Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2021-25925: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: in SiCKRAGE, versions 4.2.0 to 10.0.11.dev1 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly when processed by the server. Therefore, an attacker can inject arbitrary JavaScript code inside the application, and possibly steal a user’s sensitive information.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-04-12T14:15Z
Repository: https://github.com/SiCKRAGE/SiCKRAGE
Language: Python
Files changed: requirements.txt, sickrage/core/webserver/handlers/base.py
Commit date: 2021-03-11 09:45:12 -0800
Commit message: Added bleach to requirements.txt to clean input data from HTML forms

Diff: diff --git a/requirements.txt b/requirements.txt
index fe18e978d..df97a6457 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -9,10 +9,11 @@ asn1crypto==1.4.0
 attrdict==2.0.1
 attrs==19.3.0
 babelfish==0.5.5
 beautifulsoup4==4.9.1
 bencode3==0.1.0
+bleach==3.3.0
 CacheControl==0.12.6
 certifi==2020.6.20
 cffi==1.14.1
 chardet==3.0.4
 click==7.1.2
diff --git a/sickrage/core/webserver/handlers/base.py b/sickrage/core/webserver/handlers/base.py
index 8a2ea29f1..52e634f10 100644
--- a/sickrage/core/webserver/handlers/base.py
+++ b/sickrage/core/webserver/handlers/base.py
@@ -17,21 +17,23 @@
 #  -
 #  You should have received a copy of the GNU General Public License
 #  along with SiCKRAGE.  If not, see <http://www.gnu.org/licenses/>.
 # ##############################################################################
 import functools
+import html
 import time
 import traceback
 import types
 from concurrent.futures.thread import ThreadPoolExecutor
 from typing import Optional, Awaitable
 from urllib.parse import urlparse, urljoin
 
+import bleach
 from jose import ExpiredSignatureError
 from keycloak.exceptions import KeycloakClientError
 from mako.exceptions import RichTraceback
-from tornado import locale
+from tornado import locale, escape
 from tornado.web import RequestHandler
 
 import sickrage
 from sickrage.core.helpers import is_ip_whitelisted, torrent_webui_url
 
@@ -194,5 +196,13 @@ class BaseHandler(RequestHandler):
         setattr(self, method_name, method)
 
     def options(self, *args, **kwargs):
         self.set_status(204)
         self.finish()
+
+    def get_argument(self, *args, **kwargs):
+        value = super(BaseHandler, self).get_argument(*args, **kwargs)
+
+        try:
+            return bleach.clean(value)
+        except TypeError:
+            return value

Vulnerable code: from tornado import locale
Fixed code: bleach==3.3.0
import html
import bleach
from tornado import locale, escape

    def get_argument(self, *args, **kwargs):
        value = super(BaseHandler, self).get_argument(*args, **kwargs)

        try:
            return bleach.clean(value)
        except TypeError:
            return value
CVE-2021-25926: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In SiCKRAGE, versions 9.3.54.dev1 to 10.0.11.dev1 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly in the `quicksearch` feature. Therefore, an attacker can steal a user's sessionID to masquerade as a victim user, to carry out any actions in the context of the user.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-04-12T14:15Z
Repository: https://github.com/SiCKRAGE/SiCKRAGE
Language: Python
Files changed: requirements.txt, sickrage/core/webserver/handlers/base.py
Commit date: 2021-03-11 09:45:12 -0800
Commit message: Added bleach to requirements.txt to clean input data from HTML forms

Diff: diff --git a/requirements.txt b/requirements.txt
index fe18e978d..df97a6457 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -9,10 +9,11 @@ asn1crypto==1.4.0
 attrdict==2.0.1
 attrs==19.3.0
 babelfish==0.5.5
 beautifulsoup4==4.9.1
 bencode3==0.1.0
+bleach==3.3.0
 CacheControl==0.12.6
 certifi==2020.6.20
 cffi==1.14.1
 chardet==3.0.4
 click==7.1.2
diff --git a/sickrage/core/webserver/handlers/base.py b/sickrage/core/webserver/handlers/base.py
index 8a2ea29f1..52e634f10 100644
--- a/sickrage/core/webserver/handlers/base.py
+++ b/sickrage/core/webserver/handlers/base.py
@@ -17,21 +17,23 @@
 #  -
 #  You should have received a copy of the GNU General Public License
 #  along with SiCKRAGE.  If not, see <http://www.gnu.org/licenses/>.
 # ##############################################################################
 import functools
+import html
 import time
 import traceback
 import types
 from concurrent.futures.thread import ThreadPoolExecutor
 from typing import Optional, Awaitable
 from urllib.parse import urlparse, urljoin
 
+import bleach
 from jose import ExpiredSignatureError
 from keycloak.exceptions import KeycloakClientError
 from mako.exceptions import RichTraceback
-from tornado import locale
+from tornado import locale, escape
 from tornado.web import RequestHandler
 
 import sickrage
 from sickrage.core.helpers import is_ip_whitelisted, torrent_webui_url
 
@@ -194,5 +196,13 @@ class BaseHandler(RequestHandler):
         setattr(self, method_name, method)
 
     def options(self, *args, **kwargs):
         self.set_status(204)
         self.finish()
+
+    def get_argument(self, *args, **kwargs):
+        value = super(BaseHandler, self).get_argument(*args, **kwargs)
+
+        try:
+            return bleach.clean(value)
+        except TypeError:
+            return value

Vulnerable code: from tornado import locale
Fixed code: bleach==3.3.0
import html
import bleach
from tornado import locale, escape

    def get_argument(self, *args, **kwargs):
        value = super(BaseHandler, self).get_argument(*args, **kwargs)

        try:
            return bleach.clean(value)
        except TypeError:
            return value
CVE-2021-32645: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: Tenancy multi-tenant is an open source multi-domain controller for the Laravel web framework. In some situations, it is possible to have open redirects where users can be redirected from your site to any other site using a specially crafted URL. This is only the case for installations where the default Hostname Identification is used and the environment uses tenants that have `force_https` set to `true` (default: `false`). Version 5.7.2 contains the relevant patches to fix this bug. Stripping the URL from special characters to prevent specially crafted URL's from being redirected to. As a work around users can set the `force_https` to every tenant to `false`, however this may degrade connection security.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2021-05-27T17:15Z
Repository: https://github.com/tenancy/multi-tenant
Language: PHP
Files changed: src/Middleware/HostnameActions.php
Commit date: 2021-05-27 12:40:08 +0800
Commit message: Trim slashes from request uri before redirecting (#1001)


Diff: diff --git a/src/Middleware/HostnameActions.php b/src/Middleware/HostnameActions.php
index de5e033..6578ec9 100644
--- a/src/Middleware/HostnameActions.php
+++ b/src/Middleware/HostnameActions.php
@@ -93,11 +93,11 @@ class HostnameActions
      */
     protected function secure(Hostname $hostname, Request $request)
     {
         $this->emitEvent(new Secured($hostname));
 
-        return $this->redirect->secure($request->getRequestUri());
+        return $this->redirect->secure(ltrim($request->getRequestUri(), '/'));
     }
 
     /**
      * @param Hostname $hostname
      */

Vulnerable code:         return $this->redirect->secure($request->getRequestUri());
Fixed code:         return $this->redirect->secure(ltrim($request->getRequestUri(), '/'));
CVE-2022-3224: Misinterpretation of Input (CWE-115)
value: Misinterpretation of Input in GitHub repository ionicabizau/parse-url prior to 8.1.0.
CWE description: The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.
CVSS v3 base score: 6.1
Published: 2022-09-15T12:15Z
Repository: https://github.com/ionicabizau/parse-url
Language: JSON
Files changed: package.json
Commit date: 2022-08-30 15:45:28 +0300
Commit message: :arrow_up: 8.1.0 :tada:

Diff: diff --git a/package.json b/package.json
index 15a998b..7a00ed5 100644
--- a/package.json
+++ b/package.json
@@ -1,8 +1,8 @@
 {
   "name": "parse-url",
-  "version": "8.0.0",
+  "version": "8.1.0",
   "description": "An advanced url parser supporting git urls too.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
   "types": "./index.d.ts",
   "exports": {
@@ -62,6 +62,6 @@
   "blah": {
     "description": [
       "For low-level path parsing, check out [`parse-path`](https://github.com/IonicaBizau/parse-path). This very module is designed to parse urls. By default the urls are normalized."
     ]
   }
-}
+}
\ No newline at end of file

Vulnerable code:   "version": "8.0.0",
}
Fixed code:   "version": "8.1.0",
}
CVE-2021-32817: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: express-hbs is an Express handlebars template engine. express-hbs mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability is somewhat restricted in that only files with existing extentions (i.e. file.extension) can be included, files that lack an extension will have .hbs appended to them. For complete details refer to the referenced GHSL-2021-019 report. Notes in documentation have been added to help users of express-hbs avoid this potential information exposure vulnerability.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 6.8
Published: 2021-05-14T19:15Z
Repository: https://github.com/TryGhost/express-hbs
Language: Markdown
Files changed: README.md
Commit date: 2021-04-22 13:09:28 +0100
Commit message: 🔒 Added notes on a potential security vulnerability

- Express.js never intended for template options to be passed via res.render
- If you use res.render to pass a layout, the file will be read from disk
- If you pass user-submitted data as options to res.render e.g. using req.query, then user-submitted file paths will be read
- This is only a potential security vulnerability, depending on the implementation
- Further fixes will be pushed to express-hbs to disable this behaviour by default

Diff: diff --git a/README.md b/README.md
index d358adb..89d2b95 100644
--- a/README.md
+++ b/README.md
@@ -97,10 +97,14 @@ There are three ways to use a layout, listed in precedence order
         Else
             LAYOUT from path.resolve(dirname(template), LAYOUT)
 
 2.  As an option to render
 
+    ## ⚠️ This creates a potential security vulnerability:
+
+    Do not use this option in conjunction with passing user submitted data to res.render e.g. `res.render('index', req.query)`. This allows users to read arbitrary files from your filesystem!
+
     ```js
     res.render('veggies', {
       title: 'My favorite veggies',
       veggies: veggies,
       layout: 'layout/veggie'

Fixed code:     ## ⚠️ This creates a potential security vulnerability:

    Do not use this option in conjunction with passing user submitted data to res.render e.g. `res.render('index', req.query)`. This allows users to read arbitrary files from your filesystem!
CVE-2017-6800: Out-of-bounds Read (CWE-125)
value: An issue was discovered in ytnef before 1.9.2. An invalid memory access (heap-based buffer over-read) can occur during handling of LONG data types, related to MAPIPrint() in libytnef.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2017-03-10T10:59Z
Repository: https://github.com/Yeraze/ytnef
Language: C
Files changed: lib/ytnef.c
Commit date: 2017-02-23 14:26:49 -0500
Commit message: BugFix - data length

Even tho this is a "LONG" type, it's actually only 4 bytes. Typecasting
it to a long* caused a dereference beyond the end of the allocated
region.

issues#28

Diff: diff --git a/lib/ytnef.c b/lib/ytnef.c
index c11c77c..afb2efb 100644
--- a/lib/ytnef.c
+++ b/lib/ytnef.c
@@ -1388,11 +1388,11 @@ void MAPIPrint(MAPIProps *p) {
             printf(" %02x", (BYTE)mapidata->data[x]);
           }
           printf("] (%llu)\n", ddword_tmp);
           break;
         case PT_LONG:
-          printf("    Value: %li\n", *((long*)mapidata->data));
+          printf("    Value: %i\n", *((int*)mapidata->data));
           break;
         case PT_I2:
           printf("    Value: %hi\n", *((short int*)mapidata->data));
           break;
         case PT_BOOLEAN:

Vulnerable code:           printf("    Value: %li\n", *((long*)mapidata->data));
Fixed code:           printf("    Value: %i\n", *((int*)mapidata->data));
CVE-2017-6801: Out-of-bounds Read (CWE-125)
value: An issue was discovered in ytnef before 1.9.2. There is a potential out-of-bounds access with fields of Size 0 in TNEFParse() in libytnef.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2017-03-10T10:59Z
Repository: https://github.com/Yeraze/ytnef
Language: C
Files changed: lib/ytnef.c, test-data/test.sh
Commit date: 2017-02-24 16:08:02 -0500
Commit message: BugFix - Potential OOB with Fields of Size 0

Thanks to @hannob for contributing a malformed TNEF stream with
a Version field of size 0.  Now such files will return an error
indicating invalid data.

Diff: diff --git a/lib/ytnef.c b/lib/ytnef.c
index afb2efb..eea43b7 100644
--- a/lib/ytnef.c
+++ b/lib/ytnef.c
@@ -1145,10 +1145,14 @@ int TNEFParse(TNEFStruct *TNEF) {
   DEBUG(TNEF->Debug, 2, "Starting Full Processing.");
 
   while (TNEFGetHeader(TNEF, &type, &size) == 0) {
     DEBUG2(TNEF->Debug, 2, "Header says type=0x%X, size=%u", type, size);
     DEBUG2(TNEF->Debug, 2, "Header says type=%u, size=%u", type, size);
+    if(size == 0) {
+      printf("ERROR: Field with size of 0\n");
+      return YTNEF_ERROR_READING_DATA;
+    }
     data = calloc(size, sizeof(BYTE));
     ALLOCCHECK(data);
     if (TNEFRawRead(TNEF, data, size, &header_checksum) < 0) {
       printf("ERROR: Unable to read data.\n");
       if (TNEF->IO.CloseProc != NULL) {
diff --git a/test-data/test.sh b/test-data/test.sh
index 7e2e541..81037e4 100755
--- a/test-data/test.sh
+++ b/test-data/test.sh
@@ -19,5 +19,7 @@ diff results data
 ../ytnefprint/ytnefprint ./winmail.dat  | grep -A 1 PR_MESSAGE_DELIVERY_TIME | grep "Tuesday June 17, 2003 3:23:00 pm"
 ../ytnefprint/ytnefprint ./winmail.dat  | grep -A 1 PR_TNEF_CORRELATION_KEY  | grep "[00000000CFF233DD7623274EB78A4912C247A0E464532700.]"
 ../ytnefprint/ytnefprint ./winmail.dat  | grep -A 1 PR_RTF_SYNC_BODY_CRC     | grep 872404792
 ../ytnefprint/ytnefprint ./winmail.dat  | grep -A 1 PR_RTF_SYNC_BODY_COUNT   | grep 90
 ../ytnefprint/ytnefprint ./winmail.dat  | grep -A 18 PR_RTF_COMPRESSED       | grep '\pard Casdasdfasdfasd\\par'
+
+../ytnefprint/ytnefprint ./ytnef-oob-TNEFVersion-SwapWord | grep 'ERROR: Field with size of 0'
diff --git a/test-data/ytnef-oob-TNEFVersion-SwapWord b/test-data/ytnef-oob-TNEFVersion-SwapWord
new file mode 100644
index 0000000..4ee03bc
Binary files /dev/null and b/test-data/ytnef-oob-TNEFVersion-SwapWord differ

Fixed code:     if(size == 0) {
      printf("ERROR: Field with size of 0\n");
      return YTNEF_ERROR_READING_DATA;
    }

../ytnefprint/ytnefprint ./ytnef-oob-TNEFVersion-SwapWord | grep 'ERROR: Field with size of 0'
CVE-2017-6802: Out-of-bounds Read (CWE-125)
value: An issue was discovered in ytnef before 1.9.2. There is a potential heap-based buffer over-read on incoming Compressed RTF Streams, related to DecompressRTF() in libytnef.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2017-03-10T10:59Z
Repository: https://github.com/Yeraze/ytnef
Language: Other
Files changed: ChangeLog, lib/ytnef.c
Commit date: 2017-02-25 07:41:45 -0500
Commit message: Added safety check for Compressed RTF Streams

You could potentially overflow the input pointer.

in response to #34

Diff: diff --git a/ChangeLog b/ChangeLog
index bbe88de..e94c97b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,10 +1,11 @@
 v1.9.2 - February 23, 2017 
 
 Thanks to @hannob for finding some Out-of-bound exceptions in memory handline.
 * [SECURITY] An invalid memory access (heap overrun) in handling LONG datatypes
 * [SECURITY] Missing a check for fields of size 0
+* [SECURITY] Potential buffer overrun on incoming Compressed RTF Streams
 
 This version  & the previous 1.9.1 resolves the following CVEs:
 * CVE-2017-6306
 * CVE-2017-6305
 * CVE-2017-6304
diff --git a/lib/ytnef.c b/lib/ytnef.c
index eea43b7..548fcfa 100644
--- a/lib/ytnef.c
+++ b/lib/ytnef.c
@@ -1539,11 +1539,11 @@ BYTE *DecompressRTF(variableLength *p, int *size) {
     }
     dst = calloc(comp_Prebuf.size + uncompressedSize, 1);
     ALLOCCHECK_CHAR(dst);
     memcpy(dst, comp_Prebuf.data, comp_Prebuf.size);
     out = comp_Prebuf.size;
-    while (out < (comp_Prebuf.size + uncompressedSize)) {
+    while ((out < (comp_Prebuf.size + uncompressedSize)) && (in < p->size)) {
       // each flag byte flags 8 literals/references, 1 per bit
       flags = (flagCount++ % 8 == 0) ? src[in++] : flags >> 1;
       if ((flags & 1) == 1) { // each flag bit is 1 for reference, 0 for literal
         unsigned int offset = src[in++];
         unsigned int length = src[in++];

Vulnerable code:     while (out < (comp_Prebuf.size + uncompressedSize)) {
Fixed code: * [SECURITY] Potential buffer overrun on incoming Compressed RTF Streams
    while ((out < (comp_Prebuf.size + uncompressedSize)) && (in < p->size)) {
CVE-2016-15039: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') (CWE-444)
value: A vulnerability classified as critical was found in mhuertos phpLDAPadmin up to 665dbc2690ebeb5392d38f1fece0a654225a0b38. Affected by this vulnerability is the function makeHttpRequest of the file htdocs/js/ajax_functions.js. The manipulation leads to http request smuggling. The attack can be launched remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named dd6e9583a2eb2ca085583765e8a63df5904cb036. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-270523.
CWE description: The product acts as an intermediary HTTP agent
         (such as a proxy or firewall) in the data flow between two
         entities such as a client and server, but it does not
         interpret malformed HTTP requests or responses in ways that
         are consistent with how the messages will be processed by
         those entities that are at the ultimate destination.
Published: 2024-07-11T03:15Z
Repository: https://github.com/mhuertos/phpLDAPadmin
Language: JavaScript
Files changed: htdocs/js/ajax_functions.js
Commit date: 2016-08-11 01:48:12 +0200
Commit message: Fixed request smuggling vulnerability. See: https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_HTTP_Request/Response_Smuggling
According to https://www.w3.org/TR/XMLHttpRequest/#the-setrequestheader%28%29-method, the header should be ignored anyway if those properties were set.

Diff: diff --git a/htdocs/js/ajax_functions.js b/htdocs/js/ajax_functions.js
index 1b3a955..540b925 100644
--- a/htdocs/js/ajax_functions.js
+++ b/htdocs/js/ajax_functions.js
@@ -200,12 +200,10 @@ function makeHttpRequest(url,parameters,meth,successCallbackFunctionName,errorCa
 	http_request.onreadystatechange = window['alertHttpRequest'];
 	if (meth == 'GET') url = url + '?' + parameters;
 	http_request.open(meth,url,true);
 
 	http_request.setRequestHeader('Content-type','application/x-www-form-urlencoded');
-	http_request.setRequestHeader('Content-length',parameters.length);
-	http_request.setRequestHeader('Connection','close');
 
 	if (meth == 'GET') parameters = null;
 	http_request.send(parameters);
 }
 

Vulnerable code: 	http_request.setRequestHeader('Content-length',parameters.length);
	http_request.setRequestHeader('Connection','close');
CVE-2015-5159: Improper Input Validation (CWE-20)
value: python-kdcproxy before 0.3.2 allows remote attackers to cause a denial of service via a large POST request.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2018-10-30T18:29Z
Repository: https://github.com/latchset/kdcproxy
Language: Python
Files changed: kdcproxy/__init__.py
Commit date: 2015-08-03 14:57:23 -0400
Commit message: Enforce a maximum packet length

Permanently fixes CVE-2015-5159 for all applications.

Diff: diff --git a/kdcproxy/__init__.py b/kdcproxy/__init__.py
index 865abac..9fc1418 100644
--- a/kdcproxy/__init__.py
+++ b/kdcproxy/__init__.py
@@ -59,10 +59,11 @@ class HTTPException(Exception):
     def __str__(self):
         return "%d %s" % (self.code, httplib.responses[self.code])
 
 
 class Application:
+    MAX_LENGTH = 128 * 1024
     SOCKTYPES = {
         "tcp": socket.SOCK_STREAM,
         "udp": socket.SOCK_DGRAM,
     }
 
@@ -178,11 +179,15 @@ class Application:
 
             # Parse the request
             try:
                 length = int(env["CONTENT_LENGTH"])
             except AttributeError:
-                length = -1
+                raise HTTPException(411, "Length required.")
+            if length < 0:
+                raise HTTPException(411, "Length required.")
+            if length > self.MAX_LENGTH:
+                raise HTTPException(413, "Request entity too large.")
             try:
                 pr = codec.decode(env["wsgi.input"].read(length))
             except codec.ParsingError as e:
                 raise HTTPException(400, e.message)
 

Vulnerable code:                 length = -1
Fixed code:     MAX_LENGTH = 128 * 1024
                raise HTTPException(411, "Length required.")
            if length < 0:
                raise HTTPException(411, "Length required.")
            if length > self.MAX_LENGTH:
                raise HTTPException(413, "Request entity too large.")
CVE-2018-20545: Integer Overflow or Wraparound (CWE-190)
value: There is an illegal WRITE memory access at common-image.c (function load_image) in libcaca 0.99.beta19 for 4bpp data.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 8.8
Published: 2018-12-28T16:29Z
Repository: https://github.com/cacalabs/libcaca
Language: C
Files changed: src/common-image.h
Commit date: 2018-12-30 13:25:18 +0100
Commit message: img2txt: fix an integer overflow in the BMP loader.

Fixes: #37 (CVE-2018-20545)
Fixes: #40 (CVE-2018-20548)
Fixes: #41 (CVE-2018-20549)

Diff: diff --git a/src/common-image.h b/src/common-image.h
index b78b05c..438b2bc 100644
--- a/src/common-image.h
+++ b/src/common-image.h
@@ -1,21 +1,21 @@
 /*
  *  Imaging tools for cacaview and img2irc
- *  Copyright (c) 2003-2012 Sam Hocevar <sam@hocevar.net>
- *                All Rights Reserved
+ *  Copyright © 2003—2018 Sam Hocevar <sam@hocevar.net>
+ *              All Rights Reserved
  *
  *  This program is free software. It comes without any warranty, to
  *  the extent permitted by applicable law. You can redistribute it
  *  and/or modify it under the terms of the Do What the Fuck You Want
- *  to Public License, Version 2, as published by Sam Hocevar. See
- *  http://www.wtfpl.net/ for more details.
+ *  to Public License, Version 2, as published by the WTFPL Task Force.
+ *  See http://www.wtfpl.net/ for more details.
  */
 
 struct image
 {
     char *pixels;
-    unsigned int w, h;
+    size_t w, h;
     struct caca_dither *dither;
     void *priv;
 };
 
 /* Local functions */

Vulnerable code:  *  Copyright (c) 2003-2012 Sam Hocevar <sam@hocevar.net>
 *                All Rights Reserved
 *  to Public License, Version 2, as published by Sam Hocevar. See
 *  http://www.wtfpl.net/ for more details.
    unsigned int w, h;
Fixed code:  *  Copyright © 2003—2018 Sam Hocevar <sam@hocevar.net>
 *              All Rights Reserved
 *  to Public License, Version 2, as published by the WTFPL Task Force.
 *  See http://www.wtfpl.net/ for more details.
    size_t w, h;
CVE-2018-20546: Integer Overflow or Wraparound (CWE-190)
value: There is an illegal READ memory access at caca/dither.c (function get_rgba_default) in libcaca 0.99.beta19 for the default bpp case.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 8.1
Published: 2018-12-28T16:29Z
Repository: https://github.com/cacalabs/libcaca
Language: C
Files changed: caca/dither.c
Commit date: 2018-12-30 13:25:33 +0100
Commit message: dither: fix integer multiplication overflow that caused crashes.

Fixes: #38 (CVE-2018-20546)
Fixes: #39 (CVE-2018-20547)

Diff: diff --git a/caca/dither.c b/caca/dither.c
index c6ebab1b..b2e24e55 100644
--- a/caca/dither.c
+++ b/caca/dither.c
@@ -4,12 +4,12 @@
  *              All Rights Reserved
  *
  *  This library is free software. It comes without any warranty, to
  *  the extent permitted by applicable law. You can redistribute it
  *  and/or modify it under the terms of the Do What the Fuck You Want
- *  to Public License, Version 2, as published by Sam Hocevar. See
- *  http://www.wtfpl.net/ for more details.
+ *  to Public License, Version 2, as published by the WTFPL Task Force.
+ *  See http://www.wtfpl.net/ for more details.
  */
 
 /*
  *  This file contains bitmap dithering functions.
  */
@@ -114,11 +114,11 @@ enum color_mode
 };
 
 struct caca_dither
 {
     int bpp, has_palette, has_alpha;
-    int w, h, pitch;
+    size_t w, h, pitch;
     int rmask, gmask, bmask, amask;
     int rright, gright, bright, aright;
     int rleft, gleft, bleft, aleft;
     void (*get_hsv)(caca_dither_t *, char *, int, int);
     int red[256], green[256], blue[256], alpha[256];

Vulnerable code:  *  to Public License, Version 2, as published by Sam Hocevar. See
 *  http://www.wtfpl.net/ for more details.
    int w, h, pitch;
Fixed code:  *  to Public License, Version 2, as published by the WTFPL Task Force.
 *  See http://www.wtfpl.net/ for more details.
    size_t w, h, pitch;
CVE-2023-24623: Server-Side Request Forgery (SSRF) (CWE-918)
value: Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 7.5
Published: 2023-01-30T05:15Z
Repository: https://github.com/hakobe/paranoidhttp
Language: Go
Files changed: client.go, client_test.go
Commit date: 2019-04-22 15:08:55 +0700
Commit message: fix ipv6 unspecified address

Diff: diff --git a/client.go b/client.go
index 4f80444..5b65321 100644
--- a/client.go
+++ b/client.go
@@ -119,11 +119,11 @@ func safeAddr(ctx context.Context, resolver *net.Resolver, hostport string, opts
 		return "", err
 	}
 
 	ip := net.ParseIP(host)
 	if ip != nil {
-		if ip.To4() != nil && c.isIPForbidden(ip) {
+		if ip.IsUnspecified() || (ip.To4() != nil && c.isIPForbidden(ip)) {
 			return "", fmt.Errorf("bad ip is detected: %v", ip)
 		}
 		return net.JoinHostPort(ip.String(), port), nil
 	}
 
diff --git a/client_test.go b/client_test.go
index 7282dd6..a7ce139 100644
--- a/client_test.go
+++ b/client_test.go
@@ -17,10 +17,14 @@ func TestRequest(t *testing.T) {
 	}
 
 	if _, err := DefaultClient.Get("http://192.168.0.1"); err == nil {
 		t.Errorf("The request for localhost should be fail")
 	}
+
+	if _, err := DefaultClient.Get("http://[::]"); err == nil {
+		t.Errorf("The request for IPv6 unspecified address should be fail")
+	}
 }
 
 func TestIsHostForbidden(t *testing.T) {
 	badHosts := []string{
 		"localhost",

Vulnerable code: 		if ip.To4() != nil && c.isIPForbidden(ip) {
Fixed code: 		if ip.IsUnspecified() || (ip.To4() != nil && c.isIPForbidden(ip)) {

	if _, err := DefaultClient.Get("http://[::]"); err == nil {
		t.Errorf("The request for IPv6 unspecified address should be fail")
	}
CVE-2019-16772: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-12-07T00:15Z
Repository: https://github.com/commenthol/serialize-to-js
Language: JavaScript
Files changed: lib/index.js, test/fixtures.js
Commit date: 2019-12-06 18:14:54 +0100
Commit message: fix: for ghsa-3fjq-93xj-3f3f

Diff: diff --git a/lib/index.js b/lib/index.js
index 29b11f9..c028f06 100644
--- a/lib/index.js
+++ b/lib/index.js
@@ -73,11 +73,11 @@ function serialize (source, opts) {
     tmp = source.toString()
     // append function to es6 function within obj
     out += !/^\s*(function|\([^)]*\)\s*=>)/m.test(tmp) ? 'function ' + tmp : tmp
   } else if (util.isObject(source)) {
     if (util.isRegExp(source)) {
-      out += source.toString()
+      out += 'new RegExp("' + source.source + '", "' + source.flags + '")'
     } else if (util.isDate(source)) {
       out += 'new Date("' + source.toJSON() + '")'
     } else if (util.isError(source)) {
       out += 'new Error(' + (source.message ? '"' + source.message + '"' : '') + ')'
     } else if (util.isBuffer(source)) {
diff --git a/test/fixtures.js b/test/fixtures.js
index 83b389f..220bd75 100644
--- a/test/fixtures.js
+++ b/test/fixtures.js
@@ -31,11 +31,11 @@ module.exports = {
     null,
     'null'
   ],
   'regex': [
     /test(?:it)?/ig,
-    '/test(?:it)?/gi'
+    'new RegExp("test(?:it)?", "gi")'
   ],
   'object': [
     { a: 1, b: 2 },
     '{a: 1, b: 2}'
   ],
@@ -136,10 +136,18 @@ module.exports = {
   ],
   'Float64Array': [
     new Float64Array([1e12, 2000000, 3.1415, -4.9e2, 5]),
     'new Float64Array([1000000000000, 2000000, 3.1415, -490, 5])',
     'toString'
+  ],
+  'regexXss': [
+    /[</script><script>alert('xss')//]/i,
+    'new RegExp("[</script><script>alert(\'xss\')//]", "i")'
+  ],
+  'regex no flags': [
+    /abc/,
+    'new RegExp("abc", "")'
   ]
 }
 
 if (!isBrowser) {
   Object.assign(module.exports, {

Vulnerable code:       out += source.toString()
    '/test(?:it)?/gi'
Fixed code:       out += 'new RegExp("' + source.source + '", "' + source.flags + '")'
    'new RegExp("test(?:it)?", "gi")'
  ],
  'regexXss': [
    /[</script><script>alert('xss')//]/i,
    'new RegExp("[</script><script>alert(\'xss\')//]", "i")'
  ],
  'regex no flags': [
    /abc/,
    'new RegExp("abc", "")'
CVE-2021-21336: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an information disclosure vulnerability - everyone can list the names of roles defined in the ZODB Role Manager plugin if the site uses this plugin. The problem has been fixed in version 2.6.0. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to 2.6.0 and re-run the buildout, or if you used pip simply do `pip install "Products.PluggableAuthService>=2.6.0"`.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 6.5
Published: 2021-03-08T21:15Z
Repository: https://github.com/zopefoundation/Products.PluggableAuthService
Language: Other
Files changed: CHANGES.rst, src/Products/PluggableAuthService/plugins/ZODBRoleManager.py
Commit date: 2021-02-23 12:25:04 +0100
Commit message: - Fix missing access control on ZODB Role Manager enumerateRoles

Diff: diff --git a/CHANGES.rst b/CHANGES.rst
index d0683af..a1bfbd8 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -2,10 +2,12 @@ Change Log
 ==========
 
 2.6.0 (unreleased)
 ------------------
 
+- Fix missing access control on ZODB Role Manager ``enumerateRoles``
+
 - Fix open redirect issue in `Cookie Auth Helper` redirect handling
 
 - Add support for Python 3.9.
 
 
diff --git a/src/Products/PluggableAuthService/plugins/ZODBRoleManager.py b/src/Products/PluggableAuthService/plugins/ZODBRoleManager.py
index e0aa1ea..9167b3b 100644
--- a/src/Products/PluggableAuthService/plugins/ZODBRoleManager.py
+++ b/src/Products/PluggableAuthService/plugins/ZODBRoleManager.py
@@ -110,10 +110,11 @@ class ZODBRoleManager(BasePlugin):
         return tuple(result)
 
     #
     #   IRoleEnumerationPlugin implementation
     #
+    @security.private
     def enumerateRoles(self, id=None, exact_match=False, sort_by=None,
                        max_results=None, **kw):
         """ See IRoleEnumerationPlugin.
         """
         role_info = []

Fixed code: - Fix missing access control on ZODB Role Manager ``enumerateRoles``

    @security.private
CVE-2013-7070: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: The handle_request function in lib/HTTPServer.pm in Monitorix before 3.3.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the URI.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2019-12-31T20:15Z
Repository: https://github.com/mikaku/Monitorix
Language: Other
Files changed: Changes, lib/HTTPServer.pm
Commit date: 2013-11-21 10:08:19 +0100
Commit message: fixed to correctly sanitize the input string in the built-in HTTP server which led a number of security vulnerabilities. #30

Diff: diff --git a/Changes b/Changes
index 71e74cf..c5159c4 100644
--- a/Changes
+++ b/Changes
@@ -1,5 +1,11 @@
+3.3.1  - 21-Nov-2013
+====================
+- Fixed to correctly sanitize the input string in the built-in HTTP server
+  which led a number of security vulnerabilities. [#30]
+
+
 3.3.0  - 12-Aug-2013
 ====================
 - Added a complete statistical Wowza Media Server graph.
 	(suggested by Daniele Ilardo, kkstyle21 AT gmail.com)
 - Added a complete statistical PHP-APC graph.
diff --git a/lib/HTTPServer.pm b/lib/HTTPServer.pm
index 5e27b95..031dba5 100644
--- a/lib/HTTPServer.pm
+++ b/lib/HTTPServer.pm
@@ -146,10 +146,11 @@ sub handle_request {
 	my $auth = lc($main::config{httpd_builtin}->{auth}->{enabled});
 	my $mimetype;
 	my $target;
 	my $target_cgi;
 	my @data;
+	my $OK_CHARS='-a-zA-Z0-9_./';	# a restrictive list of valid chars
 
 	return if fork();	# parent returns
 
 	my $url = $cgi->path_info();
 	$0 = "monitorix-httpd";	# change process' name
@@ -190,12 +191,16 @@ sub handle_request {
 	if(!$target || $target eq $base_url) {
 		$target = "index.html" unless $target;
 	}
 	($mimetype) = ($target =~ m/.*\.(html|cgi|png)$/);
 
-	$target =~ s/^\///;		# removes leading slash
-	$target_cgi =~ s/^\///;		# removes leading slash
+	$target =~ s/^\/*//;		# removes leading slashes
+	$target_cgi =~ s/^\/*//;	# removes leading slashes
+
+	$target =~ s/[^$OK_CHARS]/_/go;		# only $OK_CHARS are allowed
+	$target_cgi =~ s/[^$OK_CHARS]/_/go;	# only $OK_CHARS are allowed
+
 	if($target_cgi eq "monitorix.cgi") {
 		chdir("cgi");
 		open(EXEC, "./$target_cgi |");
 		@data = <EXEC>;
 		close(EXEC);

Vulnerable code: 	$target =~ s/^\///;		# removes leading slash
	$target_cgi =~ s/^\///;		# removes leading slash
Fixed code: 3.3.1  - 21-Nov-2013
====================
- Fixed to correctly sanitize the input string in the built-in HTTP server
  which led a number of security vulnerabilities. [#30]


	my $OK_CHARS='-a-zA-Z0-9_./';	# a restrictive list of valid chars
	$target =~ s/^\/*//;		# removes leading slashes
	$target_cgi =~ s/^\/*//;	# removes leading slashes

	$target =~ s/[^$OK_CHARS]/_/go;		# only $OK_CHARS are allowed
	$target_cgi =~ s/[^$OK_CHARS]/_/go;	# only $OK_CHARS are allowed
CVE-2021-3325: Other (NVD-CWE-Other)
value: Monitorix 3.13.0 allows remote attackers to bypass Basic Authentication in a default installation (i.e., an installation without a hosts_deny option). This issue occurred because a new access-control feature was introduced without considering that some exiting installations became unsafe, upon an update to 3.13.0, unless the new feature was immediately configured.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 9.8
Published: 2021-01-27T19:15Z
Repository: https://github.com/mikaku/Monitorix
Language: Perl
Files changed: lib/HTTPServer.pm
Commit date: 2021-01-27 10:45:41 +0100
Commit message: fixed a security bug introduced in 3.13.0 version that lead the HTTP built-in server to bypass Basic Authentication when the option 'hosts_deny' is not defined #309

Diff: diff --git a/lib/HTTPServer.pm b/lib/HTTPServer.pm
index c13301a..b02a8f7 100644
--- a/lib/HTTPServer.pm
+++ b/lib/HTTPServer.pm
@@ -137,10 +137,14 @@ sub http_header {
 		print "HTTP/1.0 200 OK\r\n";
 	} elsif($code eq "401") {
 		# check if the IP address is forced to auth
 		my $denied;
 		my $allowed = ip_validity($ENV{REMOTE_ADDR}, $hosts_allow);
+
+		# specific behavior
+		$hosts_deny = "all" if !$hosts_deny;
+
 		$denied = ip_validity($ENV{REMOTE_ADDR}, $hosts_deny) if !$allowed;
 		if(!$allowed && $denied) {
 			my (undef, $encoded_str) = split(' ', $ENV{HTTP_AUTHORIZATION} || "");
 			my ($user, $pass) = split(':', decode_base64($encoded_str || ":"));
 

Fixed code: 
		# specific behavior
		$hosts_deny = "all" if !$hosts_deny;
CVE-2017-5474: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: Open redirect vulnerability in comment.php in Serendipity through 2.0.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the HTTP Referer header.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2017-01-14T07:59Z
Repository: https://github.com/s9y/Serendipity
Language: Other
Files changed: comment.php, docs/NEWS
Commit date: 2017-01-12 12:02:27 +0100
Commit message: * [Security] Redirection of comment.php now checks the referrer
      and only allows the blog's host (thanks to Lee Sheldon Victor)

Diff: diff --git a/comment.php b/comment.php
index b152a7640..b43871aa1 100644
--- a/comment.php
+++ b/comment.php
@@ -9,11 +9,11 @@ include S9Y_INCLUDE_PATH . 'include/functions_entries_admin.inc.php';
 
 header('Content-Type: text/html; charset=' . LANG_CHARSET);
 
 if (isset($serendipity['GET']['delete'], $serendipity['GET']['entry'], $serendipity['GET']['type'])) {
     serendipity_deleteComment($serendipity['GET']['delete'], $serendipity['GET']['entry'], $serendipity['GET']['type']);
-    if (serendipity_isResponseClean($_SERVER['HTTP_REFERER'])) {
+    if (serendipity_isResponseClean($_SERVER['HTTP_REFERER']) && preg_match('@^https?://' . preg_quote($_SERVER['HTTP_HOST'], '@') . '@imsU')) {
         header('Status: 302 Found');
         header('Location: '. $_SERVER['HTTP_REFERER']);
         exit;
     }
 }
diff --git a/docs/NEWS b/docs/NEWS
index 171310e74..1cba2d217 100644
--- a/docs/NEWS
+++ b/docs/NEWS
@@ -15,10 +15,13 @@ Version 2.1 ()
     * [Security] For multi-deletion of entries, secure the HTTP referrer
       output to prevent XSS (Issue #435)
       
     * [Security] Reject %0D/%0A in exit tracking and other places
       (Issue #434)
+      
+    * [Security] Redirection of comment.php now checks the referrer
+      and only allows the blog's host (thanks to Lee Sheldon Victor)
 
     * Disabled Selenium test files unless enabled
 
 Version 2.1-beta2 (September 26th, 2016)
 ------------------------------------------------------------------------

Vulnerable code:     if (serendipity_isResponseClean($_SERVER['HTTP_REFERER'])) {
Fixed code:     if (serendipity_isResponseClean($_SERVER['HTTP_REFERER']) && preg_match('@^https?://' . preg_quote($_SERVER['HTTP_HOST'], '@') . '@imsU')) {
      
    * [Security] Redirection of comment.php now checks the referrer
      and only allows the blog's host (thanks to Lee Sheldon Victor)
CVE-2024-31578: Insufficient Information (NVD-CWE-noinfo)
value: FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-17T14:15Z
Repository: https://github.com/ffmpeg/ffmpeg
Language: C
Files changed: libavutil/hwcontext.c
Commit date: 2024-03-01 17:20:00 +0800
Commit message: avutil/hwcontext: Don't assume frames_uninit is reentrant

Fix heap use after free when vulkan_frames_init failed.

Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>

Diff: diff --git a/libavutil/hwcontext.c b/libavutil/hwcontext.c
index 1d2c2d7920..aa1329bf2b 100644
--- a/libavutil/hwcontext.c
+++ b/libavutil/hwcontext.c
@@ -357,28 +357,24 @@ int av_hwframe_ctx_init(AVBufferRef *ref)
 
     /* format-specific init */
     if (ctx->internal->hw_type->frames_init) {
         ret = ctx->internal->hw_type->frames_init(ctx);
         if (ret < 0)
-            goto fail;
+            return ret;
     }
 
     if (ctx->internal->pool_internal && !ctx->pool)
         ctx->pool = ctx->internal->pool_internal;
 
     /* preallocate the frames in the pool, if requested */
     if (ctx->initial_pool_size > 0) {
         ret = hwframe_pool_prealloc(ref);
         if (ret < 0)
-            goto fail;
+            return ret;
     }
 
     return 0;
-fail:
-    if (ctx->internal->hw_type->frames_uninit)
-        ctx->internal->hw_type->frames_uninit(ctx);
-    return ret;
 }
 
 int av_hwframe_transfer_get_formats(AVBufferRef *hwframe_ref,
                                     enum AVHWFrameTransferDirection dir,
                                     enum AVPixelFormat **formats, int flags)

Vulnerable code:             goto fail;
            goto fail;
fail:
    if (ctx->internal->hw_type->frames_uninit)
        ctx->internal->hw_type->frames_uninit(ctx);
    return ret;
Fixed code:             return ret;
            return ret;
CVE-2024-31581: Insufficient Information (NVD-CWE-noinfo)
value: FFmpeg version n6.1 was discovered to contain an improper validation of array index vulnerability in libavcodec/cbs_h266_syntax_template.c. This vulnerability allows attackers to cause undefined behavior within the application.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-17T19:15Z
Repository: https://github.com/ffmpeg/ffmpeg
Language: C
Files changed: libavcodec/cbs_h266_syntax_template.c
Commit date: 2023-12-14 23:53:10 +0100
Commit message: avcodec/cbs_h266: more restrictive check on pps_tile_idx_delta_val

Fixes: out of array access
Fixes: 62603/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5837632490569728

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Diff: diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c
index dd884ad449..549d021211 100644
--- a/libavcodec/cbs_h266_syntax_template.c
+++ b/libavcodec/cbs_h266_syntax_template.c
@@ -2041,13 +2041,16 @@ static int FUNC(pps) (CodedBitstreamContext *ctx, RWContext *rw,
                     slice_top_left_ctu_x[i] = ctu_x;
                     slice_top_left_ctu_y[i] = ctu_y;
                 }
                 if (i < current->pps_num_slices_in_pic_minus1) {
                     if (current->pps_tile_idx_delta_present_flag) {
+                        // Two conditions must be met:
+                        // 1. −NumTilesInPic + 1 <= pps_tile_idx_delta_val[i] <= NumTilesInPic − 1
+                        // 2. 0 <= tile_idx + pps_tile_idx_delta_val[i] <= NumTilesInPic − 1
+                        // Combining these conditions yields: -tile_idx <= pps_tile_idx_delta_val[i] <= NumTilesInPic - 1 - tile_idx
                         ses(pps_tile_idx_delta_val[i],
-                            -current->num_tiles_in_pic + 1,
-                            current->num_tiles_in_pic - 1, 1, i);
+                            -tile_idx, current->num_tiles_in_pic - 1 - tile_idx, 1, i);
                         if (current->pps_tile_idx_delta_val[i] == 0) {
                             av_log(ctx->log_ctx, AV_LOG_ERROR,
                                    "pps_tile_idx_delta_val[i] shall not be equal to 0.\n");
                         }
                         tile_idx += current->pps_tile_idx_delta_val[i];

Vulnerable code:                             -current->num_tiles_in_pic + 1,
                            current->num_tiles_in_pic - 1, 1, i);
Fixed code:                         // Two conditions must be met:
                        // 1. −NumTilesInPic + 1 <= pps_tile_idx_delta_val[i] <= NumTilesInPic − 1
                        // 2. 0 <= tile_idx + pps_tile_idx_delta_val[i] <= NumTilesInPic − 1
                        // Combining these conditions yields: -tile_idx <= pps_tile_idx_delta_val[i] <= NumTilesInPic - 1 - tile_idx
                            -tile_idx, current->num_tiles_in_pic - 1 - tile_idx, 1, i);