Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2022-24708: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior to 1.20.0.5646 was not escaping primary group name for display. Because of that, it was possible for a logged in user to modify primary group name with elements of JavaScript. Such script could then be executed in user browser on subsequent requests on pages where primary group name was displayed. This is vulnerability has been fixed in version 1.20.0.5646. Users who are unable to upgrade may modify ttUser.class.php to use an additional call to htmlspecialchars when printing group name.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-02-24T16:15Z
Repository: https://github.com/anuko/timetracker
Language: PHP
Files changed: WEB-INF/lib/ttUser.class.php, initialize.php
Commit date: 2022-02-23 15:43:47 +0000
Commit message: Addressed stored XSS vulnerability when displaying primary group name.

Diff: diff --git a/WEB-INF/lib/ttUser.class.php b/WEB-INF/lib/ttUser.class.php
index 19e689b58..f1eb3e094 100644
--- a/WEB-INF/lib/ttUser.class.php
+++ b/WEB-INF/lib/ttUser.class.php
@@ -832,11 +832,11 @@ class ttUser {
     }
     if ($this->behalf_group_id) {
       $user_part .= ',  <span class="onBehalf">'.htmlspecialchars($this->behalf_group_name).'</span>';
     } else {
       if ($this->group_name) // Note: we did not require group names in the past.
-        $user_part .= ', '.$this->group_name;
+        $user_part .= ', '.htmlspecialchars($this->group_name);
     }
     return $user_part;
   }
 
   // setOnBehalfGroup sets on behalf group for the user in both the object and the session.
diff --git a/initialize.php b/initialize.php
index 62c2c0f8f..b4ad492fa 100644
--- a/initialize.php
+++ b/initialize.php
@@ -10,11 +10,11 @@ error_reporting(E_ALL & ~E_NOTICE & ~E_STRICT); // & ~E_DEPRECATED);
 // E_ALL tends to change as PHP evolves, therefore we use & here instead of exclusive OR (^).
 
 // Disable displaying errors on screen.
 ini_set('display_errors', 'Off');
 
-define("APP_VERSION", "1.20.0.5645");
+define("APP_VERSION", "1.20.0.5646");
 define("APP_DIR", dirname(__FILE__));
 define("LIBRARY_DIR", APP_DIR."/WEB-INF/lib");
 define("TEMPLATE_DIR", APP_DIR."/WEB-INF/templates");
 // Date format for database and URI parameters.
 define('DB_DATEFORMAT', '%Y-%m-%d');

Vulnerable code:         $user_part .= ', '.$this->group_name;
define("APP_VERSION", "1.20.0.5645");
Fixed code:         $user_part .= ', '.htmlspecialchars($this->group_name);
define("APP_VERSION", "1.20.0.5646");
CVE-2023-32066: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Time Tracker is an open source time tracking system. The week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping titles for notes in week view table. Because of that, it was possible for a logged in user to enter notes with elements of JavaScript. Such script could then be executed in user browser on subsequent requests to week view. This issue is fixed in version 1.22.12.5783. As a workaround, use `htmlspecialchars` when calling `$field->setTitle` on line #245 in the `week.php` file,  as happens in version 1.22.12.5783.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-05-09T16:15Z
Repository: https://github.com/anuko/timetracker
Language: PHP
Files changed: initialize.php, week.php
Commit date: 2023-05-05 18:19:31 +0000
Commit message: Addressed stored XSS vulnerability in week.php by escaping cell title.

Diff: diff --git a/initialize.php b/initialize.php
index 3b5b0fcf9..ac6cd7071 100644
--- a/initialize.php
+++ b/initialize.php
@@ -19,11 +19,11 @@ if (version_compare(phpversion(), '8.1', '>=')) {
     mysqli_report(MYSQLI_REPORT_OFF);
   else
     die("mysqli_report function is not available."); // No point to continue as mysqli will not work.
 }
 
-define("APP_VERSION", "1.22.11.5782");
+define("APP_VERSION", "1.22.12.5783");
 define("APP_DIR", dirname(__FILE__));
 define("LIBRARY_DIR", APP_DIR."/WEB-INF/lib");
 define("TEMPLATE_DIR", APP_DIR."/WEB-INF/templates");
 // Date format for database and URI parameters.
 define('DB_DATEFORMAT', '%Y-%m-%d');
diff --git a/week.php b/week.php
index 9d96abfbe..16a00dff6 100644
--- a/week.php
+++ b/week.php
@@ -240,11 +240,11 @@ class WeekViewCellRenderer extends DefaultCellRenderer {
     if ($showNotes) {
       if (0 == $row % 2) {
         $field->setValue($table->getValueAt($row,$column)['duration']); // Duration for even rows.
       } else {
         $field->setValue($table->getValueAt($row,$column)['note']);     // Comment for odd rows.
-        $field->setTitle($table->getValueAt($row,$column)['note']);     // Tooltip to help view the entire comment.
+        $field->setTitle(htmlspecialchars($table->getValueAt($row,$column)['note'])); // Tooltip to help view the entire comment.
       }
     } else {
       $field->setValue($table->getValueAt($row,$column)['duration']);
       // $field->setTitle($table->getValueAt($row,$column)['note']); // Tooltip to see comment. TODO - value not available.
     }

Vulnerable code: define("APP_VERSION", "1.22.11.5782");
        $field->setTitle($table->getValueAt($row,$column)['note']);     // Tooltip to help view the entire comment.
Fixed code: define("APP_VERSION", "1.22.12.5783");
        $field->setTitle(htmlspecialchars($table->getValueAt($row,$column)['note'])); // Tooltip to help view the entire comment.
CVE-2021-33420: Deserialization of Untrusted Data (CWE-502)
value: A deserialization issue discovered in inikulin replicator before 1.0.4 allows remote attackers to run arbitrary code via the fromSerializable function in TypedArray object.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2022-12-15T19:15Z
Repository: https://github.com/inikulin/replicator
Language: Unknown
Commit date: 2021-05-17 16:07:59 +0300
Commit message: Merge pull request #17 from inikulin/sec

fix: Avoid RCE when deserialising TypedArrays [closes #16][part of #12]
CVE-2015-10022: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in IISH nlgis2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file scripts/etl/custom_import.pl. The manipulation leads to sql injection. The identifier of the patch is 8bdb6fcf7209584eaf1232437f0f53e735b2b34c. It is recommended to apply a patch to fix this issue. The identifier VDB-217609 was assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-07T12:15Z
Repository: https://github.com/IISH/nlgis2
Language: Perl
Files changed: scripts/etl/custom_import.pl
Commit date: 2015-01-14 17:51:27 +0100
Commit message: Fixed for sql injection

Diff: diff --git a/scripts/etl/custom_import.pl b/scripts/etl/custom_import.pl
index 615bb59..39db358 100755
--- a/scripts/etl/custom_import.pl
+++ b/scripts/etl/custom_import.pl
@@ -29,12 +29,12 @@ while (<>)
 {
     # OUTPUT INDUSTRY 3.01: Industrial output in rubles
     my $str = $_;
     # Prevention from sql injection
     $sqlinjection = 0;
-    $sqlinjection++ if ($str=~/(drop\s+all|drop\s+table)/sxi);
-    $sqlinjection++ if ($str=~/(alter|create)\s+table/sxi);
+    $sqlinjection++ if ($str=~/(drop.+all|drop.+table)/sxi);
+    $sqlinjection++ if ($str=~/(alter|create).+table/sxi);
     $sqlinjection++ if ($str=~/^select/sxi);
     exit(0) if ($sqlinjection);
     if ($str!~/^\".+?\"/)
     {
        $str = transform($str);

Vulnerable code:     $sqlinjection++ if ($str=~/(drop\s+all|drop\s+table)/sxi);
    $sqlinjection++ if ($str=~/(alter|create)\s+table/sxi);
Fixed code:     $sqlinjection++ if ($str=~/(drop.+all|drop.+table)/sxi);
    $sqlinjection++ if ($str=~/(alter|create).+table/sxi);
CVE-2013-7436: Cryptographic Issues (CWE-310)
value: noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
CWE description: Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Published: 2015-04-10T14:59Z
Repository: https://github.com/kanaka/noVNC
Language: JavaScript
Files changed: include/webutil.js
Commit date: 2013-10-29 10:41:51 +0000
Commit message: Adds support for secure attribute on token cookie

This patch adds support for the secure attribute on token
cookies (sent by nova-novncproxy). If the https is used
to transfer the cookie, the secure attribute is set thus
restricting server requestes to secure conections only.
This should prevent man-in-the-middle attacks.

Diff: diff --git a/include/webutil.js b/include/webutil.js
index ebf8e89..5ceccbe 100644
--- a/include/webutil.js
+++ b/include/webutil.js
@@ -1,8 +1,9 @@
 /*
  * noVNC: HTML5 VNC client
  * Copyright (C) 2012 Joel Martin
+ * Copyright (C) 2013 NTT corp.
  * Licensed under MPL 2.0 (see LICENSE.txt)
  *
  * See README.md for usage and integration instructions.
  */
 
@@ -92,20 +93,24 @@ WebUtil.getQueryVar = function(name, defVal) {
  * Cookie handling. Dervied from: http://www.quirksmode.org/js/cookies.html
  */
 
 // No days means only for this browser session
 WebUtil.createCookie = function(name,value,days) {
-    var date, expires;
+    var date, expires, secure;
     if (days) {
         date = new Date();
         date.setTime(date.getTime()+(days*24*60*60*1000));
         expires = "; expires="+date.toGMTString();
-    }
-    else {
+    } else {
         expires = "";
     }
-    document.cookie = name+"="+value+expires+"; path=/";
+    if (document.location.protocol === "https:") {
+        secure = "; secure";
+    } else {
+        secure = "";
+    }
+    document.cookie = name+"="+value+expires+"; path=/"+secure;
 };
 
 WebUtil.readCookie = function(name, defaultValue) {
     var i, c, nameEQ = name + "=", ca = document.cookie.split(';');
     for(i=0; i < ca.length; i += 1) {

Vulnerable code:     var date, expires;
    }
    else {
    document.cookie = name+"="+value+expires+"; path=/";
Fixed code:  * Copyright (C) 2013 NTT corp.
    var date, expires, secure;
    } else {
    if (document.location.protocol === "https:") {
        secure = "; secure";
    } else {
        secure = "";
    }
    document.cookie = name+"="+value+expires+"; path=/"+secure;
CVE-2010-3872: Numeric Errors (CWE-189)
value: A flaw was found in the mod_fcgid module of httpd. A malformed FastCGI response may result in a stack-based buffer overflow in the modules/fcgid/fcgid_bucket.c file in the fcgid_header_bucket_read() function, resulting in an application crash.
CWE description: Weaknesses in this category are related to improper calculation or conversion of numbers.
Published: 2010-11-22T12:54Z
Repository: https://github.com/apache/httpd-mod_fcgid
Language: Other
Files changed: CHANGES-FCGID, modules/fcgid/fcgid_bucket.c
Commit date: 2010-11-04 12:10:10 +0000
Commit message: SECURITY: CVE-2010-3872 (cve.mitre.org)

Fix possible stack buffer overwrite.

PR:  49406
Reported and diagnosed by: Edgar Frank <ef-lists email.de>


git-svn-id: https://svn.apache.org/repos/asf/httpd/mod_fcgid/trunk@1030894 13f79535-47bb-0310-9956-ffa450edef68

Diff: diff --git a/CHANGES-FCGID b/CHANGES-FCGID
index 06dfde4..90ed060 100644
--- a/CHANGES-FCGID
+++ b/CHANGES-FCGID
@@ -1,8 +1,12 @@
                                                          -*- coding: utf-8 -*-
 Changes with mod_fcgid 2.3.6
 
+  *) SECURITY: CVE-2010-3872 (cve.mitre.org)
+     Fix possible stack buffer overwrite.  Diagnosed by the reporter.
+     PR 49406.  [Edgar Frank <ef-lists email.de>]
+
   *) Change the default for FcgidMaxRequestLen from 1GB to 128K.
      Administrators should change this to an appropriate value based on
      site requirements.  [Jeff Trawick]
 
   *) Allow FastCGI apps more time to exit at shutdown before being
diff --git a/modules/fcgid/fcgid_bucket.c b/modules/fcgid/fcgid_bucket.c
index 9f3d55d..7313f29 100644
--- a/modules/fcgid/fcgid_bucket.c
+++ b/modules/fcgid/fcgid_bucket.c
@@ -94,11 +94,11 @@ static apr_status_t fcgid_header_bucket_read(apr_bucket * b,
                              &bufferlen)) != APR_SUCCESS)
             return rv;
 
         /* Initialize header */
         putsize = fcgid_min(bufferlen, sizeof(header) - hasread);
-        memcpy(&header + hasread, buffer, putsize);
+        memcpy((apr_byte_t *)&header + hasread, buffer, putsize);
         hasread += putsize;
 
         /* Ignore the bytes that have read */
         fcgid_ignore_bytes(ctx, putsize);
     }

Vulnerable code:         memcpy(&header + hasread, buffer, putsize);
Fixed code:   *) SECURITY: CVE-2010-3872 (cve.mitre.org)
     Fix possible stack buffer overwrite.  Diagnosed by the reporter.
     PR 49406.  [Edgar Frank <ef-lists email.de>]

        memcpy((apr_byte_t *)&header + hasread, buffer, putsize);
CVE-2021-42073: Session Fixation (CWE-384)
value: An issue was discovered in Barrier before 2.4.0. An attacker can enter an active session state with the barriers component (aka the server-side implementation of Barrier) simply by supplying a client label that identifies a valid client configuration. This label is "Unnamed" by default but could instead be guessed from hostnames or other publicly available information. In the active session state, an attacker can capture input device events from the server, and also modify the clipboard content on the server.
CWE description: Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
CVSS v3 base score: 8.2
Published: 2021-11-08T04:15Z
Repository: https://github.com/debauchee/barrier
Language: Unknown
Commit date: 2021-11-01 05:15:48 +0200
Commit message: Merge pull request #1346 from p12tic/client-identity-verification

Implement client identity verification [SECURITY VULNERABILITIES CVE-2021-42072, CVE-2021-42073]
CVE-2020-25459: Exposure of Resource to Wrong Sphere (CWE-668)
value: An issue was discovered in function sync_tree in hetero_decision_tree_guest.py in WeBank FATE (Federated AI Technology Enabler) 0.1 through 1.4.2 allows attackers to read sensitive information during the training process of machine learning joint modeling.
CWE description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CVSS v3 base score: 7.5
Published: 2022-06-16T21:15Z
Repository: https://github.com/FederatedAI/FATE
Language: Python
Files changed: federatedml/tree/hetero/hetero_decision_tree_guest.py
Commit date: 2020-08-07 15:56:38 +0800
Commit message: remove sensitive info of guest sending to host

Signed-off-by: mgqa34 <mgq3374541@163.com>

Diff: diff --git a/federatedml/tree/hetero/hetero_decision_tree_guest.py b/federatedml/tree/hetero/hetero_decision_tree_guest.py
index 1f23ddc5..028c74c0 100644
--- a/federatedml/tree/hetero/hetero_decision_tree_guest.py
+++ b/federatedml/tree/hetero/hetero_decision_tree_guest.py
@@ -527,14 +527,27 @@ class HeteroDecisionTreeGuest(DecisionTree):
                                                              lambda unleaf_state_nodeid1, unleaf_state_nodeid2: \
                                                                  unleaf_state_nodeid1 if len(
                                                                      unleaf_state_nodeid1) == 2 else unleaf_state_nodeid2)
         self.node_dispatch = self.node_dispatch.union(dispatch_guest_result)
 
+    def remove_sensitive_info(self):
+        """
+        host is not allowed to get weights/g/h
+        """
+        new_tree_ = copy.deepcopy(self.tree_)
+        for node in new_tree_:
+            node.weight = None
+            node.sum_grad = None
+            node.sum_hess = None
+
+        return new_tree_
+
     def sync_tree(self):
         LOGGER.info("sync tree to host")
 
-        self.transfer_inst.tree.remote(self.tree_,
+        tree_nodes = self.remove_sensitive_info()
+        self.transfer_inst.tree.remote(tree_nodes,
                                        role=consts.HOST,
                                        idx=-1)
         """
         federation.remote(obj=self.tree_,
                           name=self.transfer_inst.tree.name,

Vulnerable code:         self.transfer_inst.tree.remote(self.tree_,
Fixed code:     def remove_sensitive_info(self):
        """
        host is not allowed to get weights/g/h
        """
        new_tree_ = copy.deepcopy(self.tree_)
        for node in new_tree_:
            node.weight = None
            node.sum_grad = None
            node.sum_hess = None

        return new_tree_

        tree_nodes = self.remove_sensitive_info()
        self.transfer_inst.tree.remote(tree_nodes,
CVE-2015-4471: Numeric Errors (CWE-189)
value: Off-by-one error in the lzxd_decompress function in lzxd.c in libmspack before 0.5 allows remote attackers to cause a denial of service (buffer under-read and application crash) via a crafted CAB archive.
CWE description: Weaknesses in this category are related to improper calculation or conversion of numbers.
Published: 2015-06-11T14:59Z
Repository: https://github.com/kyz/libmspack
Language: Other
Files changed: libmspack/trunk/ChangeLog, libmspack/trunk/mspack/lzxd.c
Commit date: 2015-01-18 14:20:35 +0000
Commit message: Prevent a 1-byte underread of the input buffer if an odd-sized data block comes just before an uncompressed block header

Diff: diff --git a/libmspack/trunk/ChangeLog b/libmspack/trunk/ChangeLog
index dbd13dc..5374ac8 100644
--- a/libmspack/trunk/ChangeLog
+++ b/libmspack/trunk/ChangeLog
@@ -1,5 +1,13 @@
+2015-01-18  Stuart Caie <kyzer@4u.net>
+
+	* lzxd_decompress(): the byte-alignment code for reading uncompressed
+	block headers presumed it could wind i_ptr back 2 bytes, but this
+	hasn't been true since READ_BYTES was allowed to read bytes straddling
+	two blocks, leaving just 1 byte in the read buffer. Thanks to Jakub
+	Wilk for finding the issue and providing a sample file.
+
 2015-01-17  Stuart Caie <kyzer@4u.net>
 
 	* GET_UTF8_CHAR(): Remove 5/6-byte encoding support and check decoded
 	chars are no more than U+10FFFF.
 
diff --git a/libmspack/trunk/mspack/lzxd.c b/libmspack/trunk/mspack/lzxd.c
index 79c7812..2281e7b 100644
--- a/libmspack/trunk/mspack/lzxd.c
+++ b/libmspack/trunk/mspack/lzxd.c
@@ -504,12 +504,11 @@ int lzxd_decompress(struct lzxd_stream *lzx, off_t out_bytes) {
 	case LZX_BLOCKTYPE_UNCOMPRESSED:
 	  /* because we can't assume otherwise */
 	  lzx->intel_started = 1;
 
 	  /* read 1-16 (not 0-15) bits to align to bytes */
-	  ENSURE_BITS(16);
-	  if (bits_left > 16) i_ptr -= 2;
+	  if (bits_left == 0) ENSURE_BITS(16);
 	  bits_left = 0; bit_buffer = 0;
 
 	  /* read 12 bytes of stored R0 / R1 / R2 values */
 	  for (rundest = &buf[0], i = 0; i < 12; i++) {
 	    READ_IF_NEEDED;

Vulnerable code: 	  ENSURE_BITS(16);
	  if (bits_left > 16) i_ptr -= 2;
Fixed code: 2015-01-18  Stuart Caie <kyzer@4u.net>

	* lzxd_decompress(): the byte-alignment code for reading uncompressed
	block headers presumed it could wind i_ptr back 2 bytes, but this
	hasn't been true since READ_BYTES was allowed to read bytes straddling
	two blocks, leaving just 1 byte in the read buffer. Thanks to Jakub
	Wilk for finding the issue and providing a sample file.

	  if (bits_left == 0) ENSURE_BITS(16);
CVE-2018-14682: Off-by-one Error (CWE-193)
value: An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression.
CWE description: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CVSS v3 base score: 8.8
Published: 2018-07-28T23:29Z
Repository: https://github.com/kyz/libmspack
Language: Other
Files changed: libmspack/ChangeLog, libmspack/mspack/chmd.c
Commit date: 2018-02-06 23:21:12 +0000
Commit message: Fix off-by-one error in chmd TOLOWER() fallback

Diff: diff --git a/libmspack/ChangeLog b/libmspack/ChangeLog
index 44cf81a..74354ac 100644
--- a/libmspack/ChangeLog
+++ b/libmspack/ChangeLog
@@ -1,5 +1,10 @@
+2018-02-06  Stuart Caie <kyzer@cabextract.org.uk>
+
+	* chmd.c: fixed an off-by-one error in the TOLOWER() macro, reported
+	by Dmitry Glavatskikh. Thanks Dmitry!
+
 2017-11-26  Stuart Caie <kyzer@cabextract.org.uk>
 
 	* kwajd_read_headers(): fix up the logic of reading the filename and
 	extension headers to avoid a one or two byte overwrite. Thanks to
 	Jakub Wilk for finding the issue.
diff --git a/libmspack/mspack/chmd.c b/libmspack/mspack/chmd.c
index 1a486c8..221784b 100644
--- a/libmspack/mspack/chmd.c
+++ b/libmspack/mspack/chmd.c
@@ -829,11 +829,11 @@ static int search_chunk(struct mschmd_header *chm,
 # if HAVE_CTYPE_H
 #  include <ctype.h>
 # endif
 # define TOLOWER(x) tolower(x)
 #else
-# define TOLOWER(x) (((x)<0||(x)>256)?(x):mspack_tolower_map[(x)])
+# define TOLOWER(x) (((x)<0||(x)>255)?(x):mspack_tolower_map[(x)])
 /* Map of char -> lowercase char for the first 256 chars. Generated with:
  * LC_CTYPE=en_GB.utf-8 perl -Mlocale -le 'print map{ord(lc chr).","} 0..255'
  */
 static const unsigned char mspack_tolower_map[256] = {
     0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,

Vulnerable code: # define TOLOWER(x) (((x)<0||(x)>256)?(x):mspack_tolower_map[(x)])
Fixed code: 2018-02-06  Stuart Caie <kyzer@cabextract.org.uk>

	* chmd.c: fixed an off-by-one error in the TOLOWER() macro, reported
	by Dmitry Glavatskikh. Thanks Dmitry!

# define TOLOWER(x) (((x)<0||(x)>255)?(x):mspack_tolower_map[(x)])
CVE-2018-18585: NULL Pointer Dereference (CWE-476)
value: chmd_read_headers in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has '\0' as its first or second character (such as the "/\0" name).
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 4.3
Published: 2018-10-23T02:29Z
Repository: https://github.com/kyz/libmspack
Language: Other
Files changed: libmspack/ChangeLog, libmspack/mspack/chmd.c
Commit date: 2018-10-17 11:29:03 +0100
Commit message: Avoid returning CHM file entries that are "blank" because they have embedded null bytes

Diff: diff --git a/libmspack/ChangeLog b/libmspack/ChangeLog
index cce7f2f..a5873b6 100644
--- a/libmspack/ChangeLog
+++ b/libmspack/ChangeLog
@@ -1,5 +1,11 @@
+2018-10-17  Stuart Caie <kyzer@cabextract.org.uk>
+  
+        * chmd_read_headers(): again reject files with blank filenames, this
+        time because their 1st or 2nd byte is null, not because their length
+        is zero.  Thanks again to Hanno Böck for finding the issue.
+
 2018-10-16  Stuart Caie <kyzer@cabextract.org.uk>
 
 	* Makefile.am: using automake _DEPENDENCIES for chmd_test appears to
 	override the default dependencies (e.g. sources), so libchmd.la was no
 	longer considered a dependency of chmd_test. This breaks parallel
diff --git a/libmspack/mspack/chmd.c b/libmspack/mspack/chmd.c
index b3f7fee..1d198bf 100644
--- a/libmspack/mspack/chmd.c
+++ b/libmspack/mspack/chmd.c
@@ -445,18 +445,18 @@ static int chmd_read_headers(struct mspack_system *sys, struct mspack_file *fh,
     num_entries = EndGetI16(end);
 
     while (num_entries--) {
       READ_ENCINT(name_len);
       if (name_len > (unsigned int) (end - p)) goto chunk_end;
-      /* consider blank filenames to be an error */
-      if (name_len == 0) goto chunk_end;
       name = p; p += name_len;
-
       READ_ENCINT(section);
       READ_ENCINT(offset);
       READ_ENCINT(length);
 
+      /* ignore blank or one-char (e.g. "/") filenames we'd return as blank */
+      if (name_len < 2 || !name[0] || !name[1]) continue;
+
       /* empty files and directory names are stored as a file entry at
        * offset 0 with length 0. We want to keep empty files, but not
        * directory names, which end with a "/" */
       if ((offset == 0) && (length == 0)) {
 	if ((name_len > 0) && (name[name_len-1] == '/')) continue;

Vulnerable code:       /* consider blank filenames to be an error */
      if (name_len == 0) goto chunk_end;

Fixed code: 2018-10-17  Stuart Caie <kyzer@cabextract.org.uk>
  
        * chmd_read_headers(): again reject files with blank filenames, this
        time because their 1st or 2nd byte is null, not because their length
        is zero.  Thanks again to Hanno Böck for finding the issue.

      /* ignore blank or one-char (e.g. "/") filenames we'd return as blank */
      if (name_len < 2 || !name[0] || !name[1]) continue;