *

Vulnerable code:         return print_r($value, true);
Fixed code:         return htmlspecialchars(print_r($value, true));
CVE-2020-21048: Insufficient Information (NVD-CWE-noinfo)
value: An issue in the dither.c component of libsixel prior to v1.8.4 allows attackers to cause a denial of service (DOS) via a crafted PNG file.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 6.5
Published: 2021-09-14T16:15Z
Repository: https://github.com/saitoha/libsixel
Language: C
Files changed: src/dither.c
Commit date: 2019-12-15 21:57:40 +0900
Commit message: Avoid illegal memory access problem with 1 color paletted png(#73),
Thanks to HongxuChen.

Diff: diff --git a/src/dither.c b/src/dither.c
index 72251d7..9c74eb3 100644
--- a/src/dither.c
+++ b/src/dither.c
@@ -282,13 +282,17 @@ sixel_dither_new(
     if (ncolors < 0) {
         ncolors = 256;
         quality_mode = SIXEL_QUALITY_HIGHCOLOR;
     } else {
         if (ncolors > SIXEL_PALETTE_MAX) {
+            status = SIXEL_BAD_INPUT;
             ncolors = 256;
-        } else if (ncolors < 2) {
-            ncolors = 2;
+        } else if (ncolors < 1) {
+            status = SIXEL_BAD_INPUT;
+            sixel_helper_set_additional_message(
+                "sixel_dither_new: palette colors must be more than 0");
+            goto end;
         }
         quality_mode = SIXEL_QUALITY_LOW;
     }
     headsize = sizeof(sixel_dither_t);
     datasize = (size_t)(ncolors * 3);

Vulnerable code:         } else if (ncolors < 2) {
            ncolors = 2;
Fixed code:             status = SIXEL_BAD_INPUT;
        } else if (ncolors < 1) {
            status = SIXEL_BAD_INPUT;
            sixel_helper_set_additional_message(
                "sixel_dither_new: palette colors must be more than 0");
            goto end;
CVE-2020-21050: Out-of-bounds Write (CWE-787)
value: Libsixel prior to v1.8.3 contains a stack buffer overflow in the function gif_process_raster at fromgif.c.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2021-09-14T16:15Z
Repository: https://github.com/saitoha/libsixel
Language: C
Files changed: src/fromgif.c
Commit date: 2018-08-02 02:02:07 +0900
Commit message: gif loader: check LZW code size (Issue #75)

Diff: diff --git a/src/fromgif.c b/src/fromgif.c
index c13b0055..2f88172a 100644
--- a/src/fromgif.c
+++ b/src/fromgif.c
@@ -56,18 +56,22 @@ typedef struct
    signed short prefix;
    unsigned char first;
    unsigned char suffix;
 } gif_lzw;
 
+enum {
+   gif_lzw_max_code_size = 12
+};
+
 typedef struct
 {
    int w, h;
    unsigned char *out;  /* output buffer (always 4 components) */
    int flags, bgindex, ratio, transparent, eflags;
    unsigned char pal[256][3];
    unsigned char lpal[256][3];
-   gif_lzw codes[4096];
+   gif_lzw codes[1 << gif_lzw_max_code_size];
    unsigned char *color_table;
    int parse, step;
    int lflags;
    int start_x, start_y;
    int max_x, max_y;
@@ -297,11 +301,19 @@ gif_process_raster(
     signed int len, code;
     unsigned int first;
     signed int codesize, codemask, avail, oldcode, bits, valid_bits, clear;
     gif_lzw *p;
 
+    /* LZW Minimum Code Size */
     lzw_cs = gif_get8(s);
+    if (lzw_cs > gif_lzw_max_code_size) {
+        sixel_helper_set_additional_message(
+            "Unsupported GIF (LZW code size)");
+        status = SIXEL_RUNTIME_ERROR;
+        goto end;
+    }
+
     clear = 1 << lzw_cs;
     first = 1;
     codesize = lzw_cs + 1;
     codemask = (1 << codesize) - 1;
     bits = 0;
@@ -351,11 +363,11 @@ gif_process_raster(
                         "corrupt GIF (reason: no clear code).");
                     status = SIXEL_RUNTIME_ERROR;
                     goto end;
                 }
                 if (oldcode >= 0) {
-                    if (avail < 4096) {
+                    if (avail < (1 << gif_lzw_max_code_size)) {
                         p = &g->codes[avail++];
                         p->prefix = (signed short) oldcode;
                         p->first = g->codes[oldcode].first;
                         p->suffix = (code == avail) ? p->first : g->codes[code].first;
                     }

Vulnerable code:    gif_lzw codes[4096];
                    if (avail < 4096) {
Fixed code: enum {
   gif_lzw_max_code_size = 12
};

   gif_lzw codes[1 << gif_lzw_max_code_size];
    /* LZW Minimum Code Size */
    if (lzw_cs > gif_lzw_max_code_size) {
        sixel_helper_set_additional_message(
            "Unsupported GIF (LZW code size)");
        status = SIXEL_RUNTIME_ERROR;
        goto end;
    }

                    if (avail < (1 << gif_lzw_max_code_size)) {
CVE-2024-21505: Insufficient Information (NVD-CWE-noinfo)
value: Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive merge.An attacker can manipulate an object's prototype, potentially leading to the alteration of the behavior of all objects inheriting from the affected prototype by passing specially crafted input to these functions.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-25T05:15Z
Repository: https://github.com/web3/web3.js
Language: TypeScript
Files changed: packages/web3-utils/src/index.ts, packages/web3-utils/src/objects.ts
Commit date: 2024-03-05 10:36:27 -0500
Commit message: Research (#6841)

* add nopp

* fix

* custom fix

* add space

* fix

* fix
Diff: diff --git a/packages/web3-utils/src/index.ts b/packages/web3-utils/src/index.ts
index e5f467ec..23eb49dd 100644
--- a/packages/web3-utils/src/index.ts
+++ b/packages/web3-utils/src/index.ts
@@ -31,6 +31,6 @@ export * from './chunk_response_parser.js';
 export * from './uuid.js';
 export * from './web3_eip1193_provider.js';
 export * from './socket_provider.js';
 export * from './uint8array.js';
 // for backwards compatibility with v1
-export {AbiItem} from 'web3-types';
\ No newline at end of file
+export { AbiItem } from 'web3-types';
diff --git a/packages/web3-utils/src/objects.ts b/packages/web3-utils/src/objects.ts
index 4ed6c328..6417465e 100644
--- a/packages/web3-utils/src/objects.ts
+++ b/packages/web3-utils/src/objects.ts
@@ -34,11 +34,11 @@ const isIterable = (item: unknown): item is Record<string, unknown> =>
  */
 export const mergeDeep = (
 	destination: Record<string, unknown>,
 	...sources: Record<string, unknown>[]
 ): Record<string, unknown> => {
-	const result = destination; // clone deep here
+	const result = { ...destination }; // clone deep here
 	if (!isIterable(result)) {
 		return result;
 	}
 	for (const src of sources) {
 		// eslint-disable-next-line no-restricted-syntax

Vulnerable code: export {AbiItem} from 'web3-types';
	const result = destination; // clone deep here
Fixed code: export { AbiItem } from 'web3-types';
	const result = { ...destination }; // clone deep here
CVE-2022-24785: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2022-04-04T17:15Z
Repository: https://github.com/moment/moment
Language: JavaScript
Files changed: src/lib/locale/locales.js
Commit date: 2022-03-27 15:28:21 +0300
Commit message: [bugfix] Avoid loading path-looking locales from fs

Diff: diff --git a/src/lib/locale/locales.js b/src/lib/locale/locales.js
index 0d082327..b329b83b 100644
--- a/src/lib/locale/locales.js
+++ b/src/lib/locale/locales.js
@@ -60,19 +60,25 @@ function chooseLocale(names) {
         i++;
     }
     return globalLocale;
 }
 
+function isLocaleNameSane(name) {
+    // Prevent names that look like filesystem paths, i.e contain '/' or '\'
+    return name.match('^[^/\\\\]*$') != null;
+}
+
 function loadLocale(name) {
     var oldLocale = null,
         aliasedRequire;
     // TODO: Find a better way to register and load all the locales in Node
     if (
         locales[name] === undefined &&
         typeof module !== 'undefined' &&
         module &&
-        module.exports
+        module.exports &&
+        isLocaleNameSane(name)
     ) {
         try {
             oldLocale = globalLocale._abbr;
             aliasedRequire = require;
             aliasedRequire('./locale/' + name);

Vulnerable code:         module.exports
Fixed code: function isLocaleNameSane(name) {
    // Prevent names that look like filesystem paths, i.e contain '/' or '\'
    return name.match('^[^/\\\\]*$') != null;
}

        module.exports &&
        isLocaleNameSane(name)
CVE-2022-24785: Path Traversal: 'dir/../../filename' (CWE-27)
value: Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.
CWE description: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal "../" sequences that can resolve to a location that is outside of that directory.
CVSS v3 base score: 7.5
Published: 2022-04-04T17:15Z
Repository: https://github.com/moment/moment
Language: JavaScript
Files changed: src/lib/locale/locales.js
Commit date: 2022-03-27 15:28:21 +0300
Commit message: [bugfix] Avoid loading path-looking locales from fs

Diff: diff --git a/src/lib/locale/locales.js b/src/lib/locale/locales.js
index 0d082327..b329b83b 100644
--- a/src/lib/locale/locales.js
+++ b/src/lib/locale/locales.js
@@ -60,19 +60,25 @@ function chooseLocale(names) {
         i++;
     }
     return globalLocale;
 }
 
+function isLocaleNameSane(name) {
+    // Prevent names that look like filesystem paths, i.e contain '/' or '\'
+    return name.match('^[^/\\\\]*$') != null;
+}
+
 function loadLocale(name) {
     var oldLocale = null,
         aliasedRequire;
     // TODO: Find a better way to register and load all the locales in Node
     if (
         locales[name] === undefined &&
         typeof module !== 'undefined' &&
         module &&
-        module.exports
+        module.exports &&
+        isLocaleNameSane(name)
     ) {
         try {
             oldLocale = globalLocale._abbr;
             aliasedRequire = require;
             aliasedRequire('./locale/' + name);

Vulnerable code:         module.exports
Fixed code: function isLocaleNameSane(name) {
    // Prevent names that look like filesystem paths, i.e contain '/' or '\'
    return name.match('^[^/\\\\]*$') != null;
}

        module.exports &&
        isLocaleNameSane(name)
CVE-2022-31129: Inefficient Regular Expression Complexity (CWE-1333)
value: moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2022-07-06T18:15Z
Repository: https://github.com/moment/moment
Language: JavaScript
Files changed: src/lib/create/from-string.js
Commit date: 2022-07-06 18:54:32 +0300
Commit message: [bugfix] Fix redos in preprocessRFC2822 regex (#6015)

* fix ReDoS in preprocessRFC2822 regex

Fixes: [#2936](https://github.com/moment/moment/issues/6012)

Disallow nested rfc2822 comments to prevent quadratic regex execution time (i.e each open bracket is considered at most twice).
Diff: diff --git a/src/lib/create/from-string.js b/src/lib/create/from-string.js
index 5c4d11f7..58739b9d 100644
--- a/src/lib/create/from-string.js
+++ b/src/lib/create/from-string.js
@@ -149,11 +149,11 @@ function untruncateYear(yearStr) {
 }
 
 function preprocessRFC2822(s) {
     // Remove comments and folding whitespace and replace multiple-spaces with a single space
     return s
-        .replace(/\([^)]*\)|[\n\t]/g, ' ')
+        .replace(/\([^()]*\)|[\n\t]/g, ' ')
         .replace(/(\s\s+)/g, ' ')
         .replace(/^\s\s*/, '')
         .replace(/\s\s*$/, '');
 }
 

Vulnerable code:         .replace(/\([^)]*\)|[\n\t]/g, ' ')
Fixed code:         .replace(/\([^()]*\)|[\n\t]/g, ' ')
CVE-2024-22213: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected versions users could be tricked into executing malicious code that would execute in their browser via HTML sent as a comment. It is recommended that the Nextcloud Deck is upgraded to version 1.9.5 or 1.11.2. There are no known workarounds for this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2024-01-18T20:15Z
Repository: https://github.com/nextcloud/deck
Language: Unknown
Commit date: 2023-11-17 11:38:10 +0100
Commit message: Merge pull request #5294 from nextcloud/bugfix/noid/use-text-content
CVE-2020-20276: Out-of-bounds Write (CWE-787)
value: An unauthenticated stack-based buffer overflow vulnerability in common.c's handle_PORT in uftpd FTP server versions 2.10 and earlier can be abused to cause a crash and could potentially lead to remote code execution.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2020-12-18T19:15Z
Repository: https://github.com/troglobit/uftpd
Language: C
Files changed: src/ftpcmd.c
Commit date: 2019-08-31 10:09:55 +0200
Commit message: FTP: Fix buffer overflow in PORT parser, reported by Aaron Esau

Signed-off-by: Joachim Nilsson <troglobit@gmail.com>

Diff: diff --git a/src/ftpcmd.c b/src/ftpcmd.c
index b318711..34686a4 100644
--- a/src/ftpcmd.c
+++ b/src/ftpcmd.c
@@ -439,11 +439,11 @@ static void handle_PORT(ctrl_t *ctrl, char *str)
 		ctrl->data_sd = -1;
 	}
 
 	/* Convert PORT command's argument to IP address + port */
 	sscanf(str, "%d,%d,%d,%d,%d,%d", &a, &b, &c, &d, &e, &f);
-	sprintf(addr, "%d.%d.%d.%d", a, b, c, d);
+	snprintf(addr, sizeof(addr), "%d.%d.%d.%d", a, b, c, d);
 
 	/* Check IPv4 address using inet_aton(), throw away converted result */
 	if (!inet_aton(addr, &(sin.sin_addr))) {
 		ERR(0, "Invalid address '%s' given to PORT command", addr);
 		send_msg(ctrl->sd, "500 Illegal PORT command.\r\n");

Vulnerable code: 	sprintf(addr, "%d.%d.%d.%d", a, b, c, d);
Fixed code: 	snprintf(addr, sizeof(addr), "%d.%d.%d.%d", a, b, c, d);
CVE-2020-20277: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: There are multiple unauthenticated directory traversal vulnerabilities in different FTP commands in uftpd FTP server versions 2.7 to 2.10 due to improper implementation of a chroot jail in common.c's compose_abspath function that can be abused to read or write to arbitrary files on the filesystem, leak process memory, or potentially lead to remote code execution.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.8
Published: 2020-12-18T19:15Z
Repository: https://github.com/troglobit/uftpd
Language: C
Files changed: src/common.c
Commit date: 2019-08-31 10:10:03 +0200
Commit message: FTP/TFTP: Fix directory traversal regression, reported by Aaron Esau

Signed-off-by: Joachim Nilsson <troglobit@gmail.com>

Diff: diff --git a/src/common.c b/src/common.c
index 234d5ec..8e30772 100644
--- a/src/common.c
+++ b/src/common.c
@@ -90,11 +90,11 @@ check:
 		if (rpath[1] != 0)
 			strlcat(rpath, "/", sizeof(rpath));
 		strlcat(rpath, name, sizeof(rpath));
 	}
 
-	if (!chrooted && strncmp(dir, home, strlen(home))) {
+	if (!chrooted && strncmp(rpath, home, strlen(home))) {
 		DBG("Failed non-chroot dir:%s vs home:%s", dir, home);
 		return NULL;
 	}
 
 	return rpath;

Vulnerable code: 	if (!chrooted && strncmp(dir, home, strlen(home))) {
Fixed code: 	if (!chrooted && strncmp(rpath, home, strlen(home))) {
CVE-2020-5204: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: In uftpd before 2.11, there is a buffer overflow vulnerability in handle_PORT in ftpcmd.c that is caused by a buffer that is 16 bytes large being filled via sprintf() with user input based on the format specifier string %d.%d.%d.%d. The 16 byte size is correct for valid IPv4 addresses (len(&#39;255.255.255.255&#39;) == 16), but the format specifier %d allows more than 3 digits. This has been fixed in version 2.11
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 8.8
Published: 2020-01-06T20:15Z
Repository: https://github.com/troglobit/uftpd
Language: C
Files changed: src/ftpcmd.c
Commit date: 2019-08-31 10:09:55 +0200
Commit message: FTP: Fix buffer overflow in PORT parser, reported by Aaron Esau

Signed-off-by: Joachim Nilsson <troglobit@gmail.com>

Diff: diff --git a/src/ftpcmd.c b/src/ftpcmd.c
index b318711..34686a4 100644
--- a/src/ftpcmd.c
+++ b/src/ftpcmd.c
@@ -439,11 +439,11 @@ static void handle_PORT(ctrl_t *ctrl, char *str)
 		ctrl->data_sd = -1;
 	}
 
 	/* Convert PORT command's argument to IP address + port */
 	sscanf(str, "%d,%d,%d,%d,%d,%d", &a, &b, &c, &d, &e, &f);
-	sprintf(addr, "%d.%d.%d.%d", a, b, c, d);
+	snprintf(addr, sizeof(addr), "%d.%d.%d.%d", a, b, c, d);
 
 	/* Check IPv4 address using inet_aton(), throw away converted result */
 	if (!inet_aton(addr, &(sin.sin_addr))) {
 		ERR(0, "Invalid address '%s' given to PORT command", addr);
 		send_msg(ctrl->sd, "500 Illegal PORT command.\r\n");

Vulnerable code: 	sprintf(addr, "%d.%d.%d.%d", a, b, c, d);
Fixed code: 	snprintf(addr, sizeof(addr), "%d.%d.%d.%d", a, b, c, d);
CVE-2020-5221: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: In uftpd before 2.11, it is possible for an unauthenticated user to perform a directory traversal attack using multiple different FTP commands and read and write to arbitrary locations on the filesystem due to the lack of a well-written chroot jail in compose_abspath(). This has been fixed in version 2.11
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.2
Published: 2020-01-22T19:15Z
Repository: https://github.com/troglobit/uftpd
Language: C
Files changed: src/common.c
Commit date: 2019-08-31 10:10:03 +0200
Commit message: FTP/TFTP: Fix directory traversal regression, reported by Aaron Esau

Signed-off-by: Joachim Nilsson <troglobit@gmail.com>

Diff: diff --git a/src/common.c b/src/common.c
index 234d5ec..8e30772 100644
--- a/src/common.c
+++ b/src/common.c
@@ -90,11 +90,11 @@ check:
 		if (rpath[1] != 0)
 			strlcat(rpath, "/", sizeof(rpath));
 		strlcat(rpath, name, sizeof(rpath));
 	}
 
-	if (!chrooted && strncmp(dir, home, strlen(home))) {
+	if (!chrooted && strncmp(rpath, home, strlen(home))) {
 		DBG("Failed non-chroot dir:%s vs home:%s", dir, home);
 		return NULL;
 	}
 
 	return rpath;

Vulnerable code: 	if (!chrooted && strncmp(dir, home, strlen(home))) {
Fixed code: 	if (!chrooted && strncmp(rpath, home, strlen(home))) {
CVE-2018-20760: Out-of-bounds Write (CWE-787)
value: In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because a certain -1 return value is mishandled.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2019-02-06T23:29Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/media_tools/text_import.c
Commit date: 2018-12-13 14:39:21 +0100
Commit message: check error code on call to gf_utf8_wcstombs (#1177)

Diff: diff --git a/src/media_tools/text_import.c b/src/media_tools/text_import.c
index bfba2f3bc..18f10f33d 100644
--- a/src/media_tools/text_import.c
+++ b/src/media_tools/text_import.c
@@ -267,10 +267,12 @@ char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicod
 			i+=2;
 		}
 	}
 	sptr = (u16 *)szLine;
 	i = (u32) gf_utf8_wcstombs(szLineConv, 1024, (const unsigned short **) &sptr);
+	if (i >= (u32)ARRAY_LENGTH(szLineConv))
+		return NULL;
 	szLineConv[i] = 0;
 	strcpy(szLine, szLineConv);
 	/*this is ugly indeed: since input is UTF16-LE, there are many chances the fgets never reads the \0 after a \n*/
 	if (unicode_type==3) fgetc(txt_in);
 	return sOK;

Fixed code: 	if (i >= (u32)ARRAY_LENGTH(szLineConv))
		return NULL;
CVE-2018-21017: Missing Release of Memory after Effective Lifetime (CWE-401)
value: GPAC 0.7.1 has a memory leak in dinf_Read in isomedia/box_code_base.c.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 6.5
Published: 2019-09-16T13:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/box_code_base.c
Commit date: 2019-04-11 12:58:25 +0200
Commit message: prevent dref memleak on invalid input (#1183)

Diff: diff --git a/src/isomedia/box_code_base.c b/src/isomedia/box_code_base.c
index 3fc597388f..667b57d078 100644
--- a/src/isomedia/box_code_base.c
+++ b/src/isomedia/box_code_base.c
@@ -929,12 +929,15 @@ GF_Err dinf_Read(GF_Box *s, GF_BitStream *bs)
 	GF_Err e = gf_isom_box_array_read(s, bs, dinf_AddBox);
 	if (e) {
 		return e;
 	}
 	if (!((GF_DataInformationBox *)s)->dref) {
+		GF_Box* dref;
 		GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[iso file] Missing dref box in dinf\n"));
-		((GF_DataInformationBox *)s)->dref = (GF_DataReferenceBox *)gf_isom_box_new(GF_ISOM_BOX_TYPE_DREF);
+		dref = gf_isom_box_new(GF_ISOM_BOX_TYPE_DREF);
+		((GF_DataInformationBox *)s)->dref = (GF_DataReferenceBox *)dref;
+		gf_isom_box_add_for_dump_mode(s, dref);
 	}
 	return GF_OK;
 }
 
 GF_Box *dinf_New()

Vulnerable code: 		((GF_DataInformationBox *)s)->dref = (GF_DataReferenceBox *)gf_isom_box_new(GF_ISOM_BOX_TYPE_DREF);
Fixed code: 		GF_Box* dref;
		dref = gf_isom_box_new(GF_ISOM_BOX_TYPE_DREF);
		((GF_DataInformationBox *)s)->dref = (GF_DataReferenceBox *)dref;
		gf_isom_box_add_for_dump_mode(s, dref);
CVE-2019-11222: Out-of-bounds Write (CWE-787)
value: gf_bin128_parse in utils/os_divers.c in GPAC 0.7.1 has a buffer overflow issue for the crypt feature when encountering a crafted_drm_file.xml file.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2019-04-15T12:31Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/utils/os_divers.c
Commit date: 2019-04-11 15:24:52 +0200
Commit message: fix buffer overrun in gf_bin128_parse

closes #1204
closes #1205

Diff: diff --git a/src/utils/os_divers.c b/src/utils/os_divers.c
index fef591ef6f..a1e0328e75 100644
--- a/src/utils/os_divers.c
+++ b/src/utils/os_divers.c
@@ -1986,12 +1986,18 @@ GF_Err gf_bin128_parse(const char *string, bin128 value)
 				j++;
 			if (!string[j])
 				break;
 			sprintf(szV, "%c%c", string[j], string[j+1]);
 			sscanf(szV, "%x", &v);
+			if (i > 15) {
+				// force error check below
+				i++;
+				break;
+			}
 			value[i] = v;
 			i++;
+
 		}
 	}
 	if (i != 16) {
 		GF_LOG(GF_LOG_ERROR, GF_LOG_CORE, ("[CORE] 128bit blob is not 16-bytes long: %s\n", string));
 		return GF_BAD_PARAM;

Fixed code: 			if (i > 15) {
				// force error check below
				i++;
				break;
			}
CVE-2019-20628: Use After Free (CWE-416)
value: An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box. It contains a Use-After-Free vulnerability in gf_m2ts_process_pmt in media_tools/mpegts.c that can cause a denial of service via a crafted MP4 file.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 5.5
Published: 2020-03-24T19:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/media_tools/mpegts.c
Commit date: 2019-07-07 17:56:28 +0200
Commit message: be stricter in PAT processing - cf #1269

Diff: diff --git a/src/media_tools/mpegts.c b/src/media_tools/mpegts.c
index 30c6747eeb..bbcd8a14fe 100644
--- a/src/media_tools/mpegts.c
+++ b/src/media_tools/mpegts.c
@@ -1665,11 +1665,13 @@ static void gf_m2ts_process_pat(GF_M2TS_Demuxer *ts, GF_M2TS_SECTION_ES *ses, GF
 		data += 4;
 		if (number==0) {
 			if (!ts->nit) {
 				ts->nit = gf_m2ts_section_filter_new(gf_m2ts_process_nit, 0);
 			}
-		} else {
+		} else if (!pid) {
+			GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("Broken PAT found reserved PID 0, ignoring\n", pid));
+		} else if (! ts->ess[pid]) {
 			GF_SAFEALLOC(prog, GF_M2TS_Program);
 			if (!prog) {
 				GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("Fail to allocate program for pid %d\n", pid));
 				return;
 			}

Vulnerable code: 		} else {
Fixed code: 		} else if (!pid) {
			GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("Broken PAT found reserved PID 0, ignoring\n", pid));
		} else if (! ts->ess[pid]) {
CVE-2019-20629: Out-of-bounds Read (CWE-125)
value: An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer over-read in gf_m2ts_process_pmt in media_tools/mpegts.c that can cause a denial of service via a crafted MP4 file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2020-03-24T19:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/media_tools/mpegts.c
Commit date: 2019-07-07 17:56:28 +0200
Commit message: fixed potential crash in TS - cf #1264

Diff: diff --git a/src/media_tools/mpegts.c b/src/media_tools/mpegts.c
index eadc904c59..ef709fb124 100644
--- a/src/media_tools/mpegts.c
+++ b/src/media_tools/mpegts.c
@@ -1523,18 +1523,18 @@ static void gf_m2ts_process_pmt(GF_M2TS_Demuxer *ts, GF_M2TS_SECTION_ES *pmt, GF
 			ts->ess[es->pid] = es;
 			gf_list_add(pmt->program->streams, es);
 			if (!(es->flags & GF_M2TS_ES_IS_SECTION) ) gf_m2ts_set_pes_framing(pes, GF_M2TS_PES_FRAMING_SKIP);
 
 			nb_es++;
-		}
 
-		if (es->stream_type == GF_M2TS_VIDEO_HEVC) nb_hevc++;
-		else if (es->stream_type == GF_M2TS_VIDEO_HEVC_TEMPORAL) nb_hevc_temp++;
-		else if (es->stream_type == GF_M2TS_VIDEO_SHVC) nb_shvc++;
-		else if (es->stream_type == GF_M2TS_VIDEO_SHVC_TEMPORAL) nb_shvc_temp++;
-		else if (es->stream_type == GF_M2TS_VIDEO_MHVC) nb_mhvc++;
-		else if (es->stream_type == GF_M2TS_VIDEO_MHVC_TEMPORAL) nb_mhvc_temp++;
+			if (es->stream_type == GF_M2TS_VIDEO_HEVC) nb_hevc++;
+			else if (es->stream_type == GF_M2TS_VIDEO_HEVC_TEMPORAL) nb_hevc_temp++;
+			else if (es->stream_type == GF_M2TS_VIDEO_SHVC) nb_shvc++;
+			else if (es->stream_type == GF_M2TS_VIDEO_SHVC_TEMPORAL) nb_shvc_temp++;
+			else if (es->stream_type == GF_M2TS_VIDEO_MHVC) nb_mhvc++;
+			else if (es->stream_type == GF_M2TS_VIDEO_MHVC_TEMPORAL) nb_mhvc_temp++;
+		}
 	}
 
 	//Table 2-139, implied hierarchy indexes
 	if (nb_hevc_temp + nb_shvc + nb_shvc_temp + nb_mhvc+ nb_mhvc_temp) {
 		for (i=0; i<gf_list_count(pmt->program->streams); i++) {

Vulnerable code: 		}
		if (es->stream_type == GF_M2TS_VIDEO_HEVC) nb_hevc++;
		else if (es->stream_type == GF_M2TS_VIDEO_HEVC_TEMPORAL) nb_hevc_temp++;
		else if (es->stream_type == GF_M2TS_VIDEO_SHVC) nb_shvc++;
		else if (es->stream_type == GF_M2TS_VIDEO_SHVC_TEMPORAL) nb_shvc_temp++;
		else if (es->stream_type == GF_M2TS_VIDEO_MHVC) nb_mhvc++;
		else if (es->stream_type == GF_M2TS_VIDEO_MHVC_TEMPORAL) nb_mhvc_temp++;
Fixed code: 			if (es->stream_type == GF_M2TS_VIDEO_HEVC) nb_hevc++;
			else if (es->stream_type == GF_M2TS_VIDEO_HEVC_TEMPORAL) nb_hevc_temp++;
			else if (es->stream_type == GF_M2TS_VIDEO_SHVC) nb_shvc++;
			else if (es->stream_type == GF_M2TS_VIDEO_SHVC_TEMPORAL) nb_shvc_temp++;
			else if (es->stream_type == GF_M2TS_VIDEO_MHVC) nb_mhvc++;
			else if (es->stream_type == GF_M2TS_VIDEO_MHVC_TEMPORAL) nb_mhvc_temp++;
		}
CVE-2020-11558: Use After Free (CWE-416)
value: An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. audio_sample_entry_Read in isomedia/box_code_base.c does not properly decide when to make gf_isom_box_del calls. This leads to various use-after-free outcomes involving mdia_Read, gf_isom_delete_movie, and gf_isom_parse_movie_boxes.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 9.8
Published: 2020-04-05T20:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/box_code_base.c
Commit date: 2020-03-26 19:17:07 +0100
Commit message: fix UAF in audio_sample_entry_Read (#1440)

Diff: diff --git a/src/isomedia/box_code_base.c b/src/isomedia/box_code_base.c
index 6f0347fb93..534d3b4036 100644
--- a/src/isomedia/box_code_base.c
+++ b/src/isomedia/box_code_base.c
@@ -4067,13 +4067,14 @@ GF_Err audio_sample_entry_Read(GF_Box *s, GF_BitStream *bs)
 	gf_bs_seek(bs, pos);
 	data = (char*)gf_malloc(sizeof(char) * size);
 	gf_bs_read_data(bs, data, size);
 	for (i=0; i<size-8; i++) {
 		if (GF_4CC((u32)data[i+4], (u8)data[i+5], (u8)data[i+6], (u8)data[i+7]) == GF_ISOM_BOX_TYPE_ESDS) {
+			extern Bool use_dump_mode;
 			GF_BitStream *mybs = gf_bs_new(data + i, size - i, GF_BITSTREAM_READ);
 			if (ptr->esd) {
-				gf_isom_box_del((GF_Box *)ptr->esd);
+				if (!use_dump_mode) gf_isom_box_del((GF_Box *)ptr->esd);
 				ptr->esd=NULL;
 			}
 
 			e = gf_isom_box_parse((GF_Box **)&ptr->esd, mybs);
 

Vulnerable code: 				gf_isom_box_del((GF_Box *)ptr->esd);
Fixed code: 			extern Bool use_dump_mode;
				if (!use_dump_mode) gf_isom_box_del((GF_Box *)ptr->esd);
CVE-2020-19481: Out-of-bounds Read (CWE-125)
value: An issue was discovered in GPAC before 0.8.0, as demonstrated by MP4Box. It contains an invalid memory read in gf_m2ts_process_pmt in media_tools/mpegts.c that can cause a denial of service via a crafted MP4 file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2021-07-21T18:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/media_tools/mpegts.c
Commit date: 2019-07-07 17:56:28 +0200
Commit message: fixed potential crash in TS - cf #1264

Diff: diff --git a/src/media_tools/mpegts.c b/src/media_tools/mpegts.c
index eadc904c59..ef709fb124 100644
--- a/src/media_tools/mpegts.c
+++ b/src/media_tools/mpegts.c
@@ -1523,18 +1523,18 @@ static void gf_m2ts_process_pmt(GF_M2TS_Demuxer *ts, GF_M2TS_SECTION_ES *pmt, GF
 			ts->ess[es->pid] = es;
 			gf_list_add(pmt->program->streams, es);
 			if (!(es->flags & GF_M2TS_ES_IS_SECTION) ) gf_m2ts_set_pes_framing(pes, GF_M2TS_PES_FRAMING_SKIP);
 
 			nb_es++;
-		}
 
-		if (es->stream_type == GF_M2TS_VIDEO_HEVC) nb_hevc++;
-		else if (es->stream_type == GF_M2TS_VIDEO_HEVC_TEMPORAL) nb_hevc_temp++;
-		else if (es->stream_type == GF_M2TS_VIDEO_SHVC) nb_shvc++;
-		else if (es->stream_type == GF_M2TS_VIDEO_SHVC_TEMPORAL) nb_shvc_temp++;
-		else if (es->stream_type == GF_M2TS_VIDEO_MHVC) nb_mhvc++;
-		else if (es->stream_type == GF_M2TS_VIDEO_MHVC_TEMPORAL) nb_mhvc_temp++;
+			if (es->stream_type == GF_M2TS_VIDEO_HEVC) nb_hevc++;
+			else if (es->stream_type == GF_M2TS_VIDEO_HEVC_TEMPORAL) nb_hevc_temp++;
+			else if (es->stream_type == GF_M2TS_VIDEO_SHVC) nb_shvc++;
+			else if (es->stream_type == GF_M2TS_VIDEO_SHVC_TEMPORAL) nb_shvc_temp++;
+			else if (es->stream_type == GF_M2TS_VIDEO_MHVC) nb_mhvc++;
+			else if (es->stream_type == GF_M2TS_VIDEO_MHVC_TEMPORAL) nb_mhvc_temp++;
+		}
 	}
 
 	//Table 2-139, implied hierarchy indexes
 	if (nb_hevc_temp + nb_shvc + nb_shvc_temp + nb_mhvc+ nb_mhvc_temp) {
 		for (i=0; i<gf_list_count(pmt->program->streams); i++) {

Vulnerable code: 		}
		if (es->stream_type == GF_M2TS_VIDEO_HEVC) nb_hevc++;
		else if (es->stream_type == GF_M2TS_VIDEO_HEVC_TEMPORAL) nb_hevc_temp++;
		else if (es->stream_type == GF_M2TS_VIDEO_SHVC) nb_shvc++;
		else if (es->stream_type == GF_M2TS_VIDEO_SHVC_TEMPORAL) nb_shvc_temp++;
		else if (es->stream_type == GF_M2TS_VIDEO_MHVC) nb_mhvc++;
		else if (es->stream_type == GF_M2TS_VIDEO_MHVC_TEMPORAL) nb_mhvc_temp++;
Fixed code: 			if (es->stream_type == GF_M2TS_VIDEO_HEVC) nb_hevc++;
			else if (es->stream_type == GF_M2TS_VIDEO_HEVC_TEMPORAL) nb_hevc_temp++;
			else if (es->stream_type == GF_M2TS_VIDEO_SHVC) nb_shvc++;
			else if (es->stream_type == GF_M2TS_VIDEO_SHVC_TEMPORAL) nb_shvc_temp++;
			else if (es->stream_type == GF_M2TS_VIDEO_MHVC) nb_mhvc++;
			else if (es->stream_type == GF_M2TS_VIDEO_MHVC_TEMPORAL) nb_mhvc_temp++;
		}
CVE-2020-19488: NULL Pointer Dereference (CWE-476)
value: An issue was discovered in box_code_apple.c:119 in Gpac MP4Box 0.8.0, allows attackers to cause a Denial of Service due to an invalid read on function ilst_item_Read.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2021-07-21T18:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/box_code_apple.c
Commit date: 2019-07-07 17:56:28 +0200
Commit message: fixed potential crash - cf #1263

Diff: diff --git a/src/isomedia/box_code_apple.c b/src/isomedia/box_code_apple.c
index 8f6b08957f..00eee98cd9 100644
--- a/src/isomedia/box_code_apple.c
+++ b/src/isomedia/box_code_apple.c
@@ -110,18 +110,19 @@ GF_Err ilst_item_box_read(GF_Box *s,GF_BitStream *bs)
 	/*iTunes way: there's a data atom containing the data*/
 	sub_type = gf_bs_peek_bits(bs, 32, 4);
 	if (sub_type == GF_ISOM_BOX_TYPE_DATA ) {
 		e = gf_isom_box_parse(&a, bs);
 
-		if (!e && ptr->size < a->size) {
+		if (!e && a && (ptr->size < a->size)) {
 			GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[isom] not enough bytes in box %s: %d left, reading %d (file %s, line %d)\n", gf_4cc_to_str(ptr->type), ptr->size, a->size, __FILE__, __LINE__ )); \
 			e = GF_ISOM_INVALID_FILE;
 		}
 		if (e) {
 			if (a) gf_isom_box_del(a);
 			return e;
 		}
+		if (!a) return GF_NON_COMPLIANT_BITSTREAM;
 
 		ISOM_DECREASE_SIZE(ptr, a->size);
 
 		if (a && ptr->data) gf_isom_box_del_parent(&ptr->child_boxes, (GF_Box *) ptr->data);
 

Vulnerable code: 		if (!e && ptr->size < a->size) {
Fixed code: 		if (!e && a && (ptr->size < a->size)) {
		if (!a) return GF_NON_COMPLIANT_BITSTREAM;
CVE-2020-23928: Out-of-bounds Read (CWE-125)
value: An issue was discovered in gpac before 1.0.1. The abst_box_read function in box_code_adobe.c has a heap-based buffer over-read.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.1
Published: 2021-04-21T18:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/box_code_adobe.c
Commit date: 2020-09-01 17:10:13 +0200
Commit message: fixed #1568

Diff: diff --git a/src/isomedia/box_code_adobe.c b/src/isomedia/box_code_adobe.c
index eafdabff13..ab5115f25a 100644
--- a/src/isomedia/box_code_adobe.c
+++ b/src/isomedia/box_code_adobe.c
@@ -91,11 +91,11 @@ GF_Err abst_box_read(GF_Box *s, GF_BitStream *bs)
 	ptr->current_media_time = gf_bs_read_u64(bs);
 	ptr->smpte_time_code_offset = gf_bs_read_u64(bs);
 
 	i=0;
 	if (ptr->size<8) return GF_ISOM_INVALID_FILE;
-	tmp_strsize =(u32)ptr->size-8;
+	tmp_strsize =(u32)ptr->size;
 	tmp_str = gf_malloc(sizeof(char)*tmp_strsize);
 	if (!tmp_str) return GF_OUT_OF_MEM;
 	memset(tmp_str, 0, sizeof(char)*tmp_strsize);
 
 	while (tmp_strsize) {

Vulnerable code: 	tmp_strsize =(u32)ptr->size-8;
Fixed code: 	tmp_strsize =(u32)ptr->size;
CVE-2020-23930: NULL Pointer Dereference (CWE-476)
value: An issue was discovered in gpac through 20200801. A NULL pointer dereference exists in the function nhmldump_send_header located in write_nhml.c. It allows an attacker to cause Denial of Service.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2021-04-21T18:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: applications/mp4box/main.c, src/filters/write_nhml.c
Commit date: 2020-09-01 16:46:07 +0200
Commit message: fixed #1565

Diff: diff --git a/applications/mp4box/main.c b/applications/mp4box/main.c
index f221a46b7c..d715ed4bda 100644
--- a/applications/mp4box/main.c
+++ b/applications/mp4box/main.c
@@ -5593,11 +5593,11 @@ int mp4boxMain(int argc, char **argv)
 	if (dump_udta_type) dump_isom_udta(file, dump_std ? NULL : (outName ? outName : outfile), outName ? GF_TRUE : GF_FALSE, dump_udta_type, dump_udta_track);
 
 	if (dump_iod) {
 		GF_InitialObjectDescriptor *iod = (GF_InitialObjectDescriptor *)gf_isom_get_root_od(file);
 		if (!iod) {
-			fprintf(stderr, "File %s has no IOD", inName);
+			fprintf(stderr, "File %s has no IOD\n", inName);
 		} else {
 			char szName[GF_MAX_PATH+10];
 			FILE *iodf;
 			sprintf(szName, "%s.iod", outfile);
 			iodf = gf_fopen(szName, "wb");
diff --git a/src/filters/write_nhml.c b/src/filters/write_nhml.c
index 3828bbf0cd..6ea26cf716 100644
--- a/src/filters/write_nhml.c
+++ b/src/filters/write_nhml.c
@@ -396,11 +396,12 @@ static void nhmldump_send_header(GF_NHMLDumpCtx *ctx)
 		sprintf(nhml, "sampleRate=\"%d\" numChannels=\"%d\" ", ctx->sr, ctx->chan);
 		gf_bs_write_data(ctx->bs_w, nhml, (u32) strlen(nhml));
 		sprintf(nhml, "sampleRate=\"%d\" numChannels=\"%d\" ", ctx->sr, ctx->chan);
 		gf_bs_write_data(ctx->bs_w, nhml, (u32) strlen(nhml));
 		p = gf_filter_pid_get_property(ctx->ipid, GF_PROP_PID_AUDIO_FORMAT);
-		sprintf(nhml, "bitsPerSample=\"%d\" ", gf_audio_fmt_bit_depth(p->value.uint));
+		if (p)
+			sprintf(nhml, "bitsPerSample=\"%d\" ", gf_audio_fmt_bit_depth(p->value.uint));
 		gf_bs_write_data(ctx->bs_w, nhml, (u32) strlen(nhml));
 	}
 
 	NHML_PRINT_4CC(0, "codec_vendor", "codecVendor")
 	NHML_PRINT_UINT(0, "codec_version", "codecVersion")

Vulnerable code: 			fprintf(stderr, "File %s has no IOD", inName);
		sprintf(nhml, "bitsPerSample=\"%d\" ", gf_audio_fmt_bit_depth(p->value.uint));
Fixed code: 			fprintf(stderr, "File %s has no IOD\n", inName);
		if (p)
			sprintf(nhml, "bitsPerSample=\"%d\" ", gf_audio_fmt_bit_depth(p->value.uint));
CVE-2020-23932: NULL Pointer Dereference (CWE-476)
value: An issue was discovered in gpac before 1.0.1. A NULL pointer dereference exists in the function dump_isom_sdp located in filedump.c. It allows an attacker to cause Denial of Service.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2021-04-21T18:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: applications/mp4box/filedump.c
Commit date: 2020-09-01 17:05:02 +0200
Commit message: fixed #1566

Diff: diff --git a/applications/mp4box/filedump.c b/applications/mp4box/filedump.c
index cfca7c0b25..ee4615e388 100644
--- a/applications/mp4box/filedump.c
+++ b/applications/mp4box/filedump.c
@@ -1622,11 +1622,12 @@ void dump_isom_sdp(GF_ISOFile *file, char *inName, Bool is_final_name)
 		dump = stdout;
 		fprintf(dump, "* File SDP content *\n\n");
 	}
 	//get the movie SDP
 	gf_isom_sdp_get(file, &sdp, &size);
-	fprintf(dump, "%s", sdp);
+	if (sdp && size)
+		fprintf(dump, "%s", sdp);
 	fprintf(dump, "\r\n");
 
 	//then tracks
 	for (i=0; i<gf_isom_get_track_count(file); i++) {
 		if (gf_isom_get_media_type(file, i+1) != GF_ISOM_MEDIA_HINT) continue;

Vulnerable code: 	fprintf(dump, "%s", sdp);
Fixed code: 	if (sdp && size)
		fprintf(dump, "%s", sdp);