Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2020-4068: Heap-based Buffer Overflow (CWE-122)
value: In APNSwift 1.0.0, calling APNSwiftSigner.sign(digest:) is likely to result in a heap buffer overflow. This has been fixed in 1.0.1.
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 9.8
Published: 2020-06-22T16:15Z
Repository: https://github.com/kylebrowning/APNSwift
Language: Swift
Files changed: Sources/APNSwift/APNSwiftSigner.swift
Commit date: 2019-07-23 10:27:07 -0700
Commit message: Resolves memory issue (#32)

* Resolves #31 

Diff: diff --git a/Sources/APNSwift/APNSwiftSigner.swift b/Sources/APNSwift/APNSwiftSigner.swift
index 27cef70..73d06cd 100644
--- a/Sources/APNSwift/APNSwiftSigner.swift
+++ b/Sources/APNSwift/APNSwiftSigner.swift
@@ -34,13 +34,13 @@ public struct APNSwiftSigner {
 
     internal func sign(digest: ByteBuffer) throws -> ByteBuffer {
         let bio = BIO_new(BIO_s_mem())
         defer { BIO_free(bio) }
         let res = buffer.withUnsafeReadableBytes { ptr in
-            Int(BIO_puts(bio, ptr.baseAddress?.assumingMemoryBound(to: Int8.self)))
+            BIO_write(bio, ptr.baseAddress, CInt(ptr.count))
         }
-        assert(res >= 0, "BIO_puts failed")
+        assert(res >= 0, "BIO_write failed")
 
         guard let opaquePointer = OpaquePointer.make(optional: PEM_read_bio_ECPrivateKey(bio!, nil, nil, nil)) else {
             throw APNSwiftError.SigningError.invalidAuthKey
         }
         defer { EC_KEY_free(opaquePointer) }
@@ -48,19 +48,16 @@ public struct APNSwiftSigner {
         let sig = digest.withUnsafeReadableBytes { ptr in
             ECDSA_do_sign(ptr.baseAddress?.assumingMemoryBound(to: UInt8.self), Int32(digest.readableBytes), opaquePointer)
         }
         defer { ECDSA_SIG_free(sig) }
 
-        var derEncodedSignature: UnsafeMutablePointer<UInt8>?
+        var derEncodedSignature: UnsafeMutablePointer<CUnsignedChar>?
         let derLength = i2d_ECDSA_SIG(sig, &derEncodedSignature)
         guard let derCopy = derEncodedSignature, derLength > 0 else {
             throw APNSwiftError.SigningError.invalidASN1
         }
 
         var derBytes = ByteBufferAllocator().buffer(capacity: Int(derLength))
-        for b in 0 ..< Int(derLength) {
-            derBytes.writeBytes([derCopy[b]])
-        }
-
+        derBytes.writeBytes(UnsafeBufferPointer<CUnsignedChar>(start: derCopy, count: Int(derLength)))
         return derBytes
     }
 }

Vulnerable code:             Int(BIO_puts(bio, ptr.baseAddress?.assumingMemoryBound(to: Int8.self)))
        assert(res >= 0, "BIO_puts failed")
        var derEncodedSignature: UnsafeMutablePointer<UInt8>?
        for b in 0 ..< Int(derLength) {
            derBytes.writeBytes([derCopy[b]])
        }

Fixed code:             BIO_write(bio, ptr.baseAddress, CInt(ptr.count))
        assert(res >= 0, "BIO_write failed")
        var derEncodedSignature: UnsafeMutablePointer<CUnsignedChar>?
        derBytes.writeBytes(UnsafeBufferPointer<CUnsignedChar>(start: derCopy, count: Int(derLength)))
CVE-2024-33438: Insufficient Information (NVD-CWE-noinfo)
value: File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to execute arbitrary code via a crafted .phar file.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-29T18:15Z
Repository: https://github.com/cubecart/v6
Language: PHP
Files changed: classes/filemanager.class.php
Commit date: 2024-04-24 13:01:48 +0100
Commit message: #3570 - .phar to illegal filenames list

Diff: diff --git a/classes/filemanager.class.php b/classes/filemanager.class.php
index 99e812575..e5ec0a7b6 100755
--- a/classes/filemanager.class.php
+++ b/classes/filemanager.class.php
@@ -777,11 +777,11 @@ class FileManager
      * @return bool
      */
 
     public function filenameIsIllegal($file_name)
     {
-        if (preg_match('/(\.sh\.inc\.ini|\.htaccess|\.php|\.phtml|\.php[3-6])$/i', $file_name)) {
+        if (preg_match('/(\.sh\.inc\.ini|\.htaccess|\.php|\.phar|\.phtml|\.php[3-6])$/i', $file_name)) {
             return true;
         } elseif (preg_match('/\.php\./i', $file_name)) {
             return true;
         }
         return false;

Vulnerable code:         if (preg_match('/(\.sh\.inc\.ini|\.htaccess|\.php|\.phtml|\.php[3-6])$/i', $file_name)) {
Fixed code:         if (preg_match('/(\.sh\.inc\.ini|\.htaccess|\.php|\.phar|\.phtml|\.php[3-6])$/i', $file_name)) {
CVE-2022-0764: Other (NVD-CWE-Other)
value: Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 6.7
Published: 2022-02-26T15:15Z
Repository: https://github.com/strapi/strapi
Language: Unknown
Commit date: 2022-02-24 16:48:08 +0100
Commit message: Merge pull request #12649 from strapi/cli-security

update execa commands
CVE-2021-4307: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: A vulnerability was found in Yomguithereal Baobab up to 2.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be launched remotely. Upgrading to version 2.6.1 is able to address this issue. The patch is named c56639532a923d9a1600fb863ec7551b188b5d19. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217627.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2023-01-07T20:15Z
Repository: https://github.com/Yomguithereal/baobab
Language: JavaScript
Files changed: src/helpers.js, test/suites/helpers.ts
Commit date: 2021-01-26 17:42:44 +0100
Commit message: Security Fix for Prototype Pollution (#511)


Diff: diff --git a/src/helpers.js b/src/helpers.js
index 56650e5..6de6e6d 100644
--- a/src/helpers.js
+++ b/src/helpers.js
@@ -442,11 +442,12 @@ function merger(deep, ...objects) {
     t = objects[i];
 
     for (k in t) {
       if (deep &&
           type.object(t[k]) &&
-          !(t[k] instanceof Monkey)) {
+          !(t[k] instanceof Monkey) &&
+          !(k === '__proto__' || k === 'constructor' || k === 'prototype')) {
         o[k] = merger(true, o[k] || {}, t[k]);
       }
       else {
         o[k] = t[k];
       }
diff --git a/test/suites/helpers.ts b/test/suites/helpers.ts
index 0f90ddc..7cc7c4b 100644
--- a/test/suites/helpers.ts
+++ b/test/suites/helpers.ts
@@ -92,10 +92,18 @@ describe('Helpers', function() {
       assert.deepEqual(
         deepMerge({}, {one: {two: [1, 2]}, three: 3}, {one: {two: [3, 4]}}),
         {one: {two: [3, 4]}, three: 3}
       );
     });
+
+    it('merge should not pollute object prototype.', function() {
+      const data = JSON.parse('{"__proto__": {"polluted": true}}');
+
+      deepMerge({}, data);
+
+      assert.equal(Object.keys(Object.prototype).includes('polluted'), false);
+    });
   });
 
   /**
    * Non-mutative splice
    */

Vulnerable code:           !(t[k] instanceof Monkey)) {
Fixed code:           !(t[k] instanceof Monkey) &&
          !(k === '__proto__' || k === 'constructor' || k === 'prototype')) {

    it('merge should not pollute object prototype.', function() {
      const data = JSON.parse('{"__proto__": {"polluted": true}}');

      deepMerge({}, data);

      assert.equal(Object.keys(Object.prototype).includes('polluted'), false);
    });
CVE-2018-14349: Improper Input Validation (CWE-20)
value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a NO response without a message.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 9.8
Published: 2018-07-17T17:29Z
Repository: https://github.com/neomutt/neomutt
Language: C
Files changed: imap/command.c
Commit date: 2018-07-07 14:15:56 -0500
Commit message: Handle NO response without message properly

Diff: diff --git a/imap/command.c b/imap/command.c
index 859f9872..74d12df1 100644
--- a/imap/command.c
+++ b/imap/command.c
@@ -890,11 +890,11 @@ static int cmd_handle_untagged(struct ImapData *idata)
   else if (ImapServernoise && (mutt_str_strncasecmp("NO", s, 2) == 0))
   {
     mutt_debug(2, "Handling untagged NO\n");
 
     /* Display the warning message from the server */
-    mutt_error("%s", s + 3);
+    mutt_error("%s", s + 2);
   }
 
   return 0;
 }
 

Vulnerable code:     mutt_error("%s", s + 3);
Fixed code:     mutt_error("%s", s + 2);
CVE-2018-14350: Out-of-bounds Write (CWE-787)
value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/message.c has a stack-based buffer overflow for a FETCH response with a long INTERNALDATE field.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2018-07-17T17:29Z
Repository: https://github.com/neomutt/neomutt
Language: C
Files changed: imap/message.c
Commit date: 2018-07-07 14:03:46 -0500
Commit message: Don't overflow stack buffer in msg_parse_fetch

Diff: diff --git a/imap/message.c b/imap/message.c
index 8adc9164..62bace9a 100644
--- a/imap/message.c
+++ b/imap/message.c
@@ -328,11 +328,11 @@ static int msg_parse_fetch(struct ImapHeader *h, char *s)
         mutt_debug(1, "bogus INTERNALDATE entry: %s\n", s);
         return -1;
       }
       s++;
       ptmp = tmp;
-      while (*s && *s != '\"')
+      while (*s && (*s != '\"') && (ptmp != (tmp + sizeof(tmp) - 1)))
         *ptmp++ = *s++;
       if (*s != '\"')
         return -1;
       s++; /* skip past the trailing " */
       *ptmp = '\0';
@@ -341,11 +341,11 @@ static int msg_parse_fetch(struct ImapHeader *h, char *s)
     else if (mutt_str_strncasecmp("RFC822.SIZE", s, 11) == 0)
     {
       s += 11;
       SKIPWS(s);
       ptmp = tmp;
-      while (isdigit((unsigned char) *s))
+      while (isdigit((unsigned char) *s) && (ptmp != (tmp + sizeof(tmp) - 1)))
         *ptmp++ = *s++;
       *ptmp = '\0';
       if (mutt_str_atol(tmp, &h->content_length) < 0)
         return -1;
     }

Vulnerable code:       while (*s && *s != '\"')
      while (isdigit((unsigned char) *s))
Fixed code:       while (*s && (*s != '\"') && (ptmp != (tmp + sizeof(tmp) - 1)))
      while (isdigit((unsigned char) *s) && (ptmp != (tmp + sizeof(tmp) - 1)))
CVE-2018-14351: Improper Input Validation (CWE-20)
value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a long IMAP status mailbox literal count size.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 9.8
Published: 2018-07-17T17:29Z
Repository: https://github.com/neomutt/neomutt
Language: C
Files changed: imap/command.c
Commit date: 2018-07-07 15:19:58 -0500
Commit message: Ensure litlen isn't larger than our mailbox

Diff: diff --git a/imap/command.c b/imap/command.c
index 74d12df18..13be77a79 100644
--- a/imap/command.c
+++ b/imap/command.c
@@ -633,10 +633,17 @@ static void cmd_parse_status(struct ImapData *idata, char *s)
     if (imap_cmd_step(idata) != IMAP_CMD_CONTINUE)
     {
       idata->status = IMAP_FATAL;
       return;
     }
+
+    if (strlen(idata->buf) < litlen)
+    {
+      mutt_debug(1, "Error parsing STATUS mailbox\n");
+      return;
+    }
+
     mailbox = idata->buf;
     s = mailbox + litlen;
     *s = '\0';
     s++;
     SKIPWS(s);

Fixed code: 
    if (strlen(idata->buf) < litlen)
    {
      mutt_debug(1, "Error parsing STATUS mailbox\n");
      return;
    }
CVE-2018-14352: Out-of-bounds Write (CWE-787)
value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap_quote_string in imap/util.c does not leave room for quote characters, leading to a stack-based buffer overflow.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2018-07-17T17:29Z
Repository: https://github.com/neomutt/neomutt
Language: C
Files changed: imap/util.c
Commit date: 2018-07-07 15:35:56 -0500
Commit message: imap_quote_string make room for quotes

Diff: diff --git a/imap/util.c b/imap/util.c
index 57802b254..fccfdbf45 100644
--- a/imap/util.c
+++ b/imap/util.c
@@ -812,12 +812,12 @@ void imap_quote_string(char *dest, size_t dlen, const char *src, bool quote_back
 
   char *pt = dest;
   const char *s = src;
 
   *pt++ = '"';
-  /* save room for trailing quote-char */
-  dlen -= 2;
+  /* save room for quote-chars */
+  dlen -= 3;
 
   for (; *s && dlen; s++)
   {
     if (strchr(quote, *s))
     {

Vulnerable code:   /* save room for trailing quote-char */
  dlen -= 2;
Fixed code:   /* save room for quote-chars */
  dlen -= 3;
CVE-2018-14353: Integer Underflow (Wrap or Wraparound) (CWE-191)
value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap_quote_string in imap/util.c has an integer underflow.
CWE description: The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CVSS v3 base score: 9.8
Published: 2018-07-17T17:29Z
Repository: https://github.com/neomutt/neomutt
Language: C
Files changed: imap/util.c
Commit date: 2018-07-07 16:20:56 -0500
Commit message: Check for int underflow in imap_quote_string

Diff: diff --git a/imap/util.c b/imap/util.c
index 58224fc38..57802b254 100644
--- a/imap/util.c
+++ b/imap/util.c
@@ -819,13 +819,13 @@ void imap_quote_string(char *dest, size_t dlen, const char *src, bool quote_back
 
   for (; *s && dlen; s++)
   {
     if (strchr(quote, *s))
     {
-      dlen -= 2;
-      if (dlen == 0)
+      if (dlen < 2)
         break;
+      dlen -= 2;
       *pt++ = '\\';
       *pt++ = *s;
     }
     else
     {

Vulnerable code:       dlen -= 2;
      if (dlen == 0)
Fixed code:       if (dlen < 2)
      dlen -= 2;
CVE-2018-14354: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2018-07-17T17:29Z
Repository: https://github.com/neomutt/neomutt
Language: C
Files changed: imap/imap.c
Commit date: 2018-07-07 10:46:40 +0100
Commit message: Quote path in imap_subscribe

Diff: diff --git a/imap/imap.c b/imap/imap.c
index 40f620a2e..f17068856 100644
--- a/imap/imap.c
+++ b/imap/imap.c
@@ -1707,10 +1707,11 @@ int imap_subscribe(char *path, bool subscribe)
   char buf[LONG_STRING];
   char mbox[LONG_STRING];
   char errstr[STRING];
   struct Buffer err, token;
   struct ImapMbox mx;
+  size_t len = 0;
 
   if (!mx_is_imap(path) || imap_parse_path(path, &mx) || !mx.mbox)
   {
     mutt_error(_("Bad mailbox name"));
     return -1;
@@ -1727,11 +1728,12 @@ int imap_subscribe(char *path, bool subscribe)
   {
     mutt_buffer_init(&token);
     mutt_buffer_init(&err);
     err.data = errstr;
     err.dsize = sizeof(errstr);
-    snprintf(mbox, sizeof(mbox), "%smailboxes \"%s\"", subscribe ? "" : "un", path);
+	len = snprintf(mbox, sizeof(mbox), "%smailboxes ", subscribe ? "" : "un");
+	imap_quote_string(mbox + len, sizeof(mbox) - len, path, true);
     if (mutt_parse_rc_line(mbox, &token, &err))
       mutt_debug(1, "Error adding subscribed mailbox: %s\n", errstr);
     FREE(&token.data);
   }
 

Vulnerable code:     snprintf(mbox, sizeof(mbox), "%smailboxes \"%s\"", subscribe ? "" : "un", path);
Fixed code:   size_t len = 0;
	len = snprintf(mbox, sizeof(mbox), "%smailboxes ", subscribe ? "" : "un");
	imap_quote_string(mbox + len, sizeof(mbox) - len, path, true);
CVE-2018-14355: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/util.c mishandles ".." directory traversal in a mailbox name.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 5.3
Published: 2018-07-17T17:29Z
Repository: https://github.com/neomutt/neomutt
Language: C
Files changed: imap/util.c
Commit date: 2018-07-09 15:26:26 +0100
Commit message: Selectively cache headers

Co-authored-by: JerikoOne <jeriko.one@gmx.us>

Diff: diff --git a/imap/util.c b/imap/util.c
index 614d87a56..58224fc38 100644
--- a/imap/util.c
+++ b/imap/util.c
@@ -243,10 +243,16 @@ header_cache_t *imap_hcache_open(struct ImapData *idata, const char *path)
 
     imap_cachepath(idata, mx.mbox, mbox, sizeof(mbox));
     FREE(&mx.mbox);
   }
 
+  if (strstr(mbox, "/../") || (strcmp(mbox, "..") == 0) || (strncmp(mbox, "../", 3) == 0))
+    return NULL;
+  size_t len = strlen(mbox);
+  if ((len > 3) && (strcmp(mbox + len - 3, "/..") == 0))
+    return NULL;
+
   mutt_account_tourl(&idata->conn->account, &url);
   url.path = mbox;
   url_tostring(&url, cachepath, sizeof(cachepath), U_PATH);
 
   return mutt_hcache_open(HeaderCache, cachepath, imap_hcache_namer);

Fixed code:   if (strstr(mbox, "/../") || (strcmp(mbox, "..") == 0) || (strncmp(mbox, "../", 3) == 0))
    return NULL;
  size_t len = strlen(mbox);
  if ((len > 3) && (strcmp(mbox + len - 3, "/..") == 0))
    return NULL;
CVE-2018-14356: Access of Uninitialized Pointer (CWE-824)
value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c mishandles a zero-length UID.
CWE description: The product accesses or uses a pointer that has not been initialized.
CVSS v3 base score: 9.8
Published: 2018-07-17T17:29Z
Repository: https://github.com/neomutt/neomutt
Language: C
Files changed: pop.c
Commit date: 2018-07-07 15:55:34 -0500
Commit message: Ensure UID in fetch_uidl

Diff: diff --git a/pop.c b/pop.c
index 4f3a592a8..c52585abe 100644
--- a/pop.c
+++ b/pop.c
@@ -200,10 +200,14 @@ static int fetch_uidl(char *line, void *data)
     return -1;
   while (*endp == ' ')
     endp++;
   memmove(line, endp, strlen(endp) + 1);
 
+  /* uid must be at least be 1 byte */
+  if (strlen(line) == 0)
+    return -1;
+
   for (i = 0; i < ctx->msgcount; i++)
     if (mutt_str_strcmp(line, ctx->hdrs[i]->data) == 0)
       break;
 
   if (i == ctx->msgcount)

Fixed code:   /* uid must be at least be 1 byte */
  if (strlen(line) == 0)
    return -1;
CVE-2018-14358: Out-of-bounds Write (CWE-787)
value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/message.c has a stack-based buffer overflow for a FETCH response with a long RFC822.SIZE field.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2018-07-17T17:29Z
Repository: https://github.com/neomutt/neomutt
Language: C
Files changed: imap/message.c
Commit date: 2018-07-07 14:03:46 -0500
Commit message: Don't overflow stack buffer in msg_parse_fetch

Diff: diff --git a/imap/message.c b/imap/message.c
index 8adc91645..62bace9a7 100644
--- a/imap/message.c
+++ b/imap/message.c
@@ -328,11 +328,11 @@ static int msg_parse_fetch(struct ImapHeader *h, char *s)
         mutt_debug(1, "bogus INTERNALDATE entry: %s\n", s);
         return -1;
       }
       s++;
       ptmp = tmp;
-      while (*s && *s != '\"')
+      while (*s && (*s != '\"') && (ptmp != (tmp + sizeof(tmp) - 1)))
         *ptmp++ = *s++;
       if (*s != '\"')
         return -1;
       s++; /* skip past the trailing " */
       *ptmp = '\0';
@@ -341,11 +341,11 @@ static int msg_parse_fetch(struct ImapHeader *h, char *s)
     else if (mutt_str_strncasecmp("RFC822.SIZE", s, 11) == 0)
     {
       s += 11;
       SKIPWS(s);
       ptmp = tmp;
-      while (isdigit((unsigned char) *s))
+      while (isdigit((unsigned char) *s) && (ptmp != (tmp + sizeof(tmp) - 1)))
         *ptmp++ = *s++;
       *ptmp = '\0';
       if (mutt_str_atol(tmp, &h->content_length) < 0)
         return -1;
     }

Vulnerable code:       while (*s && *s != '\"')
      while (isdigit((unsigned char) *s))
Fixed code:       while (*s && (*s != '\"') && (ptmp != (tmp + sizeof(tmp) - 1)))
      while (isdigit((unsigned char) *s) && (ptmp != (tmp + sizeof(tmp) - 1)))
CVE-2018-14360: Out-of-bounds Write (CWE-787)
value: An issue was discovered in NeoMutt before 2018-07-16. nntp_add_group in newsrc.c has a stack-based buffer overflow because of incorrect sscanf usage.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2018-07-17T17:29Z
Repository: https://github.com/neomutt/neomutt
Language: C
Files changed: newsrc.c
Commit date: 2018-07-04 17:05:24 +0100
Commit message: Set length modifiers for group and desc

nntp_add_group parses a line controlled by the connected nntp server.
Restrict the maximum lengths read into the stack buffers group, and
desc.

Diff: diff --git a/newsrc.c b/newsrc.c
index aae7144eca..a0f2c39de7 100644
--- a/newsrc.c
+++ b/newsrc.c
@@ -590,20 +590,24 @@ void nntp_expand_path(char *line, size_t len, struct Account *acct)
  */
 int nntp_add_group(char *line, void *data)
 {
   struct NntpServer *nserv = data;
   struct NntpData *nntp_data = NULL;
-  char group[LONG_STRING];
+  char group[LONG_STRING] = "";
   char desc[HUGE_STRING] = "";
   char mod;
   anum_t first, last;
 
   if (!nserv || !line)
     return 0;
 
-  if (sscanf(line, "%s " ANUM " " ANUM " %c %[^\n]", group, &last, &first, &mod, desc) < 4)
+  /* These sscanf limits must match the sizes of the group and desc arrays */
+  if (sscanf(line, "%1023s " ANUM " " ANUM " %c %8191[^\n]", group, &last, &first, &mod, desc) < 4)
+  {
+    mutt_debug(4, "Cannot parse server line: %s\n", line);
     return 0;
+  }
 
   nntp_data = nntp_data_find(nserv, group);
   nntp_data->deleted = false;
   nntp_data->first_message = first;
   nntp_data->last_message = last;

Vulnerable code:   char group[LONG_STRING];
  if (sscanf(line, "%s " ANUM " " ANUM " %c %[^\n]", group, &last, &first, &mod, desc) < 4)
Fixed code:   char group[LONG_STRING] = "";
  /* These sscanf limits must match the sizes of the group and desc arrays */
  if (sscanf(line, "%1023s " ANUM " " ANUM " %c %8191[^\n]", group, &last, &first, &mod, desc) < 4)
  {
    mutt_debug(4, "Cannot parse server line: %s\n", line);
  }
CVE-2018-14361: Improper Input Validation (CWE-20)
value: An issue was discovered in NeoMutt before 2018-07-16. nntp.c proceeds even if memory allocation fails for messages data.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 9.8
Published: 2018-07-17T17:29Z
Repository: https://github.com/neomutt/neomutt
Language: C
Files changed: nntp.c
Commit date: 2018-07-04 17:42:30 +0100
Commit message: Add alloc fail check in nntp_fetch_headers

Diff: diff --git a/nntp.c b/nntp.c
index 032b6e141d..a0ffa609cb 100644
--- a/nntp.c
+++ b/nntp.c
@@ -1286,10 +1286,12 @@ static int nntp_fetch_headers(struct Context *ctx, void *hc, anum_t first,
   fc.ctx = ctx;
   fc.first = first;
   fc.last = last;
   fc.restore = restore;
   fc.messages = mutt_mem_calloc(last - first + 1, sizeof(unsigned char));
+  if (fc.messages == NULL)
+	  return -1;
 #ifdef USE_HCACHE
   fc.hc = hc;
 #endif
 
   /* fetch list of articles */

Fixed code:   if (fc.messages == NULL)
	  return -1;
CVE-2021-32055: Out-of-bounds Read (CWE-125)
value: Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt 2019-10-25 through 2021-05-04) has a $imap_qresync issue in which imap/util.c has an out-of-bounds read in situations where an IMAP sequence set ends with a comma. NOTE: the $imap_qresync setting for QRESYNC is not enabled by default.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2021-05-05T16:15Z
Repository: https://github.com/neomutt/neomutt
Language: C
Files changed: imap/util.c
Commit date: 2021-05-05 01:50:24 +0100
Commit message: Fix seqset iterator when it ends in a comma

If the seqset ended with a comma, the substr_end marker would be just
before the trailing nul.  In the next call, the loop to skip the
marker would iterate right past the end of string too.

The fix is simple: place the substr_end marker and skip past it
immediately.

Diff: diff --git a/imap/util.c b/imap/util.c
index 52aff7da0a..27fb862954 100644
--- a/imap/util.c
+++ b/imap/util.c
@@ -1117,17 +1117,15 @@ int mutt_seqset_iterator_next(struct SeqsetIterator *iter, unsigned int *next)
   {
     iter->substr_cur = iter->substr_end;
     if (iter->substr_cur == iter->eostr)
       return 1;
 
-    while (!*(iter->substr_cur))
-      iter->substr_cur++;
     iter->substr_end = strchr(iter->substr_cur, ',');
     if (!iter->substr_end)
       iter->substr_end = iter->eostr;
     else
-      *(iter->substr_end) = '\0';
+      *(iter->substr_end++) = '\0';
 
     char *range_sep = strchr(iter->substr_cur, ':');
     if (range_sep)
       *range_sep++ = '\0';
 

Vulnerable code:     while (!*(iter->substr_cur))
      iter->substr_cur++;
      *(iter->substr_end) = '\0';
Fixed code:       *(iter->substr_end++) = '\0';
CVE-2015-7777: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in index.php in JosephErnest Void before 2015-10-02 allows remote attackers to inject arbitrary web script or HTML via a crafted URI.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2015-11-21T11:59Z
Repository: https://github.com/josephernest/void
Language: Unknown
Commit date: 2015-10-02 12:52:22 +0200
Commit message: Merge pull request #18 from g-sato/fix_security_bug

Security fix
CVE-2020-5244: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed. This has been patched in version 5.1.2.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2020-02-24T18:15Z
Repository: https://github.com/buddypress/BuddyPress
Language: PHP
Files changed: src/bp-core/admin/bp-core-admin-slugs.php
Commit date: 2020-01-31 16:32:54 +0000
Commit message: Admin: Sanitize external links to activated BP component pages.

Props imath.
See #8235.

git-svn-id: https://buddypress.svn.wordpress.org/trunk@12549 cdf35c40-ae34-48e0-9cc9-0c9da1808c22

Diff: diff --git a/src/bp-core/admin/bp-core-admin-slugs.php b/src/bp-core/admin/bp-core-admin-slugs.php
index 180e06bd1..8fbe4d82e 100644
--- a/src/bp-core/admin/bp-core-admin-slugs.php
+++ b/src/bp-core/admin/bp-core-admin-slugs.php
@@ -143,11 +143,11 @@ function bp_core_admin_slugs_options() {
 								'selected'         => !empty( $existing_pages[$name] ) ? $existing_pages[$name] : false
 							) ); ?>
 
 							<?php if ( !empty( $existing_pages[$name] ) ) : ?>
 
-								<a href="<?php echo get_permalink( $existing_pages[$name] ); ?>" class="button-secondary" target="_bp"><?php _e( 'View', 'buddypress' ); ?></a>
+								<a href="<?php echo esc_url( get_permalink( $existing_pages[$name] ) ); ?>" class="button-secondary" target="_bp"><?php _e( 'View', 'buddypress' ); ?></a>
 
 							<?php endif; ?>
 
 							<?php if ( ! bp_is_root_blog() ) restore_current_blog(); ?>
 

Vulnerable code: 								<a href="<?php echo get_permalink( $existing_pages[$name] ); ?>" class="button-secondary" target="_bp"><?php _e( 'View', 'buddypress' ); ?></a>
Fixed code: 								<a href="<?php echo esc_url( get_permalink( $existing_pages[$name] ) ); ?>" class="button-secondary" target="_bp"><?php _e( 'View', 'buddypress' ); ?></a>
CVE-2021-46875: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1. An XSS attack can occur because JavaScript code can be uploaded in a .html or .js file.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-03-12T05:15Z
Repository: https://github.com/ezsystems/ezpublish-kernel
Language: YAML
Files changed: eZ/Bundle/EzPublishCoreBundle/Resources/config/default_settings.yml
Commit date: 2021-03-17 16:03:30 +0100
Commit message: Merge pull request from GHSA-mrvj-7q4f-5p42

Co-authored-by: Gunnstein Lye <gunnstein.lye@ibexa.co>
Diff: diff --git a/eZ/Bundle/EzPublishCoreBundle/Resources/config/default_settings.yml b/eZ/Bundle/EzPublishCoreBundle/Resources/config/default_settings.yml
index 42e5c2ee2..bdd60ec70 100644
--- a/eZ/Bundle/EzPublishCoreBundle/Resources/config/default_settings.yml
+++ b/eZ/Bundle/EzPublishCoreBundle/Resources/config/default_settings.yml
@@ -87,10 +87,20 @@ parameters:
         - phar
         - phpt
         - pht
         - phtml
         - pgif
+        - hta
+        - htm
+        - html
+        - xhtm
+        - xhtml
+        - jar
+        - js
+        - jse
+        - svg
+        - swf
 
     # Content settings
     ezsettings.default.content.view_cache: true         # Whether to use content view cache or not (Etag/Last-Modified based)
     ezsettings.default.content.ttl_cache: true          # Whether to use TTL Cache for content (i.e. Max-Age response header)
     ezsettings.default.content.default_ttl: 60          # Default TTL cache value for content

Fixed code:         - hta
        - htm
        - html
        - xhtm
        - xhtml
        - jar
        - js
        - jse
        - svg
        - swf
CVE-2015-5221: Use After Free (CWE-416)
value: Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 5.5
Published: 2017-07-25T18:29Z
Repository: https://github.com/mdadams/jasper
Language: C
Files changed: src/libjasper/mif/mif_cod.c
Commit date: 2016-09-19 10:03:36 +0100
Commit message: CVE-2015-5221

Diff: diff --git a/src/libjasper/mif/mif_cod.c b/src/libjasper/mif/mif_cod.c
index 17506a1..5afc0a2 100644
--- a/src/libjasper/mif/mif_cod.c
+++ b/src/libjasper/mif/mif_cod.c
@@ -568,17 +568,17 @@ static int mif_process_cmpt(mif_hdr_t *hdr, char *buf)
 				return -1;
 			}
 			break;
 		}
 	}
-	jas_tvparser_destroy(tvp);
 	if (!cmpt->sampperx || !cmpt->samppery) {
 		goto error;
 	}
 	if (mif_hdr_addcmpt(hdr, hdr->numcmpts, cmpt)) {
 		goto error;
 	}
+	jas_tvparser_destroy(tvp);
 	return 0;
 
 error:
 	if (cmpt) {
 		mif_cmpt_destroy(cmpt);

Vulnerable code: 	jas_tvparser_destroy(tvp);
Fixed code: 	jas_tvparser_destroy(tvp);
CVE-2016-8691: Divide By Zero (CWE-369)
value: The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted XRsiz value in a BMP image to the imginfo command.
CWE description: The product divides a value by zero.
CVSS v3 base score: 5.5
Published: 2017-02-15T19:59Z
Repository: https://github.com/mdadams/jasper
Language: C
Files changed: src/libjasper/jpc/jpc_cs.c
Commit date: 2016-10-15 12:22:28 -0700
Commit message: Added range check on XRsiz and YRsiz fields of SIZ marker segment.

Diff: diff --git a/src/libjasper/jpc/jpc_cs.c b/src/libjasper/jpc/jpc_cs.c
index 6da4872..55d34d6 100644
--- a/src/libjasper/jpc/jpc_cs.c
+++ b/src/libjasper/jpc/jpc_cs.c
@@ -510,10 +510,20 @@ static int jpc_siz_getparms(jpc_ms_t *ms, jpc_cstate_t *cstate,
 		  jpc_getuint8(in, &siz->comps[i].hsamp) ||
 		  jpc_getuint8(in, &siz->comps[i].vsamp)) {
 			jas_free(siz->comps);
 			return -1;
 		}
+		if (siz->comps[i].hsamp == 0 || siz->comps[i].hsamp > 255) {
+			jas_eprintf("invalid XRsiz value %d\n", siz->comps[i].hsamp);
+			jas_free(siz->comps);
+			return -1;
+		}
+		if (siz->comps[i].vsamp == 0 || siz->comps[i].vsamp > 255) {
+			jas_eprintf("invalid YRsiz value %d\n", siz->comps[i].vsamp);
+			jas_free(siz->comps);
+			return -1;
+		}
 		siz->comps[i].sgnd = (tmp >> 7) & 1;
 		siz->comps[i].prec = (tmp & 0x7f) + 1;
 	}
 	if (jas_stream_eof(in)) {
 		jas_free(siz->comps);

Fixed code: 		if (siz->comps[i].hsamp == 0 || siz->comps[i].hsamp > 255) {
			jas_eprintf("invalid XRsiz value %d\n", siz->comps[i].hsamp);
			jas_free(siz->comps);
			return -1;
		}
		if (siz->comps[i].vsamp == 0 || siz->comps[i].vsamp > 255) {
			jas_eprintf("invalid YRsiz value %d\n", siz->comps[i].vsamp);
			jas_free(siz->comps);
			return -1;
		}
CVE-2016-8692: Divide By Zero (CWE-369)
value: The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted YRsiz value in a BMP image to the imginfo command.
CWE description: The product divides a value by zero.
CVSS v3 base score: 5.5
Published: 2017-02-15T19:59Z
Repository: https://github.com/mdadams/jasper
Language: C
Files changed: src/libjasper/jpc/jpc_cs.c
Commit date: 2016-10-15 12:22:28 -0700
Commit message: Added range check on XRsiz and YRsiz fields of SIZ marker segment.

Diff: diff --git a/src/libjasper/jpc/jpc_cs.c b/src/libjasper/jpc/jpc_cs.c
index 6da4872..55d34d6 100644
--- a/src/libjasper/jpc/jpc_cs.c
+++ b/src/libjasper/jpc/jpc_cs.c
@@ -510,10 +510,20 @@ static int jpc_siz_getparms(jpc_ms_t *ms, jpc_cstate_t *cstate,
 		  jpc_getuint8(in, &siz->comps[i].hsamp) ||
 		  jpc_getuint8(in, &siz->comps[i].vsamp)) {
 			jas_free(siz->comps);
 			return -1;
 		}
+		if (siz->comps[i].hsamp == 0 || siz->comps[i].hsamp > 255) {
+			jas_eprintf("invalid XRsiz value %d\n", siz->comps[i].hsamp);
+			jas_free(siz->comps);
+			return -1;
+		}
+		if (siz->comps[i].vsamp == 0 || siz->comps[i].vsamp > 255) {
+			jas_eprintf("invalid YRsiz value %d\n", siz->comps[i].vsamp);
+			jas_free(siz->comps);
+			return -1;
+		}
 		siz->comps[i].sgnd = (tmp >> 7) & 1;
 		siz->comps[i].prec = (tmp & 0x7f) + 1;
 	}
 	if (jas_stream_eof(in)) {
 		jas_free(siz->comps);

Fixed code: 		if (siz->comps[i].hsamp == 0 || siz->comps[i].hsamp > 255) {
			jas_eprintf("invalid XRsiz value %d\n", siz->comps[i].hsamp);
			jas_free(siz->comps);
			return -1;
		}
		if (siz->comps[i].vsamp == 0 || siz->comps[i].vsamp > 255) {
			jas_eprintf("invalid YRsiz value %d\n", siz->comps[i].vsamp);
			jas_free(siz->comps);
			return -1;
		}
CVE-2016-8693: Double Free (CWE-415)
value: Double free vulnerability in the mem_close function in jas_stream.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image to the imginfo command.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 7.8
Published: 2017-02-15T19:59Z
Repository: https://github.com/mdadams/jasper
Language: C
Files changed: src/libjasper/base/jas_stream.c
Commit date: 2016-10-20 07:34:32 -0700
Commit message: The memory stream interface allows for a buffer size of zero.
The case of a zero-sized buffer was not handled correctly, as it could
lead to a double free.
This problem has now been fixed (hopefully).
One might ask whether a zero-sized buffer should be allowed at all,
but this is a question for another day.

Diff: diff --git a/src/libjasper/base/jas_stream.c b/src/libjasper/base/jas_stream.c
index f182972..29e4291 100644
--- a/src/libjasper/base/jas_stream.c
+++ b/src/libjasper/base/jas_stream.c
@@ -991,13 +991,14 @@ static int mem_read(jas_stream_obj_t *obj, char *buf, int cnt)
 
 static int mem_resize(jas_stream_memobj_t *m, int bufsize)
 {
 	unsigned char *buf;
 
-	assert(m->buf_);
+	//assert(m->buf_);
 	assert(bufsize >= 0);
-	if (!(buf = jas_realloc2(m->buf_, bufsize, sizeof(unsigned char)))) {
+	if (!(buf = jas_realloc2(m->buf_, bufsize, sizeof(unsigned char))) &&
+	  bufsize) {
 		return -1;
 	}
 	m->buf_ = buf;
 	m->bufsize_ = bufsize;
 	return 0;

Vulnerable code: 	assert(m->buf_);
	if (!(buf = jas_realloc2(m->buf_, bufsize, sizeof(unsigned char)))) {
Fixed code: 	//assert(m->buf_);
	if (!(buf = jas_realloc2(m->buf_, bufsize, sizeof(unsigned char))) &&
	  bufsize) {
CVE-2016-8887: NULL Pointer Dereference (CWE-476)
value: The jp2_colr_destroy function in libjasper/jp2/jp2_cod.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (NULL pointer dereference).
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2017-03-23T18:59Z
Repository: https://github.com/mdadams/jasper
Language: C
Files changed: src/libjasper/jp2/jp2_cod.c, src/libjasper/jp2/jp2_dec.c
Commit date: 2016-10-21 00:00:27 -0700
Commit message: Fixed a bug that resulted in the destruction of JP2 box data that had never
been constructed in the first place.

Diff: diff --git a/src/libjasper/jp2/jp2_cod.c b/src/libjasper/jp2/jp2_cod.c
index 6255fe3..dc0f66c 100644
--- a/src/libjasper/jp2/jp2_cod.c
+++ b/src/libjasper/jp2/jp2_cod.c
@@ -256,10 +256,14 @@ jp2_box_t *jp2_box_get(jas_stream_t *in)
 	}
 	boxinfo = jp2_boxinfolookup(box->type);
 	box->info = boxinfo;
 	box->ops = &boxinfo->ops;
 	box->len = len;
+	JAS_DBGLOG(10, (
+	  "preliminary processing of JP2 box: type=%c%s%c (0x%08x); length=%d\n",
+	  '"', boxinfo->name, '"', box->type, box->len
+	  ));
 	if (box->len == 1) {
 		if (jp2_getuint64(in, &extlen)) {
 			goto error;
 		}
 		if (extlen > 0xffffffffUL) {
@@ -280,10 +284,13 @@ jp2_box_t *jp2_box_get(jas_stream_t *in)
 	if (dataflag) {
 		if (!(tmpstream = jas_stream_memopen(0, 0))) {
 			goto error;
 		}
 		if (jas_stream_copy(tmpstream, in, box->datalen)) {
+			// Mark the box data as never having been constructed
+			// so that we will not errantly attempt to destroy it later.
+			box->ops = &jp2_boxinfo_unk.ops;
 			jas_eprintf("cannot copy box data\n");
 			goto error;
 		}
 		jas_stream_rewind(tmpstream);
 
diff --git a/src/libjasper/jp2/jp2_dec.c b/src/libjasper/jp2/jp2_dec.c
index 07210f1..2996393 100644
--- a/src/libjasper/jp2/jp2_dec.c
+++ b/src/libjasper/jp2/jp2_dec.c
@@ -153,11 +153,11 @@ jas_image_t *jp2_decode(jas_stream_t *in, char *optstr)
 
 	/* Get more boxes... */
 	found = 0;
 	while ((box = jp2_box_get(in))) {
 		if (jas_getdbglevel() >= 1) {
-			jas_eprintf("box type %s\n", box->info->name);
+			jas_eprintf("got box type %s\n", box->info->name);
 		}
 		switch (box->type) {
 		case JP2_BOX_JP2C:
 			found = 1;
 			break;

Vulnerable code: 			jas_eprintf("box type %s\n", box->info->name);
Fixed code: 	JAS_DBGLOG(10, (
	  "preliminary processing of JP2 box: type=%c%s%c (0x%08x); length=%d\n",
	  '"', boxinfo->name, '"', box->type, box->len
	  ));
			// Mark the box data as never having been constructed
			// so that we will not errantly attempt to destroy it later.
			box->ops = &jp2_boxinfo_unk.ops;
			jas_eprintf("got box type %s\n", box->info->name);
CVE-2016-9387: Integer Overflow or Wraparound (CWE-190)
value: Integer overflow in the jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.13 allows remote attackers to have unspecified impact via a crafted file, which triggers an assertion failure.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 7.8
Published: 2017-03-23T18:59Z
Repository: https://github.com/mdadams/jasper
Language: C
Files changed: src/libjasper/jpc/jpc_dec.c
Commit date: 2016-10-23 03:34:35 -0700
Commit message: Fixed another integer overflow problem.

Diff: diff --git a/src/libjasper/jpc/jpc_dec.c b/src/libjasper/jpc/jpc_dec.c
index d2f258e..4f24660 100644
--- a/src/libjasper/jpc/jpc_dec.c
+++ b/src/libjasper/jpc/jpc_dec.c
@@ -1193,10 +1193,11 @@ static int jpc_dec_process_siz(jpc_dec_t *dec, jpc_ms_t *ms)
 	jpc_dec_tile_t *tile;
 	jpc_dec_tcomp_t *tcomp;
 	int htileno;
 	int vtileno;
 	jpc_dec_cmpt_t *cmpt;
+	size_t size;
 
 	dec->xstart = siz->xoff;
 	dec->ystart = siz->yoff;
 	dec->xend = siz->width;
 	dec->yend = siz->height;
@@ -1229,11 +1230,14 @@ static int jpc_dec_process_siz(jpc_dec_t *dec, jpc_ms_t *ms)
 
 	dec->image = 0;
 
 	dec->numhtiles = JPC_CEILDIV(dec->xend - dec->tilexoff, dec->tilewidth);
 	dec->numvtiles = JPC_CEILDIV(dec->yend - dec->tileyoff, dec->tileheight);
-	dec->numtiles = dec->numhtiles * dec->numvtiles;
+	if (!jas_safe_size_mul(dec->numhtiles, dec->numvtiles, &size)) {
+		return -1;
+	}
+	dec->numtiles = size;
 	JAS_DBGLOG(10, ("numtiles = %d; numhtiles = %d; numvtiles = %d;\n",
 	  dec->numtiles, dec->numhtiles, dec->numvtiles));
 	if (!(dec->tiles = jas_alloc2(dec->numtiles, sizeof(jpc_dec_tile_t)))) {
 		return -1;
 	}

Vulnerable code: 	dec->numtiles = dec->numhtiles * dec->numvtiles;
Fixed code: 	size_t size;
	if (!jas_safe_size_mul(dec->numhtiles, dec->numvtiles, &size)) {
		return -1;
	}
	dec->numtiles = size;
CVE-2016-9390: Improper Input Validation (CWE-20)
value: The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted image file.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 5.5
Published: 2017-03-23T18:59Z
Repository: https://github.com/mdadams/jasper
Language: C
Files changed: src/libjasper/jpc/jpc_cs.c, src/libjasper/jpc/jpc_dec.c
Commit date: 2016-10-25 16:18:51 -0700
Commit message: Ensure that not all tiles lie outside the image area.

Diff: diff --git a/src/libjasper/jpc/jpc_cs.c b/src/libjasper/jpc/jpc_cs.c
index 1e0c9af..cf7199e 100644
--- a/src/libjasper/jpc/jpc_cs.c
+++ b/src/libjasper/jpc/jpc_cs.c
@@ -506,10 +506,14 @@ static int jpc_siz_getparms(jpc_ms_t *ms, jpc_cstate_t *cstate,
 	}
 	if (!siz->width || !siz->height || !siz->tilewidth ||
 	  !siz->tileheight || !siz->numcomps || siz->numcomps > 16384) {
 		return -1;
 	}
+	if (siz->tilexoff >= siz->width || siz->tileyoff >= siz->height) {
+		jas_eprintf("all tiles are outside the image area\n");
+		return -1;
+	}
 	if (!(siz->comps = jas_alloc2(siz->numcomps, sizeof(jpc_sizcomp_t)))) {
 		return -1;
 	}
 	for (i = 0; i < siz->numcomps; ++i) {
 		if (jpc_getuint8(in, &tmp) ||
diff --git a/src/libjasper/jpc/jpc_dec.c b/src/libjasper/jpc/jpc_dec.c
index 2dc3db8..4bddb22 100644
--- a/src/libjasper/jpc/jpc_dec.c
+++ b/src/libjasper/jpc/jpc_dec.c
@@ -1214,10 +1214,11 @@ static int jpc_dec_process_siz(jpc_dec_t *dec, jpc_ms_t *ms)
 	dec->tilewidth = siz->tilewidth;
 	dec->tileheight = siz->tileheight;
 	dec->tilexoff = siz->tilexoff;
 	dec->tileyoff = siz->tileyoff;
 	dec->numcomps = siz->numcomps;
+
 	if (!(dec->cp = jpc_dec_cp_create(dec->numcomps))) {
 		return -1;
 	}
 
 	if (!(dec->cmpts = jas_alloc2(dec->numcomps, sizeof(jpc_dec_cmpt_t)))) {

Fixed code: 	if (siz->tilexoff >= siz->width || siz->tileyoff >= siz->height) {
		jas_eprintf("all tiles are outside the image area\n");
		return -1;
	}
CVE-2016-9560: Out-of-bounds Write (CWE-787)
value: Stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before 1.900.30 allows remote attackers to have unspecified impact via a crafted image.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2017-02-15T19:59Z
Repository: https://github.com/mdadams/jasper
Language: C
Files changed: src/libjasper/jpc/jpc_dec.c
Commit date: 2016-11-20 04:43:00 -0800
Commit message: Fixed an array overflow problem in the JPC decoder.

Diff: diff --git a/src/libjasper/jpc/jpc_dec.c b/src/libjasper/jpc/jpc_dec.c
index 446dc59..1da54a7 100644
--- a/src/libjasper/jpc/jpc_dec.c
+++ b/src/libjasper/jpc/jpc_dec.c
@@ -710,11 +710,11 @@ static int jpc_dec_tileinit(jpc_dec_t *dec, jpc_dec_tile_t *tile)
 	uint_fast32_t tmpxstart;
 	uint_fast32_t tmpystart;
 	uint_fast32_t tmpxend;
 	uint_fast32_t tmpyend;
 	jpc_dec_cp_t *cp;
-	jpc_tsfb_band_t bnds[64];
+	jpc_tsfb_band_t bnds[JPC_MAXBANDS];
 	jpc_pchg_t *pchg;
 	int pchgno;
 	jpc_dec_cmpt_t *cmpt;
 
 	cp = tile->cp;

Vulnerable code: 	jpc_tsfb_band_t bnds[64];
Fixed code: 	jpc_tsfb_band_t bnds[JPC_MAXBANDS];
CVE-2016-9583: Out-of-bounds Read (CWE-125)
value: An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2018-08-01T17:29Z
Repository: https://github.com/mdadams/jasper
Language: C
Files changed: src/libjasper/jpc/jpc_t2cod.c
Commit date: 2016-11-26 20:54:24 -0800
Commit message: Fixed a bug in the packet iterator code.
Added a new regression test case.

Diff: diff --git a/data/test/good/PoC2.jpc b/data/test/good/PoC2.jpc
new file mode 100644
index 0000000..6ce94dd
Binary files /dev/null and b/data/test/good/PoC2.jpc differ
diff --git a/src/libjasper/jpc/jpc_t2cod.c b/src/libjasper/jpc/jpc_t2cod.c
index 5e2c862..91114e3 100644
--- a/src/libjasper/jpc/jpc_t2cod.c
+++ b/src/libjasper/jpc/jpc_t2cod.c
@@ -247,13 +247,13 @@ static int jpc_pi_nextrpcl(register jpc_pi_t *pi)
 		for (compno = 0, picomp = pi->picomps; compno < pi->numcomps;
 		  ++compno, ++picomp) {
 			for (rlvlno = 0, pirlvl = picomp->pirlvls; rlvlno <
 			  picomp->numrlvls; ++rlvlno, ++pirlvl) {
 				// Check for the potential for overflow problems.
-				if (pirlvl->prcwidthexpn + pi->picomp->numrlvls >
+				if (pirlvl->prcwidthexpn + picomp->numrlvls >
 				  JAS_UINTFAST32_NUMBITS - 2 ||
-				  pirlvl->prcheightexpn + pi->picomp->numrlvls >
+				  pirlvl->prcheightexpn + picomp->numrlvls >
 				  JAS_UINTFAST32_NUMBITS - 2) {
 					return -1;
 				}
 				xstep = picomp->hsamp * (JAS_CAST(uint_fast32_t, 1) <<
 				  (pirlvl->prcwidthexpn + picomp->numrlvls - rlvlno - 1));

Vulnerable code: 				if (pirlvl->prcwidthexpn + pi->picomp->numrlvls >
				  pirlvl->prcheightexpn + pi->picomp->numrlvls >
Fixed code: 				if (pirlvl->prcwidthexpn + picomp->numrlvls >
				  pirlvl->prcheightexpn + picomp->numrlvls >