Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-4778: Out-of-bounds Read (CWE-125)
value: Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2023-09-05T16:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/scene_manager/loader_bt.c
Commit date: 2023-09-05 16:59:13 +0200
Commit message: fixed #2589

Diff: diff --git a/src/scene_manager/loader_bt.c b/src/scene_manager/loader_bt.c
index 3f98c6fcf07..475e28384fd 100644
--- a/src/scene_manager/loader_bt.c
+++ b/src/scene_manager/loader_bt.c
@@ -445,16 +445,16 @@ char *gf_bt_get_next(GF_BTParser *parser, Bool point_break)
 	s32 i;
 	gf_bt_check_line(parser);
 	i=0;
 	has_quote = 0;
 	while (go) {
+		if (parser->line_pos+i>=parser->line_size) break;
+
 		if (parser->line_buffer[parser->line_pos + i] == '\"') {
 			if (!has_quote) has_quote = 1;
 			else has_quote = 0;
 			parser->line_pos += 1;
-
-			if (parser->line_pos+i==parser->line_size) break;
 			continue;
 		}
 		if (!has_quote) {
 			switch (parser->line_buffer[parser->line_pos + i]) {
 			case 0:

Vulnerable code: 
			if (parser->line_pos+i==parser->line_size) break;
Fixed code: 		if (parser->line_pos+i>=parser->line_size) break;
CVE-2023-48011: Use After Free (CWE-416)
value: GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a heap-use-after-free via the flush_ref_samples function at /gpac/src/isomedia/movie_fragments.c.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.8
Published: 2023-11-15T19:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/movie_fragments.c
Commit date: 2023-10-12 16:08:14 +0200
Commit message: Fixed #2611

Diff: diff --git a/src/isomedia/movie_fragments.c b/src/isomedia/movie_fragments.c
index b7f7ade327a..d665eeb9d05 100644
--- a/src/isomedia/movie_fragments.c
+++ b/src/isomedia/movie_fragments.c
@@ -589,10 +589,11 @@ u32 UpdateRuns(GF_ISOFile *movie, GF_TrackFragmentBox *traf)
 	//empty runs
 	if (traf->tfhd->EmptyDuration) {
 		while (gf_list_count(traf->TrackRuns)) {
 			trun = (GF_TrackFragmentRunBox *)gf_list_get(traf->TrackRuns, 0);
 			gf_list_rem(traf->TrackRuns, 0);
+			gf_list_del_item(movie->moof->trun_list, trun);
 			gf_isom_box_del_parent(&traf->child_boxes, (GF_Box *)trun);
 		}
 		traf->tfhd->flags |= GF_ISOM_TRAF_DUR_EMPTY;
 		if (traf->tfhd->EmptyDuration != traf->trex->def_sample_duration) {
 			traf->tfhd->def_sample_duration = traf->tfhd->EmptyDuration;
@@ -641,10 +642,11 @@ u32 UpdateRuns(GF_ISOFile *movie, GF_TrackFragmentBox *traf)
 		}
 		//empty list
 		if (!first_ent) {
 			i--;
 			gf_list_rem(traf->TrackRuns, i);
+			gf_list_del_item(movie->moof->trun_list, trun);
 			continue;
 		}
 		trun->flags = 0;
 
 		//size checking

Fixed code: 			gf_list_del_item(movie->moof->trun_list, trun);
			gf_list_del_item(movie->moof->trun_list, trun);
CVE-2023-48014: Out-of-bounds Write (CWE-787)
value: GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a stack overflow via the hevc_parse_vps_extension function at /media_tools/av_parsers.c.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2023-11-15T19:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/media_tools/av_parsers.c
Commit date: 2023-10-12 16:46:20 +0200
Commit message: Fixed #2613

Diff: diff --git a/src/media_tools/av_parsers.c b/src/media_tools/av_parsers.c
index 8a37040cf6c..6e2915d40d3 100644
--- a/src/media_tools/av_parsers.c
+++ b/src/media_tools/av_parsers.c
@@ -7724,17 +7724,23 @@ static Bool hevc_parse_vps_extension(HEVC_VPS *vps, GF_BitStream *bs)
 		for (i = 0; i < (num_scalability_types - splitting_flag); i++) {
 			dimension_id_len[i] = 1 + gf_bs_read_int_log_idx(bs, 3, "dimension_id_len_minus1", i);
 		}
 
 		if (splitting_flag) {
-			for (i = 0; i < num_scalability_types; i++) {
+			u32 num_bits=0;
+			for (i = 0; i < num_scalability_types-1; i++) {
 				dim_bit_offset[i] = 0;
+				num_bits+=dimension_id_len[i];
 				for (j = 0; j < i; j++)
 					dim_bit_offset[i] += dimension_id_len[j];
 			}
-			dimension_id_len[num_scalability_types - 1] = 1 + (5 - dim_bit_offset[num_scalability_types - 1]);
-			dim_bit_offset[num_scalability_types] = 6;
+			if (num_bits>=6) {
+				GF_LOG(GF_LOG_ERROR, GF_LOG_CODING, ("[HEVC] Too many its defined for dimension IDs (%d vs 5 max)\n", num_bits));
+				return -1;
+			}
+			dimension_id_len[num_scalability_types - 1] = 6 - num_bits; //1 + (5 - dim_bit_offset[num_scalability_types - 1]);
+			dim_bit_offset[num_scalability_types - 1] = 6;
 		}
 	}
 
 	vps_nuh_layer_id_present_flag = gf_bs_read_int_log(bs, 1, "vps_nuh_layer_id_present_flag");
 	vps->layer_id_in_nuh[0] = 0;

Vulnerable code: 			for (i = 0; i < num_scalability_types; i++) {
			dimension_id_len[num_scalability_types - 1] = 1 + (5 - dim_bit_offset[num_scalability_types - 1]);
			dim_bit_offset[num_scalability_types] = 6;
Fixed code: 			u32 num_bits=0;
			for (i = 0; i < num_scalability_types-1; i++) {
				num_bits+=dimension_id_len[i];
			if (num_bits>=6) {
				GF_LOG(GF_LOG_ERROR, GF_LOG_CODING, ("[HEVC] Too many its defined for dimension IDs (%d vs 5 max)\n", num_bits));
				return -1;
			}
			dimension_id_len[num_scalability_types - 1] = 6 - num_bits; //1 + (5 - dim_bit_offset[num_scalability_types - 1]);
			dim_bit_offset[num_scalability_types - 1] = 6;
CVE-2023-5520: Out-of-bounds Read (CWE-125)
value: Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.1
Published: 2023-10-11T12:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/reframe_ac3.c
Commit date: 2023-10-11 13:24:46 +0200
Commit message: ac3dmx: add remain size check (fixes #2627)

Diff: diff --git a/src/filters/reframe_ac3.c b/src/filters/reframe_ac3.c
index 1ffa99f638f..7b6452ed761 100644
--- a/src/filters/reframe_ac3.c
+++ b/src/filters/reframe_ac3.c
@@ -340,11 +340,11 @@ GF_Err ac3dmx_process(GF_Filter *filter)
 	GF_FilterPacket *pck, *dst_pck;
 	u8 *output;
 	u8 *start;
 	u32 pck_size, remain, prev_pck_size;
 	u64 cts;
-	
+
 restart:
 	cts = GF_FILTER_NO_TS;
 
 	//always reparse duration
 	if (!ctx->duration.num)
@@ -478,14 +478,14 @@ restart:
 			if ((cts > ctx->cts + ctx->timescale) || (ctx->cts > cts + ctx->timescale))
 				ctx->cts = cts;
 			cts = GF_FILTER_NO_TS;
 		}
 
-		if (!ctx->in_seek) {
+		if (!ctx->in_seek && remain >= ctx->hdr.framesize) {
 			dst_pck = gf_filter_pck_new_alloc(ctx->opid, ctx->hdr.framesize, &output);
 			if (!dst_pck) return GF_OUT_OF_MEM;
-			
+
 			if (ctx->src_pck) gf_filter_pck_merge_properties(ctx->src_pck, dst_pck);
 
 			memcpy(output, sync, ctx->hdr.framesize);
 			gf_filter_pck_set_dts(dst_pck, ctx->cts);
 			gf_filter_pck_set_cts(dst_pck, ctx->cts);

Vulnerable code: 	
		if (!ctx->in_seek) {
			
Fixed code: 
		if (!ctx->in_seek && remain >= ctx->hdr.framesize) {
CVE-2023-5586: NULL Pointer Dereference (CWE-476)
value: NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3.0-DEV.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.8
Published: 2023-10-15T01:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/reframe_rawpcm.c
Commit date: 2023-10-13 16:25:14 +0200
Commit message: Fixed #2632

Diff: diff --git a/src/filters/reframe_rawpcm.c b/src/filters/reframe_rawpcm.c
index 37decc00e63..406c6638ded 100644
--- a/src/filters/reframe_rawpcm.c
+++ b/src/filters/reframe_rawpcm.c
@@ -358,10 +358,18 @@ GF_Err pcmreframe_process(GF_Filter *filter)
 				}
 				GF_LOG(GF_LOG_WARNING, GF_LOG_MEDIA, ("[PCMReframe] Cannot find wave data chunk after %d bytes, aborting\n", ctx->probe_data_size));
 			}
 			wav_ok = GF_FALSE;
 		}
+		if (!ctx->ch) {
+			GF_LOG(GF_LOG_ERROR, GF_LOG_MEDIA, ("[PCMReframe] Channel count %d invalid in wave\n", ctx->ch));
+			wav_ok = GF_FALSE;
+		}
+		if (!ctx->sr) {
+			GF_LOG(GF_LOG_ERROR, GF_LOG_MEDIA, ("[PCMReframe] Samplerate %d invalid in wave\n", ctx->sr));
+			wav_ok = GF_FALSE;
+		}
 
 		ctx->wav_hdr_size = (u32) gf_bs_get_position(bs);
 
 		gf_bs_del(bs);
 		if (!wav_ok) {

Fixed code: 		if (!ctx->ch) {
			GF_LOG(GF_LOG_ERROR, GF_LOG_MEDIA, ("[PCMReframe] Channel count %d invalid in wave\n", ctx->ch));
			wav_ok = GF_FALSE;
		}
		if (!ctx->sr) {
			GF_LOG(GF_LOG_ERROR, GF_LOG_MEDIA, ("[PCMReframe] Samplerate %d invalid in wave\n", ctx->sr));
			wav_ok = GF_FALSE;
		}
CVE-2023-5998: Out-of-bounds Read (CWE-125)
value: Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3.0-DEV.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2023-11-07T19:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/reframe_mpgvid.c
Commit date: 2023-10-23 13:02:56 +0200
Commit message: reframe_mpgvid: add size check (fixes #2651)

Diff: diff --git a/src/filters/reframe_mpgvid.c b/src/filters/reframe_mpgvid.c
index 8e092f973c3..ecf25195552 100644
--- a/src/filters/reframe_mpgvid.c
+++ b/src/filters/reframe_mpgvid.c
@@ -1079,10 +1079,15 @@ GF_Err mpgviddmx_process(GF_Filter *filter)
 
 		//we skipped bytes already in store + end of start code present in packet, so the size of the first object
 		//needs adjustement
 		if (bytes_from_store) {
 			size += bytes_from_store + hdr_offset;
+			if (size > remain) {
+				e = GF_NON_COMPLIANT_BITSTREAM;
+				GF_LOG(GF_LOG_ERROR, GF_LOG_MEDIA, ("[MPGVid] packet too large to process (size %llu remain %d)\n", size, remain ));
+				break;
+			}
 		}
 
 		if ((e == GF_EOS) && !ctx->input_is_au_end) {
 			u8 b3 = start[remain-3];
 			u8 b2 = start[remain-2];

Fixed code: 			if (size > remain) {
				e = GF_NON_COMPLIANT_BITSTREAM;
				GF_LOG(GF_LOG_ERROR, GF_LOG_MEDIA, ("[MPGVid] packet too large to process (size %llu remain %d)\n", size, remain ));
				break;
			}
CVE-2024-0321: Out-of-bounds Write (CWE-787)
value: Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3-DEV.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2024-01-08T13:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/load_text.c
Commit date: 2023-10-17 16:32:29 +0200
Commit message: gf_text_get_utf8_line: add dest buffer len check (fixes #2647)

Diff: diff --git a/src/filters/load_text.c b/src/filters/load_text.c
index 63733982288..877b285a809 100644
--- a/src/filters/load_text.c
+++ b/src/filters/load_text.c
@@ -375,10 +375,14 @@ char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicod
 		}
 		if ( j >= GF_ARRAY_LENGTH(szLineConv) ) {
 			GF_LOG(GF_LOG_DEBUG, GF_LOG_PARSER, ("[TXTIn] Line too long to convert to utf8 (len: %d)\n", len));
 			j = GF_ARRAY_LENGTH(szLineConv) -1 ;
 		}
+		if ( j >= lineSize ) {
+			GF_LOG(GF_LOG_DEBUG, GF_LOG_PARSER, ("[TXTIn] UT8 converted line too long for buffer (len: %d, buffer: %d)\n", j, lineSize));
+			j = lineSize-1 ;
+		}
 		szLineConv[j] = 0;
 		strcpy(szLine, szLineConv);
 		return sOK;
 	}
 

Fixed code: 		if ( j >= lineSize ) {
			GF_LOG(GF_LOG_DEBUG, GF_LOG_PARSER, ("[TXTIn] UT8 converted line too long for buffer (len: %d, buffer: %d)\n", j, lineSize));
			j = lineSize-1 ;
		}
CVE-2024-0322: Out-of-bounds Read (CWE-125)
value: Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2024-01-08T13:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/reframe_ac3.c
Commit date: 2023-10-12 12:26:50 +0200
Commit message: fix 5692dc7: make test more strict (#2627)

Diff: diff --git a/src/filters/reframe_ac3.c b/src/filters/reframe_ac3.c
index 7b6452ed761..a73455978df 100644
--- a/src/filters/reframe_ac3.c
+++ b/src/filters/reframe_ac3.c
@@ -478,16 +478,15 @@ restart:
 			if ((cts > ctx->cts + ctx->timescale) || (ctx->cts > cts + ctx->timescale))
 				ctx->cts = cts;
 			cts = GF_FILTER_NO_TS;
 		}
 
-		if (!ctx->in_seek && remain >= ctx->hdr.framesize) {
+		if (!ctx->in_seek && remain >= sync_pos + ctx->hdr.framesize) {
 			dst_pck = gf_filter_pck_new_alloc(ctx->opid, ctx->hdr.framesize, &output);
 			if (!dst_pck) return GF_OUT_OF_MEM;
 
 			if (ctx->src_pck) gf_filter_pck_merge_properties(ctx->src_pck, dst_pck);
-
 			memcpy(output, sync, ctx->hdr.framesize);
 			gf_filter_pck_set_dts(dst_pck, ctx->cts);
 			gf_filter_pck_set_cts(dst_pck, ctx->cts);
 			if (ctx->timescale && (ctx->timescale!=ctx->sample_rate))
 				gf_filter_pck_set_duration(dst_pck, (u32) gf_timestamp_rescale(AC3_FRAME_SIZE, ctx->sample_rate, ctx->timescale));

Vulnerable code: 		if (!ctx->in_seek && remain >= ctx->hdr.framesize) {

Fixed code: 		if (!ctx->in_seek && remain >= sync_pos + ctx->hdr.framesize) {
CVE-2024-24267: Missing Release of Memory after Effective Lifetime (CWE-401)
value: gpac v2.2.1 was discovered to contain a memory leak via the gfio_blob variable in the gf_fileio_from_blob function.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 7.5
Published: 2024-02-05T18:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/utils/os_file.c
Commit date: 2023-08-29 14:19:22 +0200
Commit message: fix #2571

Diff: diff --git a/src/utils/os_file.c b/src/utils/os_file.c
index 4b7afef83bb..43609777c93 100644
--- a/src/utils/os_file.c
+++ b/src/utils/os_file.c
@@ -1424,16 +1424,16 @@ static GF_FileIO *gf_fileio_from_blob(const char *file_name)
 	u32 blob_size, flags;
 	GF_FileIOBlob *gfio_blob;
 	GF_Err e = gf_blob_get(file_name, &blob_data, &blob_size, &flags);
 	if (e || !blob_data) return NULL;
     gf_blob_release(file_name);
-    
+
     if (flags) {
         GF_LOG(GF_LOG_ERROR, GF_LOG_CORE, ("[Core] Attempt at creating a GFIO object on blob corrupted or in transfer, not supported !"));
         return NULL;
     }
-    
+
 	GF_SAFEALLOC(gfio_blob, GF_FileIOBlob);
 	if (!gfio_blob) return NULL;
 	gfio_blob->data = blob_data;
 	gfio_blob->size = blob_size;
 	GF_FileIO *res = gf_fileio_new((char *) file_name, gfio_blob, gfio_blob_open, gfio_blob_seek, gfio_blob_read, NULL, gfio_blob_tell, gfio_blob_eof, NULL);
@@ -1450,11 +1450,14 @@ GF_FileIO *gf_fileio_from_mem(const char *URL, const u8 *data, u32 size)
 	GF_SAFEALLOC(gfio_blob, GF_FileIOBlob);
 	if (!gfio_blob) return NULL;
 	gfio_blob->data = (u8 *) data;
 	gfio_blob->size = size;
 	GF_FileIO *res = gf_fileio_new((char *) URL, gfio_blob, gfio_blob_open, gfio_blob_seek, gfio_blob_read, NULL, gfio_blob_tell, gfio_blob_eof, NULL);
-	if (!res) return NULL;
+	if (!res)  {
+		gf_free(gfio_blob);
+		return NULL;
+	}
 	res->gets = gfio_blob_gets;
 	if (URL)
 		gfio_blob->url_crc = gf_crc_32(URL, (u32) strlen(URL) );
 	gf_fopen(gf_fileio_url(res), "r");
 	return res;
@@ -1967,6 +1970,5 @@ char* gf_url_colon_suffix(const char *path, char assign_sep)
 			}
 		}
 	}
 	return sep;
 }
-

Vulnerable code:     
    
	if (!res) return NULL;

Fixed code: 

	if (!res)  {
		gf_free(gfio_blob);
		return NULL;
	}
CVE-2024-6061: Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
value: A vulnerability has been found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this vulnerability is the function isoffin_process of the file src/filters/isoffin_read.c of the component MP4Box. The manipulation leads to infinite loop. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of the patch is 20c0f29139a82779b86453ce7f68d0681ec7624c. It is recommended to apply a patch to fix this issue. The identifier VDB-268789 was assigned to this vulnerability.
CWE description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Published: 2024-06-17T20:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/isoffin_read.c, src/filters/isoffin_read_ch.c
Commit date: 2024-06-12 15:25:10 +0200
Commit message: fixed #2871

Diff: diff --git a/src/filters/isoffin_read.c b/src/filters/isoffin_read.c
index c66d7e8da76..41cb74425eb 100644
--- a/src/filters/isoffin_read.c
+++ b/src/filters/isoffin_read.c
@@ -1722,15 +1722,15 @@ static GF_Err isoffin_process(GF_Filter *filter)
 
 					gf_filter_pid_set_eos(ch->pid);
 				}
 				break;
 			} else if (ch->last_state==GF_ISOM_INVALID_FILE) {
-				ch->nb_empty_retry++;
 				if (!ch->eos_sent) {
 					ch->eos_sent = 1;
 					read->eos_signaled = GF_TRUE;
 					gf_filter_pid_set_eos(ch->pid);
+					ch->playing = GF_FALSE;
 				}
 				return ch->last_state;
 			} else {
 				if ((ch->last_state==GF_OK) && ch->sap_only)
 					gf_filter_ask_rt_reschedule(filter, 1);
diff --git a/src/filters/isoffin_read_ch.c b/src/filters/isoffin_read_ch.c
index 7daab03628c..491e9c2793f 100644
--- a/src/filters/isoffin_read_ch.c
+++ b/src/filters/isoffin_read_ch.c
@@ -534,11 +534,10 @@ void isor_reader_get_sample(ISOMChannel *ch)
 		u32 sample_count = gf_isom_get_sample_count(ch->owner->mov, ch->track);
 		ch->sample_data_offset = 0;
 		/*incomplete file - check if we're still downloading or not*/
 		if (gf_isom_get_missing_bytes(ch->owner->mov, ch->track)) {
 			ch->last_state = GF_ISOM_INCOMPLETE_FILE;
-			ch->nb_empty_retry = 0;
 			if (ch->owner->mem_load_mode==2)
 				ch->owner->force_fetch = GF_TRUE;
 
 			if (!ch->owner->input_loaded) {
 				ch->last_state = GF_OK;

Vulnerable code: 				ch->nb_empty_retry++;
			ch->nb_empty_retry = 0;
Fixed code: 					ch->playing = GF_FALSE;
CVE-2024-6062: NULL Pointer Dereference (CWE-476)
value: A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this issue is the function swf_svg_add_iso_sample of the file src/filters/load_text.c of the component MP4Box. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 31e499d310a48bd17c8b055a0bfe0fe35887a7cd. It is recommended to apply a patch to fix this issue. VDB-268790 is the identifier assigned to this vulnerability.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
Published: 2024-06-17T20:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/load_text.c
Commit date: 2024-06-12 15:31:30 +0200
Commit message: fixed #2872

Diff: diff --git a/src/filters/load_text.c b/src/filters/load_text.c
index c1f4adc04d6..07a818401e4 100644
--- a/src/filters/load_text.c
+++ b/src/filters/load_text.c
@@ -2533,10 +2533,11 @@ exit:
 static GF_Err swf_svg_add_iso_sample(void *user, const u8 *data, u32 length, u64 timestamp, Bool isRap)
 {
 	GF_FilterPacket *pck;
 	u8 *pck_data;
 	GF_TXTIn *ctx = (GF_TXTIn *)user;
+	if (!data || !length) return GF_BAD_PARAM;
 
 	if (ctx->seek_state==2) {
 		Double ts = (Double) timestamp;
 		ts/=1000;
 		if (ts<ctx->start_range) return GF_OK;

Fixed code: 	if (!data || !length) return GF_BAD_PARAM;
CVE-2024-6063: NULL Pointer Dereference (CWE-476)
value: A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been classified as problematic. This affects the function m2tsdmx_on_event of the file src/filters/dmx_m2ts.c of the component MP4Box. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8767ed0a77c4b02287db3723e92c2169f67c85d5. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-268791.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
Published: 2024-06-17T21:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/dmx_m2ts.c
Commit date: 2024-06-12 15:35:23 +0200
Commit message: fixed #2873

Diff: diff --git a/src/filters/dmx_m2ts.c b/src/filters/dmx_m2ts.c
index 75b7cf0ee70..715467e680c 100644
--- a/src/filters/dmx_m2ts.c
+++ b/src/filters/dmx_m2ts.c
@@ -1209,10 +1209,13 @@ static void m2tsdmx_on_event(GF_M2TS_Demuxer *ts, u32 evt_type, void *param)
 	{
 		GF_M2TS_SL_PCK *pck = (GF_M2TS_SL_PCK*)param;
 		GF_BitStream *bs;
 		GF_M2TS_Prop *t;
 
+		//for now all SCTE35 must be associated with a stream
+		if (!pck->stream) return;
+
 		// convey SCTE35 splice info to all streams of the program
 		u32 count = gf_list_count(pck->stream->program->streams);
 		for (i=0; i<count; i++) {
 			GF_M2TS_PES *es = gf_list_get(pck->stream->program->streams, i);
 			if (!es->user) {

Fixed code: 		//for now all SCTE35 must be associated with a stream
		if (!pck->stream) return;
CVE-2021-23803: Incorrect Authorization (CWE-863)
value: This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the security of the application. When the template is set to allow/disallow the use of certain functions, adding control characters (x00-x08) after the function will bypass these restrictions.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 9.8
Published: 2021-12-17T20:15Z
Repository: https://github.com/nette/latte
Language: PHP
Files changed: src/Latte/Compiler/Parser.php, tests/Latte/Parser.errors.phpt
Commit date: 2021-11-23 12:35:48 +0100
Commit message: Parser: removes all control characters from template [Closes #279]

Diff: diff --git a/src/Latte/Compiler/Parser.php b/src/Latte/Compiler/Parser.php
index a57f1c9f..3f541f2f 100644
--- a/src/Latte/Compiler/Parser.php
+++ b/src/Latte/Compiler/Parser.php
@@ -92,10 +92,15 @@ public function parse(string $input): array
 	{
 		if (Helpers::startsWith($input, "\u{FEFF}")) { // BOM
 			$input = substr($input, 3);
 		}
 
+		if (preg_match('#[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]#', $input, $m, PREG_OFFSET_CAPTURE)) {
+			trigger_error('Template contains control character \x' . dechex(ord($m[0][0])) . ' on line ' . (substr_count($input, "\n", 0, $m[0][1]) + 1) . '.', E_USER_WARNING);
+			$input = preg_replace('#[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]#', '', $input);
+		}
+
 		$this->input = $input = str_replace("\r\n", "\n", $input);
 		$this->offset = 0;
 		$this->line = 1;
 		$this->output = [];
 
diff --git a/tests/Latte/Parser.errors.phpt b/tests/Latte/Parser.errors.phpt
index 5b87b1f1..6b5246b2 100644
--- a/tests/Latte/Parser.errors.phpt
+++ b/tests/Latte/Parser.errors.phpt
@@ -58,5 +58,12 @@
 Assert::exception(function () use (&$parser) {
 	$parser = new Parser;
 	$parser->parse("\n{");
 }, Latte\CompileException::class, 'Malformed tag.');
 Assert::same(2, $parser->getLine());
+
+
+Assert::error(function () use (&$res) {
+	$parser = new Parser;
+	$res = $parser->parse("a\x00\x1F\x7Fb");
+}, E_USER_WARNING, 'Template contains control character \x0 on line 1.');
+Assert::same('ab', $res[0]->text);

Fixed code: 		if (preg_match('#[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]#', $input, $m, PREG_OFFSET_CAPTURE)) {
			trigger_error('Template contains control character \x' . dechex(ord($m[0][0])) . ' on line ' . (substr_count($input, "\n", 0, $m[0][1]) + 1) . '.', E_USER_WARNING);
			$input = preg_replace('#[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]#', '', $input);
		}



Assert::error(function () use (&$res) {
	$parser = new Parser;
	$res = $parser->parse("a\x00\x1F\x7Fb");
}, E_USER_WARNING, 'Template contains control character \x0 on line 1.');
Assert::same('ab', $res[0]->text);
CVE-2022-32171: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript payload will be executed and allow an attacker to access the user’s credentials.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2022-10-06T18:16Z
Repository: https://github.com/zinclabs/zinc
Language: Other
Files changed: web/src/views/Template.vue, web/src/views/User.vue
Commit date: 2022-09-10 04:36:26 -0700
Commit message: Hotfix/mend vulnerabilities (#521)

* fix mend vulnerabilities

* fix mend vulnerabilities
Diff: diff --git a/web/src/views/Template.vue b/web/src/views/Template.vue
index 6b307b0..08ad9eb 100644
--- a/web/src/views/Template.vue
+++ b/web/src/views/Template.vue
@@ -173,11 +173,11 @@ export default defineComponent({
     const deleteTemplate = (props) => {
       $q.dialog({
         title: "Delete template",
         message:
           "You are about to delete this template: <ul><li>" +
-          props.row.name +
+          escape(props.row.name) +
           "</li></ul>",
         cancel: true,
         persistent: true,
         html: true,
       }).onOk(() => {
diff --git a/web/src/views/User.vue b/web/src/views/User.vue
index b61f79f..94b5713 100644
--- a/web/src/views/User.vue
+++ b/web/src/views/User.vue
@@ -126,11 +126,11 @@ export default defineComponent({
     const deleteUser = (props) => {
       $q.dialog({
         title: "Delete user",
         message:
           "You are about to delete this user: <ul><li>" +
-          props.row.id +
+          escape(props.row.id) +
           "</li></ul>",
         cancel: true,
         persistent: true,
         html: true,
       }).onOk(() => {

Vulnerable code:           props.row.name +
          props.row.id +
Fixed code:           escape(props.row.name) +
          escape(props.row.id) +
CVE-2022-32172: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user deletes a template with a XSS payload in the name field, the Javascript payload will be executed and allow an attacker to access the user’s credentials.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2022-10-06T18:16Z
Repository: https://github.com/zinclabs/zinc
Language: Other
Files changed: web/src/views/Template.vue, web/src/views/User.vue
Commit date: 2022-09-10 04:36:26 -0700
Commit message: Hotfix/mend vulnerabilities (#521)

* fix mend vulnerabilities

* fix mend vulnerabilities
Diff: diff --git a/web/src/views/Template.vue b/web/src/views/Template.vue
index 6b307b0..08ad9eb 100644
--- a/web/src/views/Template.vue
+++ b/web/src/views/Template.vue
@@ -173,11 +173,11 @@ export default defineComponent({
     const deleteTemplate = (props) => {
       $q.dialog({
         title: "Delete template",
         message:
           "You are about to delete this template: <ul><li>" +
-          props.row.name +
+          escape(props.row.name) +
           "</li></ul>",
         cancel: true,
         persistent: true,
         html: true,
       }).onOk(() => {
diff --git a/web/src/views/User.vue b/web/src/views/User.vue
index b61f79f..94b5713 100644
--- a/web/src/views/User.vue
+++ b/web/src/views/User.vue
@@ -126,11 +126,11 @@ export default defineComponent({
     const deleteUser = (props) => {
       $q.dialog({
         title: "Delete user",
         message:
           "You are about to delete this user: <ul><li>" +
-          props.row.id +
+          escape(props.row.id) +
           "</li></ul>",
         cancel: true,
         persistent: true,
         html: true,
       }).onOk(() => {

Vulnerable code:           props.row.name +
          props.row.id +
Fixed code:           escape(props.row.name) +
          escape(props.row.id) +
CVE-2020-26290: Improper Verification of Cryptographic Signature (CWE-347)
value: Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library. The vulnerabilities have been addressed in version 2.27.0 by using the xml-roundtrip-validator from Mattermost (see related references).
CWE description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CVSS v3 base score: 9.6
Published: 2020-12-28T20:15Z
Repository: https://github.com/dexidp/dex
Language: Unknown
Commit date: 2020-12-14 03:21:11 -0500
Commit message: Merge pull request from GHSA-m9hp-7r99-94h5

connector/saml: Validate XML roundtrip data before processing request
CVE-2022-39222: Missing Authorization (CWE-862)
value: Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public clients (and by extension, clients accepting tokens issued by those Dex instances) are affected by this vulnerability if they are running a version prior to 2.35.0. An attacker can exploit this vulnerability by making a victim navigate to a malicious website and guiding them through the OIDC flow, stealing the OAuth authorization code in the process. The authorization code then can be exchanged by the attacker for a token, gaining access to applications accepting that token. Version 2.35.0 has introduced a fix for this issue. Users are advised to upgrade. There are no known workarounds for this issue.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 6.5
Published: 2022-10-06T18:16Z
Repository: https://github.com/dexidp/dex
Language: Unknown
Commit date: 2022-09-28 16:10:11 +0200
Commit message: Merge pull request from GHSA-vh7g-p26c-j2cw

Add HMAC protection on /approval endpoint
CVE-2022-4520: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in WSO2 carbon-registry up to 4.8.11. It has been rated as problematic. Affected by this issue is some unknown functionality of the file components/registry/org.wso2.carbon.registry.search.ui/src/main/resources/web/search/advancedSearchForm-ajaxprocessor.jsp of the component Advanced Search. The manipulation of the argument mediaType/rightOp/leftOp/rightPropertyValue/leftPropertyValue leads to cross site scripting. The attack may be launched remotely. Upgrading to version 4.8.12 is able to address this issue. The name of the patch is 0c827cc1b14b82d8eb86117ab2e43c34bb91ddb4. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215900.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-15T21:15Z
Repository: https://github.com/wso2/carbon-registry
Language: Unknown
Commit date: 2022-11-10 18:43:46 +0530
Commit message: Merge pull request #404 from Yasasr1/master

Fix XSS vulnerability in registry advanced search
CVE-2022-4521: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic has been found in WSO2 carbon-registry up to 4.8.6. This affects an unknown part of the component Request Parameter Handler. The manipulation of the argument parentPath/path/username/path/profile_menu leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 4.8.7 is able to address this issue. The name of the patch is 9f967abfde9317bee2cda469dbc09b57d539f2cc. It is recommended to upgrade the affected component. The identifier VDB-215901 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-15T21:15Z
Repository: https://github.com/wso2/carbon-registry
Language: Unknown
Commit date: 2022-07-12 11:41:47 +0530
Commit message: Merge pull request #399 from bhagyasakalanka/master-xss

Encode request parameters in registry profiles UI.
CVE-2024-32876: Insufficient Information (NVD-CWE-noinfo)
value: NewPipe is an Android app for video streaming written in Java. It supports exporting and importing backups, as a way to let users move their data to a new device effortlessly. However, in versions 0.13.4 through 0.26.1, importing a backup file from an untrusted source could have resulted in Arbitrary Code Execution. This is because backups are serialized/deserialized using Java's Object Serialization Stream Protocol, which can allow constructing any class in the app, unless properly restricted.

To exploit this vulnerability, an attacker would need to build a backup file containing the exploit, and then persuade a user into importing it. During the import process, the malicious code would be executed, possibly crashing the app, stealing user data from the NewPipe app, performing nasty actions through Android APIs, and attempting Android JVM/Sandbox escapes through vulnerabilities in the Android OS.

The attack can take place only if the user imports a malicious backup file, so an attacker would need to trick a user into importing a backup file from a source they can control. The implementation details of the malicious backup file can be independent of the attacked user or the device they are being run on, and do not require additional privileges.

All NewPipe versions from 0.13.4 to 0.26.1 are vulnerable. NewPipe version 0.27.0 fixes the issue by doing the following: Restrict the classes that can be deserialized when calling Java's Object Serialization Stream Protocol, by adding a whitelist with only innocuous data-only classes that can't lead to Arbitrary Code Execution; deprecate backups serialized with Java's Object Serialization Stream Protocol; use JSON serialization for all newly created backups (but still include an alternative file serialized with Java's Object Serialization Stream Protocol in the backup zip for backwards compatibility); show a warning to the user when attempting to import a backup where the only available serialization mode is Java's Object Serialization Stream Protocol (note that in the future this serialization mode will be removed completely).

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-24T19:15Z
Repository: https://github.com/TeamNewPipe/NewPipe
Language: Unknown
Commit date: 2024-04-23 19:22:17 +0200
Commit message: Merge pull request from GHSA-wxrm-jhpf-vp6v

Fix preferences import vulnerability
CVE-2017-20178: Insufficient Information (NVD-CWE-noinfo)
value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Codiad 2.8.0. It has been rated as problematic. Affected by this issue is the function saveJSON of the file components/install/process.php. The manipulation of the argument data leads to information disclosure. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 2.8.1 is able to address this issue. The patch is identified as 517119de673e62547ee472a730be0604f44342b5. It is recommended to upgrade the affected component. VDB-221498 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2023-02-21T18:15Z
Repository: https://github.com/Codiad/Codiad
Language: PHP
Files changed: components/install/process.php
Commit date: 2017-04-18 19:01:22 -0400
Commit message: fixed vuln

added \r\n to saveJSON function to prevent sensitive information disclosure
Diff: diff --git a/components/install/process.php b/components/install/process.php
index 68deffe..5a52769 100644
--- a/components/install/process.php
+++ b/components/install/process.php
@@ -31,11 +31,11 @@ function saveFile($file, $data)
     fclose($write);
 }
 
 function saveJSON($file, $data)
 {
-    $data = "<?php/*|" . json_encode($data) . "|*/?>";
+    $data = "<?php/*|\r\n" . json_encode($data) . "\r\n|*/?>";
     saveFile($file, $data);
 }
 
 function encryptPassword($p)
 {

Vulnerable code:     $data = "<?php/*|" . json_encode($data) . "|*/?>";
Fixed code:     $data = "<?php/*|\r\n" . json_encode($data) . "\r\n|*/?>";
CVE-2019-17534: Use After Free (CWE-416)
value: vips_foreign_load_gif_scan_image in foreign/gifload.c in libvips before 8.8.2 tries to access a color map before a DGifGetImageDesc call, leading to a use-after-free.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 8.8
Published: 2019-10-13T02:15Z
Repository: https://github.com/libvips/libvips
Language: C
Files changed: libvips/foreign/gifload.c
Commit date: 2019-08-27 12:50:52 +0100
Commit message: fetch map after DGifGetImageDesc()

Earlier refactoring broke GIF map fetch.

Diff: diff --git a/libvips/foreign/gifload.c b/libvips/foreign/gifload.c
index 67fe4c80..a394da7a 100644
--- a/libvips/foreign/gifload.c
+++ b/libvips/foreign/gifload.c
@@ -406,13 +406,12 @@ vips_foreign_load_gif_code_next( VipsForeignLoadGif *gif,
 static int
 vips_foreign_load_gif_scan_image( VipsForeignLoadGif *gif ) 
 {
 	VipsObjectClass *class = VIPS_OBJECT_GET_CLASS( gif );
 	GifFileType *file = gif->file;
-	ColorMapObject *map = file->Image.ColorMap ?
-		file->Image.ColorMap : file->SColorMap;
 
+	ColorMapObject *map;
 	GifByteType *extension;
 
 	if( DGifGetImageDesc( gif->file ) == GIF_ERROR ) {
 		vips_foreign_load_gif_error( gif ); 
 		return( -1 );
@@ -433,10 +432,11 @@ vips_foreign_load_gif_scan_image( VipsForeignLoadGif *gif )
 		return( -1 ); 
 	}
 
 	/* Test for a non-greyscale colourmap for this frame.
 	 */
+	map = file->Image.ColorMap ? file->Image.ColorMap : file->SColorMap;
 	if( !gif->has_colour &&
 		map ) {
 		int i;
 
 		for( i = 0; i < map->ColorCount; i++ ) 

Vulnerable code: 	ColorMapObject *map = file->Image.ColorMap ?
		file->Image.ColorMap : file->SColorMap;
Fixed code: 	ColorMapObject *map;
	map = file->Image.ColorMap ? file->Image.ColorMap : file->SColorMap;
CVE-2019-6976: Use of Uninitialized Resource (CWE-908)
value: libvips before 8.7.4 generates output images from uninitialized memory locations when processing corrupted input image data because iofuncs/memory.c does not zero out allocated memory. This can result in leaking raw process memory contents through the output image.
CWE description: The product uses or accesses a resource that has not been initialized.
CVSS v3 base score: 5.3
Published: 2019-01-26T23:29Z
Repository: https://github.com/libvips/libvips
Language: Other
Files changed: ChangeLog, libvips/iofuncs/memory.c
Commit date: 2019-01-18 10:10:43 +0000
Commit message: zero memory on malloc

to prevent write of uninit memory under some error conditions

thanks Balint

Diff: diff --git a/ChangeLog b/ChangeLog
index e80313a8..057adf95 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,7 +1,10 @@
 4/1/19 started 8.7.4
-- magicksave with magick6 API did not chain exceptions correctly [kleisauke]
+- magicksave with magick6 API did not chain exceptions correctly causing a
+  memory leak under some conditions [kleisauke]
+- zero memory on allocate to prevent write of uninitialized memory under some 
+  error conditions [Balint Varga-Perke]
 
 21/11/18 started 8.7.3
 - fix infinite loop for autofit with non-scaleable font 
 - mapim was not offsetting by window offset [erdmann]
 - better rounding for scale [kleisauke]
diff --git a/libvips/iofuncs/memory.c b/libvips/iofuncs/memory.c
index d877e2e0..9f9b55f8 100644
--- a/libvips/iofuncs/memory.c
+++ b/libvips/iofuncs/memory.c
@@ -171,11 +171,11 @@ vips_malloc_cb( VipsObject *object, char *buf )
 void *
 vips_malloc( VipsObject *object, size_t size )
 {
 	void *buf;
 
-	buf = g_malloc( size );
+	buf = g_malloc0( size );
 
         if( object ) {
 		g_signal_connect( object, "postclose", 
 			G_CALLBACK( vips_malloc_cb ), buf );
 		object->local_memory += size;
@@ -315,11 +315,11 @@ vips_tracked_malloc( size_t size )
 	 * size of this block. Ask for an extra 16 to make sure we don't break
 	 * alignment rules.
 	 */
 	size += 16;
 
-        if( !(buf = g_try_malloc( size )) ) {
+        if( !(buf = g_try_malloc0( size )) ) {
 #ifdef DEBUG
 		g_assert_not_reached();
 #endif /*DEBUG*/
 
 		vips_error( "vips_tracked", 

Vulnerable code: - magicksave with magick6 API did not chain exceptions correctly [kleisauke]
	buf = g_malloc( size );
        if( !(buf = g_try_malloc( size )) ) {
Fixed code: - magicksave with magick6 API did not chain exceptions correctly causing a
  memory leak under some conditions [kleisauke]
- zero memory on allocate to prevent write of uninitialized memory under some 
  error conditions [Balint Varga-Perke]
	buf = g_malloc0( size );
        if( !(buf = g_try_malloc0( size )) ) {
CVE-2020-20739: Missing Initialization of Resource (CWE-909)
value: im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.
CWE description: The product does not initialize a critical resource.
CVSS v3 base score: 5.3
Published: 2020-11-20T19:15Z
Repository: https://github.com/libvips/libvips
Language: C
Files changed: libvips/deprecated/im_vips2dz.c
Commit date: 2019-09-03 13:17:18 +0100
Commit message: fix a used-before-set error in im_vips2dz

we were reading an uninited string in a vips7 compatibility wrapper, thanks
yifengchen-cc

see https://github.com/libvips/libvips/issues/1419

Diff: diff --git a/libvips/deprecated/im_vips2dz.c b/libvips/deprecated/im_vips2dz.c
index 6dbde78c3..aafe8f99d 100644
--- a/libvips/deprecated/im_vips2dz.c
+++ b/libvips/deprecated/im_vips2dz.c
@@ -73,10 +73,12 @@ im_vips2dz( IMAGE *in, const char *filename )
 	im_strncpy( name, filename, FILENAME_MAX ); 
 	if( (p = strchr( name, ':' )) ) {
 		*p = '\0';
 		im_strncpy( mode, p + 1, FILENAME_MAX ); 
 	}
+	else 
+		strcpy( mode, "" ); 
 
 	strcpy( buf, mode ); 
 	p = &buf[0];
 
 	if( (q = im_getnextoption( &p )) ) {

Fixed code: 	else 
		strcpy( mode, "" );
CVE-2015-10055: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in PictureThisWebServer and classified as critical. This issue affects the function router.post of the file routes/user.js. The manipulation of the argument username/password leads to sql injection. The patch is named 68b9dc346e88b494df00d88c7d058e96820e1479. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218399.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-16T18:15Z
Repository: https://github.com/jan-rodriguez/PictureThisWebServer
Language: JavaScript
Files changed: routes/user.js
Commit date: 2015-02-23 20:52:32 -0500
Commit message: Fixed error and prevent sql injection

Diff: diff --git a/routes/user.js b/routes/user.js
index 4bab10b..cdd563a 100644
--- a/routes/user.js
+++ b/routes/user.js
@@ -16,21 +16,24 @@ router.get('/all', function(req, res, next) {
   res.json({hi: "there"});
 });
 
 /* POST create user */
 router.post('/new', function(req, res, next) {
-  console.log(req.body);
 
   var username = req.body.username;
   var password = req.body.password;
 
   //Make sure both username and password are specified
   if(!username || !password) {
     res.json ({error: "Please specify both username and password"});
     return;
   }
 
+  //SQL INJECTION SHALL NOT PASS!!!
+  var username = conn.escape(username);
+  var password = conn.escape(password);
+
   var conn = mysql.createConnection({
     host    : "ec2-52-1-159-248.compute-1.amazonaws.com",
     user    : "root",
     password: "root",
     port    : 3306,
@@ -46,11 +49,11 @@ router.post('/new', function(req, res, next) {
       return;
     }
     conn.query("INSERT INTO user (username, password) VALUES ('"+username+"', '"+password+"')", function (err, result) {
       if(err) {
         //Duplicate code
-        if(err.code === "ER_DUP_UNIQUE") {
+        if(err.code === "ER_DUP_ENTRY") {
           res.json({error: "Username already exists."});
         }else{
           console.error("********Failed to insert user**********");
           console.error(err.code);
           res.json({error: "Failed to insert user to table"});

Vulnerable code:   console.log(req.body);
        if(err.code === "ER_DUP_UNIQUE") {
Fixed code:   //SQL INJECTION SHALL NOT PASS!!!
  var username = conn.escape(username);
  var password = conn.escape(password);

        if(err.code === "ER_DUP_ENTRY") {