Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2022-1382: NULL Pointer Dereference (CWE-476)
value: NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of making the radare2 crash, thus affecting the availability of the system.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2022-04-18T01:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/bin/format/ne/ne.c
Commit date: 2022-04-17 00:38:35 +0200
Commit message: Fix null deref in ne parser ##crash

* Reported by @cnitlrt via huntr.dev
* BountyID: d8b6d239-6d7b-4783-b26b-5be848c01aa1/
* Reproducer: nenull

Diff: diff --git a/libr/bin/format/ne/ne.c b/libr/bin/format/ne/ne.c
index d9dc886d2177..e61ca7049101 100644
--- a/libr/bin/format/ne/ne.c
+++ b/libr/bin/format/ne/ne.c
@@ -75,11 +75,11 @@ static char *__func_name_from_ord(const char *module, ut16 ordinal) {
 	return name;
 }
 
 RList *r_bin_ne_get_segments(r_bin_ne_obj_t *bin) {
 	int i;
-	if (!bin) {
+	if (!bin || !bin->segment_entries) {
 		return NULL;
 	}
 	RList *segments = r_list_newf (free);
 	for (i = 0; i < bin->ne_header->SegCount; i++) {
 		RBinSection *bs = R_NEW0 (RBinSection);

Vulnerable code: 	if (!bin) {
Fixed code: 	if (!bin || !bin->segment_entries) {
CVE-2022-1383: Out-of-bounds Write (CWE-787)
value: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.8. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.1
Published: 2022-04-18T01:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/bin/format/mach0/coresymbolication.c
Commit date: 2022-04-17 01:06:07 +0200
Commit message: Fix oobread bug in NE parser ##crash

* Reported by @cnitlrt via huntrdev
* BountyID: 02b4b563-b946-4343-9092-38d1c5cd60c9
* Reproducer: neoobread
Diff: diff --git a/libr/bin/format/mach0/coresymbolication.c b/libr/bin/format/mach0/coresymbolication.c
index f350199550b5..f554898c9401 100644
--- a/libr/bin/format/mach0/coresymbolication.c
+++ b/libr/bin/format/mach0/coresymbolication.c
@@ -272,16 +272,16 @@ RCoreSymCacheElement *r_coresym_cache_element_new(RBinFile *bf, RBuffer *buf, ut
 			sect->vaddr = sect->paddr = r_read_ble (cursor, false, bits);
 			if (sect->vaddr < page_zero_size) {
 				sect->vaddr += page_zero_size;
 			}
 			cursor += word_size;
-			if (cursor >= end) {
+			if (cursor + word_size >= end) {
 				break;
 			}
 			sect->size = r_read_ble (cursor, false, bits);
 			cursor += word_size;
-			if (cursor >= end) {
+			if (cursor + word_size >= end) {
 				break;
 			}
 			ut64 sect_name_off = r_read_ble (cursor, false, bits);
 			if (!i && !sect_name_off) {
 				relative_to_strings = true;
@@ -289,11 +289,15 @@ RCoreSymCacheElement *r_coresym_cache_element_new(RBinFile *bf, RBuffer *buf, ut
 			cursor += word_size;
 			if (bits == 32) {
 				cursor += word_size;
 			}
 			string_origin = relative_to_strings? b + start_of_strings : sect_start;
-			sect->name = str_dup_safe (b, string_origin + (size_t)sect_name_off, end);
+			if (sect_name_off < (ut64)(size_t)(end - string_origin)) {
+				sect->name = str_dup_safe (b, string_origin + sect_name_off, end);
+			} else {
+				sect->name = strdup ("");
+			}
 		}
 	}
 	if (hdr->n_symbols) {
 		result->symbols = R_NEWS0 (RCoreSymCacheElementSymbol, hdr->n_symbols);
 		if (!result->symbols) {

Vulnerable code: 			if (cursor >= end) {
			if (cursor >= end) {
			sect->name = str_dup_safe (b, string_origin + (size_t)sect_name_off, end);
Fixed code: 			if (cursor + word_size >= end) {
			if (cursor + word_size >= end) {
			if (sect_name_off < (ut64)(size_t)(end - string_origin)) {
				sect->name = str_dup_safe (b, string_origin + sect_name_off, end);
			} else {
				sect->name = strdup ("");
			}
CVE-2022-1444: Use After Free (CWE-416)
value: heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.7.0. This vulnerability is capable of inducing denial of service.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 5.5
Published: 2022-04-23T22:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/util/new_rbtree.c
Commit date: 2022-04-23 03:17:34 +0200
Commit message: Redo minor cleanup in new_rbtree

Diff: diff --git a/libr/util/new_rbtree.c b/libr/util/new_rbtree.c
index 6a4242059c38..4328c09c37a1 100644
--- a/libr/util/new_rbtree.c
+++ b/libr/util/new_rbtree.c
@@ -136,13 +136,13 @@ static RRBNode *_rot_twice(RRBNode *root, int dir) {
 
 R_API bool r_crbtree_insert(RRBTree *tree, void *data, RRBComparator cmp, void *user) {
 	r_return_val_if_fail (tree && data && cmp, false);
 	bool inserted = false;
 
-	if (tree->root == NULL) {
+	if (!tree->root) {
 		tree->root = _node_new (data, NULL);
-		if (tree->root == NULL) {
+		if (!tree->root) {
 			return false;
 		}
 		inserted = true;
 		goto out_exit;
 	}

Vulnerable code: 	if (tree->root == NULL) {
		if (tree->root == NULL) {
Fixed code: 	if (!tree->root) {
		if (!tree->root) {
CVE-2022-1452: Out-of-bounds Read (CWE-125)
value: Out-of-bounds Read in r_bin_java_bootstrap_methods_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. More details see [CWE-125: Out-of-bounds read](https://cwe.mitre.org/data/definitions/125.html).
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.1
Published: 2022-04-24T21:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: shlr/java/class.c
Commit date: 2022-04-24 21:53:13 +0200
Commit message: Fix oobread in java parser ##crash

* Reported by @bet4it via @huntrdev
* BountyID c8f4c2de-7d96-4ad4-857a-c099effca2d6
* Reproducer: bootstrap.class

Diff: diff --git a/shlr/java/class.c b/shlr/java/class.c
index 80919af8ecbd..a2c6747cf185 100644
--- a/shlr/java/class.c
+++ b/shlr/java/class.c
@@ -6931,10 +6931,14 @@ R_API RBinJavaAttrInfo *r_bin_java_bootstrap_methods_attr_new(RBinJavaObj *bin,
 	ut64 offset = 0;
 	RBinJavaAttrInfo *attr = r_bin_java_default_attr_new (bin, buffer, sz, buf_offset);
 	offset += 6;
 	if (attr) {
 		attr->type = R_BIN_JAVA_ATTR_TYPE_BOOTSTRAP_METHODS_ATTR;
+		if (offset + 8 > sz)  {
+			free (attr);
+			return NULL;
+		}
 		attr->info.bootstrap_methods_attr.num_bootstrap_methods = R_BIN_JAVA_USHORT (buffer, offset);
 		offset += 2;
 		attr->info.bootstrap_methods_attr.bootstrap_methods = r_list_newf (r_bin_java_bootstrap_method_free);
 		for (i = 0; i < attr->info.bootstrap_methods_attr.num_bootstrap_methods; i++) {
 			// bsm = r_bin_java_bootstrap_method_new (bin, bin->b->cur);

Fixed code: 		if (offset + 8 > sz)  {
			free (attr);
			return NULL;
		}
CVE-2022-1649: NULL Pointer Dereference (CWE-476)
value: Null pointer dereference in libr/bin/format/mach0/mach0.c in radareorg/radare2 in GitHub repository radareorg/radare2 prior to 5.7.0. It is likely to be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/476.html).
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2022-05-10T17:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/bin/format/mach0/mach0.c
Commit date: 2022-05-10 11:50:25 +0200
Commit message: Fix null deref in macho parser ##crash

* Reported by Han0nly via huntrdev
* BountyID: c07e4918-cf86-4d2e-8969-5fb63575b449
* Reproducer: machonull

Diff: diff --git a/libr/bin/format/mach0/mach0.c b/libr/bin/format/mach0/mach0.c
index 4e8b97c7bae4..14bc321727b3 100644
--- a/libr/bin/format/mach0/mach0.c
+++ b/libr/bin/format/mach0/mach0.c
@@ -4578,10 +4578,13 @@ void MACH0_(iterate_chained_fixups)(struct MACH0_(obj_t) *bin, ut64 limit_start,
 			ut64 page_end_idx = (R_MIN (limit_end, end) - start) / page_size;
 			for (; page_idx <= page_end_idx; page_idx++) {
 				if (page_idx >= bin->chained_starts[i]->page_count) {
 					break;
 				}
+				if (!bin->chained_starts[i]->page_start) {
+					break;
+				}
 				ut16 page_start = bin->chained_starts[i]->page_start[page_idx];
 				if (page_start == DYLD_CHAINED_PTR_START_NONE) {
 					continue;
 				}
 				ut64 cursor = start + page_idx * page_size + page_start;

Fixed code: 				if (!bin->chained_starts[i]->page_start) {
					break;
				}
CVE-2022-1899: Out-of-bounds Read (CWE-125)
value: Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2022-05-26T17:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/bin/bfile.c
Commit date: 2022-05-26 17:42:39 +0200
Commit message: Fix integer overflow in string search causing oobread ##crash

* Reported by @greatergoodest via huntrdev
* BountyID: 8a3dc5cb-08b3-4807-82b2-77f08c137a04
* Reproducer bfileovf
Diff: diff --git a/libr/bin/bfile.c b/libr/bin/bfile.c
index 3216e5b7618d..bb9663fff17d 100644
--- a/libr/bin/bfile.c
+++ b/libr/bin/bfile.c
@@ -176,31 +176,31 @@ static int string_scan_range(RList *list, RBinFile *bf, int min,
 		r_charset_free (ch);
 	}
 	free (charset);
 	RConsIsBreaked is_breaked = (bin && bin->consb.is_breaked)? bin->consb.is_breaked: NULL;
 	// may oobread
-	while (needle < to) {
+	while (needle < to && needle < UT64_MAX - 4) {
 		if (is_breaked && is_breaked ()) {
 			break;
 		}
 		// smol optimization
-		if (needle + 4 < to) {
-			ut32 n1 = r_read_le32 (buf + needle - from);
+		if (needle < to - 4) {
+			ut32 n1 = r_read_le32 (buf + (needle - from));
 			if (!n1) {
 				needle += 4;
 				continue;
 			}
 		}
-		rc = r_utf8_decode (buf + needle - from, to - needle, NULL);
+		rc = r_utf8_decode (buf + (needle - from), to - needle, NULL);
 		if (!rc) {
 			needle++;
 			continue;
 		}
 		bool addr_aligned = !(needle % 4);
 
 		if (type == R_STRING_TYPE_DETECT) {
-			char *w = (char *)buf + needle + rc - from;
+			char *w = (char *)buf + (needle + rc - from);
 			if (((to - needle) > 8 + rc)) {
 				// TODO: support le and be
 				bool is_wide32le = (needle + rc + 2 < to) && (!w[0] && !w[1] && !w[2] && w[3] && !w[4]);
 				// reduce false positives
 				if (is_wide32le) {
@@ -246,11 +246,11 @@ static int string_scan_range(RList *list, RBinFile *bf, int min,
 				rc = r_utf16le_decode (buf + needle - from, to - needle, &r);
 				if (rc == 1) {
 					rc = 2;
 				}
 			} else {
-				rc = r_utf8_decode (buf + needle - from, to - needle, &r);
+				rc = r_utf8_decode (buf + (needle - from), to - needle, &r);
 				if (rc > 1) {
 					str_type = R_STRING_TYPE_UTF8;
 				}
 			}
 

Vulnerable code: 	while (needle < to) {
		if (needle + 4 < to) {
			ut32 n1 = r_read_le32 (buf + needle - from);
		rc = r_utf8_decode (buf + needle - from, to - needle, NULL);
			char *w = (char *)buf + needle + rc - from;
				rc = r_utf8_decode (buf + needle - from, to - needle, &r);
Fixed code: 	while (needle < to && needle < UT64_MAX - 4) {
		if (needle < to - 4) {
			ut32 n1 = r_read_le32 (buf + (needle - from));
		rc = r_utf8_decode (buf + (needle - from), to - needle, NULL);
			char *w = (char *)buf + (needle + rc - from);
				rc = r_utf8_decode (buf + (needle - from), to - needle, &r);
CVE-2022-28069: Out-of-bounds Write (CWE-787)
value: A heap buffer overflow in vax_opfunction in radare2 5.4.2 and 5.4.0.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2023-08-22T19:16Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/anal/p/anal_vax.c
Commit date: 2021-10-30 12:09:00 +0200
Commit message: Fix oobread in VAX disassembler (tests_64920) ##crash

Reported by giantbranch of NSFOCUS TIANJI Lab

Diff: diff --git a/libr/anal/p/anal_vax.c b/libr/anal/p/anal_vax.c
index 93169b184877..3e6e47d941fa 100644
--- a/libr/anal/p/anal_vax.c
+++ b/libr/anal/p/anal_vax.c
@@ -148,11 +148,11 @@ static int vax_op(RAnal *anal, RAnalOp *op, ut64 addr, const ut8 *buf, int len,
 		op->type = R_ANAL_OP_TYPE_SUB;
 		break;
 	case 0xfb: // calls
 		op->type = R_ANAL_OP_TYPE_CALL;
 		op->size = 7;
-		{
+		if (len > 6) {
 			int oa = 3;
 			ut32 delta = buf[oa];
 			delta |= (ut32)(buf[oa + 1]) << 8;
 			delta |= (ut32)(buf[oa + 2]) << 16;
 			delta |= (ut32)(buf[oa + 3]) << 24;

Vulnerable code: 		{
Fixed code: 		if (len > 6) {
CVE-2022-28070: NULL Pointer Dereference (CWE-476)
value: A null pointer deference in __core_anal_fcn function in radare2 5.4.2 and 5.4.0.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2023-08-22T19:16Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/core/canal.c
Commit date: 2021-10-30 14:11:29 +0200
Commit message: Fix oobread crash in the analysis loop with corrupted ELFs (tests_64928) ##crash

Reported by giantbranch of NSFOCUS TIANJI Lab

Diff: diff --git a/libr/core/canal.c b/libr/core/canal.c
index c60601f051a4..4eb88caf9043 100644
--- a/libr/core/canal.c
+++ b/libr/core/canal.c
@@ -829,11 +829,11 @@ static bool __core_anal_fcn(RCore *core, ut64 at, ut64 from, int reftype, int de
 					RListIter *iter;
 					RBinSymbol *sym;
 					const RList *syms = r_bin_get_symbols (core->bin);
 					ut64 baddr = r_config_get_i (core->config, "bin.baddr");
 					r_list_foreach (syms, iter, sym) {
-						if ((sym->paddr + baddr) == fcn->addr && !strcmp (sym->type, R_BIN_TYPE_FUNC_STR)) {
+						if (sym->type && (sym->paddr + baddr) == fcn->addr && !strcmp (sym->type, R_BIN_TYPE_FUNC_STR)) {
 							free (new_name);
 							new_name = r_str_newf ("sym.%s", sym->name);
 							break;
 						}
 					}

Vulnerable code: 						if ((sym->paddr + baddr) == fcn->addr && !strcmp (sym->type, R_BIN_TYPE_FUNC_STR)) {
Fixed code: 						if (sym->type && (sym->paddr + baddr) == fcn->addr && !strcmp (sym->type, R_BIN_TYPE_FUNC_STR)) {
CVE-2022-28071: Use After Free (CWE-416)
value: A use after free in r_reg_get_name_idx function in radare2 5.4.2 and 5.4.0.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.5
Published: 2023-08-22T19:16Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/core/anal_tp.c
Commit date: 2021-10-30 12:09:00 +0200
Commit message: Fix UAF in aaft (tests_64923) ##crash

Reported by giantbranch of NSFOCUS TIANJI Lab

Diff: diff --git a/libr/core/anal_tp.c b/libr/core/anal_tp.c
index 8f7a93c8f5e8..cfc275b6f214 100644
--- a/libr/core/anal_tp.c
+++ b/libr/core/anal_tp.c
@@ -502,15 +502,16 @@ R_API void r_core_anal_type_match(RCore *core, RAnalFunction *fcn) {
 	bool prop = false;
 	bool prev_var = false;
 	char prev_type[256] = {0};
 	const char *prev_dest = NULL;
 	char *ret_reg = NULL;
-	const char *pc = r_reg_get_name (core->dbg->reg, R_REG_NAME_PC);
-	if (!pc) {
-        free (buf);
+	const char *_pc = r_reg_get_name (core->dbg->reg, R_REG_NAME_PC);
+	if (!_pc) {
+		free (buf);
 		return;
 	}
+	char *pc = strdup (_pc);
 	RRegItem *r = r_reg_get (core->dbg->reg, pc, -1);
 	if (!r) {
 		free (buf);
 		return;
 	}
@@ -776,6 +777,7 @@ out_function:
 	R_FREE (ret_reg);
 	R_FREE (ret_type);
 	free (buf);
 	r_cons_break_pop();
 	anal_emul_restore (core, hc, dt, et);
+	free (pc);
 }

Vulnerable code: 	const char *pc = r_reg_get_name (core->dbg->reg, R_REG_NAME_PC);
	if (!pc) {
        free (buf);
Fixed code: 	const char *_pc = r_reg_get_name (core->dbg->reg, R_REG_NAME_PC);
	if (!_pc) {
		free (buf);
	char *pc = strdup (_pc);
	free (pc);
CVE-2022-28072: Out-of-bounds Write (CWE-787)
value: A heap buffer overflow in r_read_le32 function in radare25.4.2 and 5.4.0.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2023-08-22T19:16Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/anal/p/anal_hexagon.c
Commit date: 2021-10-30 12:09:00 +0200
Commit message: Fix oobread crash in RAnal.hexagon (tests_64900) ##crash

Reported by giantbranch of NSFOCUS TIANJI Lab

Diff: diff --git a/libr/anal/p/anal_hexagon.c b/libr/anal/p/anal_hexagon.c
index 7f92d5b6dec4..a5dc15718dd1 100644
--- a/libr/anal/p/anal_hexagon.c
+++ b/libr/anal/p/anal_hexagon.c
@@ -8,12 +8,15 @@
 #include "hexagon.h"
 #include "hexagon_insn.h"
 #include "hexagon_anal.h"
 
 static int hexagon_v6_op(RAnal *anal, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAnalOpMask mask) {
-	HexInsn hi = {0};;
+	HexInsn hi = {0};
 	ut32 data = 0;
+	if (len < 4) {
+		return 0;
+	}
 	data = r_read_le32 (buf);
 	int size = hexagon_disasm_instruction (data, &hi, (ut32) addr);
 	op->size = size;
 	if (size <= 0) {
 		return size;

Vulnerable code: 	HexInsn hi = {0};;
Fixed code: 	HexInsn hi = {0};
	if (len < 4) {
		return 0;
	}
CVE-2022-4398: Integer Overflow or Wraparound (CWE-190)
value: Integer Overflow or Wraparound in GitHub repository radareorg/radare2 prior to 5.8.0.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 7.8
Published: 2022-12-10T20:15Z
Repository: https://github.com/radareorg/radare2
Language: Other
Files changed: dist/docker/Dockerfile, libr/core/canal.c
Commit date: 2022-12-01 13:57:46 +0100
Commit message: Fix integer overflow in fuzzed dwarf rendering in graphs ##crash

* Reported by @solid-snail via huntrdev
* BountyID: c6f8d3ef-5420-4eba-9a5f-aba5e2b5fea2/
* Reproducer: `intof_mod`

Diff: diff --git a/dist/docker/Dockerfile b/dist/docker/Dockerfile
index af908b4aefbe..f1c4467bacdb 100644
--- a/dist/docker/Dockerfile
+++ b/dist/docker/Dockerfile
@@ -68,10 +68,13 @@ RUN DEBIAN_FRONTEND=noninteractive dpkg --add-architecture i386 && \
   gcc \
   git \
   bison \
   pkg-config \
   make \
+  python3 \
+  python3-pip \
+  sudo \
   glib-2.0 \
   libc6:i386 \
   libncurses5:i386 \
   libstdc++6:i386 \
   gnupg2 \
diff --git a/libr/core/canal.c b/libr/core/canal.c
index be6bd1532646..d858cefdfbfe 100644
--- a/libr/core/canal.c
+++ b/libr/core/canal.c
@@ -1388,10 +1388,14 @@ static char *core_anal_graph_label(RCore *core, RAnalBlock *bb, int opts) {
 			r_bin_addr2line (core->bin, at, file, sizeof (file) - 1, &line);
 			if (line != 0 && line != oline && strcmp (file, "??")) {
 				filestr = r_file_slurp_line (file, line, 0);
 				if (filestr) {
 					int flen = strlen (filestr);
+					if (idx < 0 || ST32_ADD_OVFCHK (idx, flen + 8)) {
+						R_LOG_WARN ("integer overflow detected");
+						break;
+					}
 					cmdstr = realloc (cmdstr, idx + flen + 8);
 					memcpy (cmdstr + idx, filestr, flen);
 					idx += flen;
 					if (is_json) {
 						strcpy (cmdstr + idx, "\\n");

Fixed code:   python3 \
  python3-pip \
  sudo \
					if (idx < 0 || ST32_ADD_OVFCHK (idx, flen + 8)) {
						R_LOG_WARN ("integer overflow detected");
						break;
					}
CVE-2022-4843: NULL Pointer Dereference (CWE-476)
value: NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.8.2.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2022-12-29T18:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/io/io_bank.c
Commit date: 2022-12-29 17:08:22 +0100
Commit message: Fix null deref in io.bank ##crash

* BountyID: 075b2760-66a0-4d38-b3b5-e9934956ab7f
* Reported by @coolkingcole
* Reproducer `POCbank`

Diff: diff --git a/libr/io/io_bank.c b/libr/io/io_bank.c
index 7a62773dffde..5b170e74f4ef 100644
--- a/libr/io/io_bank.c
+++ b/libr/io/io_bank.c
@@ -784,11 +784,11 @@ R_API bool r_io_bank_read_at(RIO *io, const ut32 bankid, ut64 addr, ut8 *buf, in
 			continue;
 		}
 		const ut64 buf_off = R_MAX (addr, r_io_submap_from (sm)) - addr;
 		const int read_len = R_MIN (r_io_submap_to ((&fake_sm)),
 					     r_io_submap_to (sm)) - (addr + buf_off) + 1;
-		if (map->perm & R_PERM_RELOC) {
+		if (map->perm & R_PERM_RELOC && map->reloc_map) {
 			ret &= map->reloc_map->read (io, map, addr + buf_off, &buf[buf_off], read_len);
 		} else {
 			const ut64 paddr = addr + buf_off - r_io_map_from (map) + map->delta;
 			ret &= (r_io_fd_read_at (io, map->fd, paddr, &buf[buf_off], read_len) == read_len);
 		}
@@ -873,11 +873,11 @@ R_API int r_io_bank_read_from_submap_at(RIO *io, const ut32 bankid, ut64 addr, u
 	RIOMap *map = r_io_map_get_by_ref (io, &sm->mapref);
 	if (!map || !(map->perm & R_PERM_R)) {
 		return -1;
 	}
 	const int read_len = R_MIN (len, r_io_submap_to (sm) - addr + 1);
-	if (map->perm & R_PERM_RELOC) {
+	if (map->perm & R_PERM_RELOC && map->reloc_map) {
 		return map->reloc_map->read (io, map, addr, buf, read_len);
 	}
 	const ut64 paddr = addr - r_io_map_from (map) + map->delta;
 	return r_io_fd_read_at (io, map->fd, paddr, buf, read_len);
 }

Vulnerable code: 		if (map->perm & R_PERM_RELOC) {
	if (map->perm & R_PERM_RELOC) {
Fixed code: 		if (map->perm & R_PERM_RELOC && map->reloc_map) {
	if (map->perm & R_PERM_RELOC && map->reloc_map) {
CVE-2023-1605: Uncontrolled Resource Consumption (CWE-400)
value: Denial of Service in GitHub repository radareorg/radare2 prior to 5.8.6.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 7.5
Published: 2023-03-23T19:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/bin/p/bin_coff.c
Commit date: 2023-03-21 19:08:00 +0100
Commit message: fix segfault when bin->symbols is NULL #21503

Diff: diff --git a/libr/bin/p/bin_coff.c b/libr/bin/p/bin_coff.c
index caecf55a53a9..deeb7c7e9b22 100644
--- a/libr/bin/p/bin_coff.c
+++ b/libr/bin/p/bin_coff.c
@@ -503,15 +503,17 @@ static RList *patch_relocs(RBin *b) {
 		return NULL;
 	}
 
 	size_t nimports = 0;
 	int i;
-	for (i = 0; i < bin->hdr.f_nsyms; i++) {
-		if (is_imported_symbol (&bin->symbols[i])) {
-			nimports++;
+	if (bin->symbols) {
+		for (i = 0; i < bin->hdr.f_nsyms; i++) {
+			if (is_imported_symbol (&bin->symbols[i])) {
+				nimports++;
+			}
+			i += bin->symbols[i].n_numaux;
 		}
-		i += bin->symbols[i].n_numaux;
 	}
 	ut64 m_vaddr = UT64_MAX;
 	if (nimports) {
 		ut64 offset = 0;
 		RIOBank *bank = b->iob.bank_get (io, io->bank);

Vulnerable code: 	for (i = 0; i < bin->hdr.f_nsyms; i++) {
		if (is_imported_symbol (&bin->symbols[i])) {
			nimports++;
		i += bin->symbols[i].n_numaux;
Fixed code: 	if (bin->symbols) {
		for (i = 0; i < bin->hdr.f_nsyms; i++) {
			if (is_imported_symbol (&bin->symbols[i])) {
				nimports++;
			}
			i += bin->symbols[i].n_numaux;
CVE-2023-47016: Out-of-bounds Write (CWE-787)
value: radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a crash in r_read_le32 in libr/include/r_endian.h.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2023-11-22T07:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/bin/p/bin_xnu_kernelcache.c
Commit date: 2023-10-29 03:20:44 +0100
Commit message: Fix #22349 - oobread in xnu kernelcache ##crash

* Reproducer rabin_hbo_194
* Reported by @gandalf4a

Diff: diff --git a/libr/bin/p/bin_xnu_kernelcache.c b/libr/bin/p/bin_xnu_kernelcache.c
index b3da18139fe6..19da1a203ed1 100644
--- a/libr/bin/p/bin_xnu_kernelcache.c
+++ b/libr/bin/p/bin_xnu_kernelcache.c
@@ -986,11 +986,11 @@ static void process_constructors(RKernelCacheObj *obj, struct MACH0_(obj_t) *mac
 			free (buf);
 			break;
 		}
 		int j;
 		int count = 0;
-		for (j = 0; j < section->size; j += 8) {
+		for (j = 0; j + 7 < section->size; j += 8) {
 			ut64 addr64 = K_RPTR (buf + j);
 			ut64 paddr64 = section->paddr + paddr + j;
 			if (mode == R_K_CONSTRUCTOR_TO_ENTRY) {
 				RBinAddr *ba = newEntry (paddr64, addr64, type);
 				r_list_append (ret, ba);

Vulnerable code: 		for (j = 0; j < section->size; j += 8) {
Fixed code: 		for (j = 0; j + 7 < section->size; j += 8) {
CVE-2023-5686: Out-of-bounds Write (CWE-787)
value: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2023-10-20T17:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: shlr/java/code.c
Commit date: 2023-10-19 17:50:11 +0200
Commit message: Fix oobread in the java disassembler ##asan

* Causes UB when performing analysis, not exploitable
* https://huntr.com/bounties/bbfe1f76-8fa1-4a8c-909d-65b16e970be0/
* Reported by @gandalf4a

Diff: diff --git a/shlr/java/code.c b/shlr/java/code.c
index 97347eb8d1b8..efafecf8c972 100644
--- a/shlr/java/code.c
+++ b/shlr/java/code.c
@@ -204,13 +204,13 @@ R_API int java_print_opcode(RBinJavaObj *obj, ut64 addr, int idx, const ut8 *byt
 	case 0xa4: // if_icmple
 	case 0xa5: // if_acmpne
 	case 0xa6: // if_acmpne
 	case 0xa7: // goto
 	case 0xa8: // jsr
-		if (len > 1) {
-			snprintf (output, outlen, "%s 0x%04"PFMT64x, JAVA_OPS[idx].name,
-					(addr + (short)USHORT (bytes, 1)));
+		if (len > 3) {
+			const short delta = USHORT (bytes, 1);
+			snprintf (output, outlen, "%s 0x%04"PFMT64x, JAVA_OPS[idx].name, addr + delta);
 			output[outlen - 1] = 0;
 			return update_bytes_consumed (JAVA_OPS[idx].size);
 		}
 		return -1;
 		// XXX - Figure out what constitutes the [<high>] value

Vulnerable code: 		if (len > 1) {
			snprintf (output, outlen, "%s 0x%04"PFMT64x, JAVA_OPS[idx].name,
					(addr + (short)USHORT (bytes, 1)));
Fixed code: 		if (len > 3) {
			const short delta = USHORT (bytes, 1);
			snprintf (output, outlen, "%s 0x%04"PFMT64x, JAVA_OPS[idx].name, addr + delta);
CVE-2018-16749: NULL Pointer Dereference (CWE-476)
value: In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted file.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 6.5
Published: 2018-09-09T15:29Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: coders/png.c
Commit date: 2018-05-01 19:13:48 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1119

Diff: diff --git a/coders/png.c b/coders/png.c
index 31c0b8450..3d6eb7db2 100644
--- a/coders/png.c
+++ b/coders/png.c
@@ -4582,11 +4582,11 @@ static Image *ReadOneJNGImage(MngInfo *mng_info,
 
         if (logging != MagickFalse)
           (void) LogMagickEvent(CoderEvent,GetMagickModule(),
             "    Copying JDAT chunk data to color_blob.");
 
-        if (length != 0)
+        if ((length != 0) && (color_image != (Image *) NULL))
           {
             (void) WriteBlob(color_image,length,chunk);
             chunk=(unsigned char *) RelinquishMagickMemory(chunk);
           }
 

Vulnerable code:         if (length != 0)
Fixed code:         if ((length != 0) && (color_image != (Image *) NULL))
CVE-2019-11472: Divide By Zero (CWE-369)
value: ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the header indicates neither LSB first nor MSB first.
CWE description: The product divides a value by zero.
CVSS v3 base score: 6.5
Published: 2019-04-23T14:29Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: coders/xwd.c
Commit date: 2019-04-14 11:49:45 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1546

Diff: diff --git a/coders/xwd.c b/coders/xwd.c
index 186b3f1ca..94a2907c9 100644
--- a/coders/xwd.c
+++ b/coders/xwd.c
@@ -241,10 +241,13 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
     ThrowReaderException(CorruptImageError,"FileFormatVersionMismatch");
   if (header.header_size < sz_XWDheader)
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   if ((header.bits_per_pixel == 0) || (header.bits_per_pixel > 32))
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+  if ((header.bitmap_bit_order != MSBFirst) &&
+      (header.bitmap_bit_order != LSBFirst))
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   if (((header.bitmap_pad % 8) != 0) || (header.bitmap_pad > 32))
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   if (header.bitmap_unit > 32)
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   if (header.ncolors > 256)

Fixed code:   if ((header.bitmap_bit_order != MSBFirst) &&
      (header.bitmap_bit_order != LSBFirst))
    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
CVE-2019-13135: Use of Uninitialized Resource (CWE-908)
value: ImageMagick before 7.0.8-50 has a "use of uninitialized value" vulnerability in the function ReadCUTImage in coders/cut.c.
CWE description: The product uses or accesses a resource that has not been initialized.
CVSS v3 base score: 8.8
Published: 2019-07-01T20:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: coders/cut.c
Commit date: 2019-06-18 11:45:11 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1599

Diff: diff --git a/coders/cut.c b/coders/cut.c
index 2ef35f4c45..070136f228 100644
--- a/coders/cut.c
+++ b/coders/cut.c
@@ -566,10 +566,11 @@ static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)
 
   /* ----- Load RLE compressed raster ----- */
   BImgBuff=(unsigned char *) AcquireQuantumMemory((size_t) ldblk,
     sizeof(*BImgBuff));  /*Ldblk was set in the check phase*/
   if(BImgBuff==NULL) goto NoMemory;
+  (void) memset(BImgBuff,0,(size_t) ldblk*sizeof(*BImgBuff));
 
   offset=SeekBlob(image,6 /*sizeof(Header)*/,SEEK_SET);
   if (offset < 0)
     {
       if (palette != NULL)

Fixed code:   (void) memset(BImgBuff,0,(size_t) ldblk*sizeof(*BImgBuff));
CVE-2019-13137: Missing Release of Memory after Effective Lifetime (CWE-401)
value: ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadPSImage in coders/ps.c.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 6.5
Published: 2019-07-01T20:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: coders/ps.c
Commit date: 2019-06-18 11:54:17 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1601

Diff: diff --git a/coders/ps.c b/coders/ps.c
index bcc20d9b25..4ffd7296e1 100644
--- a/coders/ps.c
+++ b/coders/ps.c
@@ -747,10 +747,11 @@ static Image *ReadPSImage(const ImageInfo *image_info,ExceptionInfo *exception)
         &page.height);
       if (flags == NoValue)
         {
           (void) ThrowMagickException(exception,GetMagickModule(),OptionError,
             "InvalidGeometry","`%s'",option);
+          geometry=DestroyString(geometry);
           image=DestroyImage(image);
           return((Image *) NULL);
         }
       page.width=(size_t) ceil((double) (page.width*image->x_resolution/delta.x)
         -0.5);

Fixed code:           geometry=DestroyString(geometry);
CVE-2019-13295: Out-of-bounds Read (CWE-125)
value: ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a width of zero is mishandled.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: magick/threshold.c
Commit date: 2019-06-21 16:52:14 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1608

Diff: diff --git a/magick/threshold.c b/magick/threshold.c
index 763eb8552d..a53e839e6c 100644
--- a/magick/threshold.c
+++ b/magick/threshold.c
@@ -200,10 +200,12 @@ MagickExport Image *AdaptiveThresholdImage(const Image *image,
   assert(exception != (ExceptionInfo *) NULL);
   assert(exception->signature == MagickCoreSignature);
   threshold_image=CloneImage(image,0,0,MagickTrue,exception);
   if (threshold_image == (Image *) NULL)
     return((Image *) NULL);
+  if (width == 0)
+    return(threshold_image);
   if (SetImageStorageClass(threshold_image,DirectClass) == MagickFalse)
     {
       InheritException(exception,&threshold_image->exception);
       threshold_image=DestroyImage(threshold_image);
       return((Image *) NULL);

Fixed code:   if (width == 0)
    return(threshold_image);
CVE-2019-13297: Out-of-bounds Read (CWE-125)
value: ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a height of zero is mishandled.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: magick/threshold.c
Commit date: 2019-06-21 17:30:44 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1609

Diff: diff --git a/magick/threshold.c b/magick/threshold.c
index a53e839e6c..4a8c6b2e72 100644
--- a/magick/threshold.c
+++ b/magick/threshold.c
@@ -200,11 +200,11 @@ MagickExport Image *AdaptiveThresholdImage(const Image *image,
   assert(exception != (ExceptionInfo *) NULL);
   assert(exception->signature == MagickCoreSignature);
   threshold_image=CloneImage(image,0,0,MagickTrue,exception);
   if (threshold_image == (Image *) NULL)
     return((Image *) NULL);
-  if (width == 0)
+  if ((width == 0) || (height == 0))
     return(threshold_image);
   if (SetImageStorageClass(threshold_image,DirectClass) == MagickFalse)
     {
       InheritException(exception,&threshold_image->exception);
       threshold_image=DestroyImage(threshold_image);

Vulnerable code:   if (width == 0)
Fixed code:   if ((width == 0) || (height == 0))
CVE-2019-13300: Out-of-bounds Write (CWE-787)
value: ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling columns.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: magick/statistic.c
Commit date: 2019-06-16 14:36:10 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1586

Diff: diff --git a/magick/statistic.c b/magick/statistic.c
index 467fe20efe..7a07c52825 100644
--- a/magick/statistic.c
+++ b/magick/statistic.c
@@ -147,36 +147,43 @@ static MagickPixelPacket **DestroyPixelThreadSet(MagickPixelPacket **pixels)
       pixels[i]=(MagickPixelPacket *) RelinquishMagickMemory(pixels[i]);
   pixels=(MagickPixelPacket **) RelinquishMagickMemory(pixels);
   return(pixels);
 }
 
-static MagickPixelPacket **AcquirePixelThreadSet(const Image *image)
+static MagickPixelPacket **AcquirePixelThreadSet(const Image *images)
 {
+  const Image
+    *next;
+
   MagickPixelPacket
     **pixels;
 
   register ssize_t
     i,
     j;
 
   size_t
+    columns,
     number_threads;
 
   number_threads=(size_t) GetMagickResourceLimit(ThreadResource);
   pixels=(MagickPixelPacket **) AcquireQuantumMemory(number_threads,
     sizeof(*pixels));
   if (pixels == (MagickPixelPacket **) NULL)
     return((MagickPixelPacket **) NULL);
   (void) memset(pixels,0,number_threads*sizeof(*pixels));
+  columns=images->columns;
+  for (next=images; next != (Image *) NULL; next=next->next)
+    columns=MagickMax(next->columns,columns);
   for (i=0; i < (ssize_t) number_threads; i++)
   {
-    pixels[i]=(MagickPixelPacket *) AcquireQuantumMemory(image->columns,
+    pixels[i]=(MagickPixelPacket *) AcquireQuantumMemory(columns,
       sizeof(**pixels));
     if (pixels[i] == (MagickPixelPacket *) NULL)
       return(DestroyPixelThreadSet(pixels));
-    for (j=0; j < (ssize_t) image->columns; j++)
-      GetMagickPixelPacket(image,&pixels[i][j]);
+    for (j=0; j < (ssize_t) columns; j++)
+      GetMagickPixelPacket(images,&pixels[i][j]);
   }
   return(pixels);
 }
 
 static inline double EvaluateMax(const double x,const double y)

Vulnerable code: static MagickPixelPacket **AcquirePixelThreadSet(const Image *image)
    pixels[i]=(MagickPixelPacket *) AcquireQuantumMemory(image->columns,
    for (j=0; j < (ssize_t) image->columns; j++)
      GetMagickPixelPacket(image,&pixels[i][j]);
Fixed code: static MagickPixelPacket **AcquirePixelThreadSet(const Image *images)
  const Image
    *next;

    columns,
  columns=images->columns;
  for (next=images; next != (Image *) NULL; next=next->next)
    columns=MagickMax(next->columns,columns);
    pixels[i]=(MagickPixelPacket *) AcquireQuantumMemory(columns,
    for (j=0; j < (ssize_t) columns; j++)
      GetMagickPixelPacket(images,&pixels[i][j]);
CVE-2019-13304: Out-of-bounds Write (CWE-787)
value: ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: coders/pnm.c
Commit date: 2019-06-21 20:33:10 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1614

Diff: diff --git a/coders/pnm.c b/coders/pnm.c
index c10558d244..d3500b3ae0 100644
--- a/coders/pnm.c
+++ b/coders/pnm.c
@@ -1760,17 +1760,17 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image)
             break;
           for (x=0; x < (ssize_t) image->columns; x++)
           {
             *q++=(unsigned char) (GetPixelLuma(image,p) >= (QuantumRange/2.0) ?
               '0' : '1');
-            *q++=' ';
             if ((q-pixels+1) >= (ssize_t) sizeof(pixels))
               {
                 *q++='\n';
                 (void) WriteBlob(image,q-pixels,pixels);
                 q=pixels;
               }
+            *q++=' ';
             p++;
           }
           *q++='\n';
           (void) WriteBlob(image,q-pixels,pixels);
           q=pixels;

Vulnerable code:             *q++=' ';
Fixed code:             *q++=' ';
CVE-2019-13305: Off-by-one Error (CWE-193)
value: ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error.
CWE description: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CVSS v3 base score: 7.8
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: coders/pnm.c
Commit date: 2019-06-21 20:27:25 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1613

Diff: diff --git a/coders/pnm.c b/coders/pnm.c
index 7f818a869d..c10558d244 100644
--- a/coders/pnm.c
+++ b/coders/pnm.c
@@ -1828,18 +1828,18 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image)
                   ScaleQuantumToShort(index));
               else
                 count=(ssize_t) FormatLocaleString(buffer,MaxTextExtent,"%u ",
                   ScaleQuantumToLong(index));
             extent=(size_t) count;
-            (void) strncpy((char *) q,buffer,extent);
-            q+=extent;
-            if ((q-pixels+extent+2) >= sizeof(pixels))
+            if ((q-pixels+extent+1) >= sizeof(pixels))
               {
                 *q++='\n';
                 (void) WriteBlob(image,q-pixels,pixels);
                 q=pixels;
               }
+            (void) strncpy((char *) q,buffer,extent);
+            q+=extent;
             p++;
           }
           *q++='\n';
           (void) WriteBlob(image,q-pixels,pixels);
           q=pixels;
@@ -1903,18 +1903,18 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image)
                 count=(ssize_t) FormatLocaleString(buffer,MaxTextExtent,
                   "%u %u %u ",ScaleQuantumToLong(GetPixelRed(p)),
                   ScaleQuantumToLong(GetPixelGreen(p)),
                   ScaleQuantumToLong(GetPixelBlue(p)));
             extent=(size_t) count;
-            (void) strncpy((char *) q,buffer,extent);
-            q+=extent;
-            if ((q-pixels+extent+2) >= sizeof(pixels))
+            if ((q-pixels+extent+1) >= sizeof(pixels))
               {
                 *q++='\n';
                 (void) WriteBlob(image,q-pixels,pixels);
                 q=pixels;
               }
+            (void) strncpy((char *) q,buffer,extent);
+            q+=extent;
             p++;
           }
           *q++='\n';
           (void) WriteBlob(image,q-pixels,pixels);
           q=pixels;

Vulnerable code:             (void) strncpy((char *) q,buffer,extent);
            q+=extent;
            if ((q-pixels+extent+2) >= sizeof(pixels))
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;
            if ((q-pixels+extent+2) >= sizeof(pixels))
Fixed code:             if ((q-pixels+extent+1) >= sizeof(pixels))
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;
            if ((q-pixels+extent+1) >= sizeof(pixels))
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;
CVE-2019-13305: Out-of-bounds Write (CWE-787)
value: ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: coders/pnm.c
Commit date: 2019-06-21 20:27:25 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1613

Diff: diff --git a/coders/pnm.c b/coders/pnm.c
index 7f818a869d..c10558d244 100644
--- a/coders/pnm.c
+++ b/coders/pnm.c
@@ -1828,18 +1828,18 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image)
                   ScaleQuantumToShort(index));
               else
                 count=(ssize_t) FormatLocaleString(buffer,MaxTextExtent,"%u ",
                   ScaleQuantumToLong(index));
             extent=(size_t) count;
-            (void) strncpy((char *) q,buffer,extent);
-            q+=extent;
-            if ((q-pixels+extent+2) >= sizeof(pixels))
+            if ((q-pixels+extent+1) >= sizeof(pixels))
               {
                 *q++='\n';
                 (void) WriteBlob(image,q-pixels,pixels);
                 q=pixels;
               }
+            (void) strncpy((char *) q,buffer,extent);
+            q+=extent;
             p++;
           }
           *q++='\n';
           (void) WriteBlob(image,q-pixels,pixels);
           q=pixels;
@@ -1903,18 +1903,18 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image)
                 count=(ssize_t) FormatLocaleString(buffer,MaxTextExtent,
                   "%u %u %u ",ScaleQuantumToLong(GetPixelRed(p)),
                   ScaleQuantumToLong(GetPixelGreen(p)),
                   ScaleQuantumToLong(GetPixelBlue(p)));
             extent=(size_t) count;
-            (void) strncpy((char *) q,buffer,extent);
-            q+=extent;
-            if ((q-pixels+extent+2) >= sizeof(pixels))
+            if ((q-pixels+extent+1) >= sizeof(pixels))
               {
                 *q++='\n';
                 (void) WriteBlob(image,q-pixels,pixels);
                 q=pixels;
               }
+            (void) strncpy((char *) q,buffer,extent);
+            q+=extent;
             p++;
           }
           *q++='\n';
           (void) WriteBlob(image,q-pixels,pixels);
           q=pixels;

Vulnerable code:             (void) strncpy((char *) q,buffer,extent);
            q+=extent;
            if ((q-pixels+extent+2) >= sizeof(pixels))
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;
            if ((q-pixels+extent+2) >= sizeof(pixels))
Fixed code:             if ((q-pixels+extent+1) >= sizeof(pixels))
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;
            if ((q-pixels+extent+1) >= sizeof(pixels))
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;
CVE-2019-13306: Off-by-one Error (CWE-193)
value: ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors.
CWE description: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CVSS v3 base score: 7.8
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: coders/pnm.c
Commit date: 2019-06-21 20:16:54 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1612

Diff: diff --git a/coders/pnm.c b/coders/pnm.c
index 56f6063438..7f818a869d 100644
--- a/coders/pnm.c
+++ b/coders/pnm.c
@@ -1830,11 +1830,11 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image)
                 count=(ssize_t) FormatLocaleString(buffer,MaxTextExtent,"%u ",
                   ScaleQuantumToLong(index));
             extent=(size_t) count;
             (void) strncpy((char *) q,buffer,extent);
             q+=extent;
-            if ((q-pixels+extent+1) >= sizeof(pixels))
+            if ((q-pixels+extent+2) >= sizeof(pixels))
               {
                 *q++='\n';
                 (void) WriteBlob(image,q-pixels,pixels);
                 q=pixels;
               }
@@ -1905,11 +1905,11 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image)
                   ScaleQuantumToLong(GetPixelGreen(p)),
                   ScaleQuantumToLong(GetPixelBlue(p)));
             extent=(size_t) count;
             (void) strncpy((char *) q,buffer,extent);
             q+=extent;
-            if ((q-pixels+extent+1) >= sizeof(pixels))
+            if ((q-pixels+extent+2) >= sizeof(pixels))
               {
                 *q++='\n';
                 (void) WriteBlob(image,q-pixels,pixels);
                 q=pixels;
               }

Vulnerable code:             if ((q-pixels+extent+1) >= sizeof(pixels))
            if ((q-pixels+extent+1) >= sizeof(pixels))
Fixed code:             if ((q-pixels+extent+2) >= sizeof(pixels))
            if ((q-pixels+extent+2) >= sizeof(pixels))