Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-2550: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-05-05T20:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/admin/record.questions.php
Commit date: 2023-04-02 10:04:31 +0200
Commit message: fix: added missing conversion to HTML entities

Diff: diff --git a/phpmyfaq/admin/record.questions.php b/phpmyfaq/admin/record.questions.php
index 2e15fd09837..0e8dbfca93f 100644
--- a/phpmyfaq/admin/record.questions.php
+++ b/phpmyfaq/admin/record.questions.php
@@ -87,16 +87,18 @@ if (!defined('IS_VALID_PHPMYFAQ')) {
                       </label>
                     </td>
                     <td>
                         <?= $date->format(Date::createIsoDate($openQuestion->getCreated())) ?>
                       <br>
-                      <a href="mailto:<?= $openQuestion->getEmail() ?>">
+                      <a href="mailto:<?= Strings::htmlentities($openQuestion->getEmail()) ?>">
                           <?= Strings::htmlentities($openQuestion->getUsername()) ?>
                       </a>
                     </td>
                     <td>
-                      <strong><?= $category->categoryName[$openQuestion->getCategoryId()]['name'] ?></strong>
+                      <strong>
+                          <?= Strings::htmlentities($category->categoryName[$openQuestion->getCategoryId()]['name']) ?>
+                      </strong>
                       <br>
                         <?= Strings::htmlentities($openQuestion->getQuestion()) ?>
                     </td>
                     <td>
                       <a href="?action=question&amp;id=<?= $openQuestion->getId() ?>&amp;is_visible=toggle&csrf=<?= $user->getCsrfTokenFromSession() ?>"

Vulnerable code:                       <a href="mailto:<?= $openQuestion->getEmail() ?>">
                      <strong><?= $category->categoryName[$openQuestion->getCategoryId()]['name'] ?></strong>
Fixed code:                       <a href="mailto:<?= Strings::htmlentities($openQuestion->getEmail()) ?>">
                      <strong>
                          <?= Strings::htmlentities($category->categoryName[$openQuestion->getCategoryId()]['name']) ?>
                      </strong>
CVE-2023-2998: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-05-31T01:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/src/phpMyFAQ/News.php
Commit date: 2023-05-05 15:30:53 +0200
Commit message: fix: strip tags for news on startpage

Diff: diff --git a/phpmyfaq/src/phpMyFAQ/News.php b/phpmyfaq/src/phpMyFAQ/News.php
index e40643562dc..e5f939ac9c0 100644
--- a/phpmyfaq/src/phpMyFAQ/News.php
+++ b/phpmyfaq/src/phpMyFAQ/News.php
@@ -85,11 +85,11 @@ class News
                 $item['id'],
                 Strings::htmlentities($oLink->toString()),
                 Strings::htmlentities($item['header'])
             );
 
-            $output .= sprintf('%s', $item['content']);
+            $output .= sprintf('%s', strip_tags($item['content']));
 
             if (strlen($item['link']) > 1) {
                 $output .= sprintf(
                     '<br>%s <a href="%s" target="_%s">%s</a>',
                     $this->pmfLang['msgInfo'],
@@ -111,11 +111,11 @@ class News
      * @param bool $showArchive Show archived news
      * @param bool $active Show active news
      * @param bool $forceConfLimit Force to limit in configuration
      * @return array<int, array<mixed>>
      */
-    public function getLatestData($showArchive = false, $active = true, $forceConfLimit = false): array
+    public function getLatestData(bool $showArchive = false, bool $active = true, bool $forceConfLimit = false): array
     {
         $news = [];
         $counter = 0;
         $now = date('YmdHis');
 

Vulnerable code:             $output .= sprintf('%s', $item['content']);
    public function getLatestData($showArchive = false, $active = true, $forceConfLimit = false): array
Fixed code:             $output .= sprintf('%s', strip_tags($item['content']));
    public function getLatestData(bool $showArchive = false, bool $active = true, bool $forceConfLimit = false): array
CVE-2023-4007: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.16.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-07-31T01:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/src/phpMyFAQ/Link.php
Commit date: 2023-07-07 17:20:09 +0200
Commit message: fix: added missing conversion to HTML entities

Diff: diff --git a/phpmyfaq/src/phpMyFAQ/Link.php b/phpmyfaq/src/phpMyFAQ/Link.php
index 980ce08f480..8df09ab945e 100755
--- a/phpmyfaq/src/phpMyFAQ/Link.php
+++ b/phpmyfaq/src/phpMyFAQ/Link.php
@@ -313,15 +313,15 @@ class Link
         if (!empty($this->id)) {
             $htmlAnchor .= ' id="' . $this->id . '"';
         }
 
         if (!empty($this->tooltip)) {
-            $htmlAnchor .= sprintf(' title="%s"', addslashes($this->tooltip));
+            $htmlAnchor .= sprintf(' title="%s"', Strings::htmlentities($this->tooltip));
         }
 
         if (!empty($this->name)) {
-            $htmlAnchor .= sprintf(' name="%s"', $this->name);
+            $htmlAnchor .= sprintf(' name="%s"', Strings::htmlentities($this->name));
         } else {
             if (!empty($this->url)) {
                 $htmlAnchor .= sprintf(' href="%s"', $url);
             }
             if (!empty($this->target)) {
@@ -331,14 +331,14 @@ class Link
         if (!empty($this->rel)) {
             $htmlAnchor .= sprintf(' rel="%s"', $this->rel);
         }
         $htmlAnchor .= '>';
         if (('0' == $this->text) || (!empty($this->text))) {
-            $htmlAnchor .= $this->text;
+            $htmlAnchor .= Strings::htmlentities($this->text);
         } else {
             if (!empty($this->name)) {
-                $htmlAnchor .= $this->name;
+                $htmlAnchor .= Strings::htmlentities($this->name);
             } else {
                 $htmlAnchor .= $url;
             }
         }
         $htmlAnchor .= '</a>';

Vulnerable code:             $htmlAnchor .= sprintf(' title="%s"', addslashes($this->tooltip));
            $htmlAnchor .= sprintf(' name="%s"', $this->name);
            $htmlAnchor .= $this->text;
                $htmlAnchor .= $this->name;
Fixed code:             $htmlAnchor .= sprintf(' title="%s"', Strings::htmlentities($this->tooltip));
            $htmlAnchor .= sprintf(' name="%s"', Strings::htmlentities($this->name));
            $htmlAnchor .= Strings::htmlentities($this->text);
                $htmlAnchor .= Strings::htmlentities($this->name);
CVE-2023-5316: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-09-30T01:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/admin/ajax.config_list.php
Commit date: 2023-09-02 17:05:31 +0200
Commit message: fix: added missing conversion to HTML entities

Diff: diff --git a/phpmyfaq/admin/ajax.config_list.php b/phpmyfaq/admin/ajax.config_list.php
index a936ef18e9a..fbff13109da 100755
--- a/phpmyfaq/admin/ajax.config_list.php
+++ b/phpmyfaq/admin/ajax.config_list.php
@@ -20,10 +20,11 @@ use Abraham\TwitterOAuth\TwitterOAuth;
 use phpMyFAQ\Configuration;
 use phpMyFAQ\Filter;
 use phpMyFAQ\Helper\AdministrationHelper;
 use phpMyFAQ\Helper\LanguageHelper;
 use phpMyFAQ\Helper\PermissionHelper;
+use phpMyFAQ\Strings;
 use phpMyFAQ\System;
 use phpMyFAQ\Utils;
 
 if (!defined('IS_VALID_PHPMYFAQ')) {
     http_response_code(400);
@@ -93,11 +94,11 @@ function renderInputForm($key, $type)
             printf(
                 '<input class="form-control" type="%s" name="edit[%s]" id="edit[%s]" value="%s" step="1" min="0">',
                 is_numeric($value) ? 'number' : $type,
                 $key,
                 $key,
-                $value
+                Strings::htmlentities($value)
             );
             if ('api.apiClientToken' === $key) {
                 echo '<div class="input-group-append">';
                 echo '<button class="btn btn-dark" id="pmf-generate-api-token" type="button">Generate API Client Token</button>';
                 echo '</div>';
@@ -141,11 +142,11 @@ function renderInputForm($key, $type)
 
         case 'password':
             printf(
                 '<input class="form-control" type="password" autocomplete="off" name="edit[%s]" value="%s">',
                 $key,
-                $faqConfig->get($key)
+                Strings::htmlentities($faqConfig->get($key))
             );
             echo "</div>\n";
             break;
 
         case 'select':

Vulnerable code:                 $value
                $faqConfig->get($key)
Fixed code: use phpMyFAQ\Strings;
                Strings::htmlentities($value)
                Strings::htmlentities($faqConfig->get($key))
CVE-2023-5319: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.18.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-09-30T01:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/admin/ajax.user.php
Commit date: 2023-09-02 16:58:52 +0200
Commit message: fix: added missing conversion to HTML entities

Diff: diff --git a/phpmyfaq/admin/ajax.user.php b/phpmyfaq/admin/ajax.user.php
index eed5638d3ca..db512753fa9 100644
--- a/phpmyfaq/admin/ajax.user.php
+++ b/phpmyfaq/admin/ajax.user.php
@@ -64,10 +64,11 @@ if (
             $user->getUserById($userId, true);
             $userdata = [];
             $userdata = $user->userdata->get('*');
             $userdata['status'] = $user->getStatus();
             $userdata['login'] = Strings::htmlentities($user->getLogin());
+            $userdata['display_name'] = Strings::htmlentities($userdata['display_name']);
             $userdata['is_superadmin'] = $user->isSuperAdmin();
             $http->sendJsonWithHeaders($userdata);
             break;
 
         case 'get_all_user_data':

Fixed code:             $userdata['display_name'] = Strings::htmlentities($userdata['display_name']);
CVE-2023-5320: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-09-30T01:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/admin/ajax.config_list.php, phpmyfaq/admin/configuration.php
Commit date: 2023-08-30 18:54:21 +0200
Commit message: fix: only URLs should be allowed

Diff: diff --git a/phpmyfaq/admin/ajax.config_list.php b/phpmyfaq/admin/ajax.config_list.php
index b675ca1b737..a936ef18e9a 100755
--- a/phpmyfaq/admin/ajax.config_list.php
+++ b/phpmyfaq/admin/ajax.config_list.php
@@ -84,12 +84,12 @@ function renderInputForm($key, $type)
                 case 'main.referenceURL':
                 case 'main.privacyURL':
                     $type = 'url';
                     break;
                 default:
-                  $type = 'text';
-                  break;
+                    $type = 'text';
+                    break;
             }
 
             printf(
                 '<input class="form-control" type="%s" name="edit[%s]" id="edit[%s]" value="%s" step="1" min="0">',
                 is_numeric($value) ? 'number' : $type,
diff --git a/phpmyfaq/admin/configuration.php b/phpmyfaq/admin/configuration.php
index 8e5867b6c6e..974f6075420 100644
--- a/phpmyfaq/admin/configuration.php
+++ b/phpmyfaq/admin/configuration.php
@@ -56,10 +56,17 @@ if ($user->perm->hasPermission($user->getUserId(), 'editconfig')) {
         }
         if (isset($editData['edit']['main.currentVersion'])) {
             unset($editData['edit']['main.currentVersion']); // don't update the version number
         }
 
+        if (
+            isset($editData['edit']['main.referenceURL']) &&
+            is_null(Filter::filterVar($editData['edit']['main.referenceURL'], FILTER_VALIDATE_URL))
+        ) {
+            unset($editData['edit']['main.referenceURL']);
+        }
+
         foreach ($editData['edit'] as $key => $value) {
             // Remove forbidden characters
             $newConfigValues[$key] = str_replace($forbiddenValues, '', $value);
             // Escape some values
             if (isset($escapeValues[$key])) {

Vulnerable code:                   $type = 'text';
                  break;
Fixed code:                     $type = 'text';
                    break;
        if (
            isset($editData['edit']['main.referenceURL']) &&
            is_null(Filter::filterVar($editData['edit']['main.referenceURL'], FILTER_VALIDATE_URL))
        ) {
            unset($editData['edit']['main.referenceURL']);
        }
CVE-2023-5863: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-10-31T01:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/admin/login.php
Commit date: 2023-10-01 10:41:47 +0200
Commit message: fix: added missing conversion to HTML entities

Diff: diff --git a/phpmyfaq/admin/login.php b/phpmyfaq/admin/login.php
index 567d573342a..bee9d6dfaf0 100644
--- a/phpmyfaq/admin/login.php
+++ b/phpmyfaq/admin/login.php
@@ -15,10 +15,11 @@
  * @link      https://www.phpmyfaq.de
  * @since     2013-02-05
  */
 
 use phpMyFAQ\Component\Alert;
+use phpMyFAQ\Strings;
 use phpMyFAQ\Translation;
 use Symfony\Component\HttpFoundation\Request;
 
 if (isset($error) && 0 < strlen((string) $error)) {
     $message = sprintf(
@@ -53,11 +54,11 @@ if ($request->isSecure() || !$faqConfig->get('security.useSslForLogins')) {
                                 </div>
                                 <div class="card-body">
                                     <form action="<?= $faqSystem->getSystemUri($faqConfig) ?>admin/index.php"
                                           method="post" accept-charset="utf-8" role="form">
                                         <input type="hidden" name="redirect-action"
-                                               value="<?= $request->query->get('action') ?>">
+                                               value="<?= Strings::htmlentities($request->query->get('action')) ?>">
                                         <div class="form-floating mb-3">
                                             <input class="form-control" id="faqusername" name="faqusername" type="text"
                                                    placeholder="<?= Translation::get('ad_auth_user') ?>" />
                                             <label for="faqusername"><?= Translation::get('ad_auth_user') ?></label>
                                         </div>

Vulnerable code:                                                value="<?= $request->query->get('action') ?>">
Fixed code: use phpMyFAQ\Strings;
                                               value="<?= Strings::htmlentities($request->query->get('action')) ?>">
CVE-2023-5864: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.1.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-10-31T01:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/src/phpMyFAQ/Faq.php
Commit date: 2023-09-16 12:55:19 +0200
Commit message: fix: added missing conversion to HTML entities

Diff: diff --git a/phpmyfaq/src/phpMyFAQ/Faq.php b/phpmyfaq/src/phpMyFAQ/Faq.php
index bf4c26cf458..868023c0bf5 100755
--- a/phpmyfaq/src/phpMyFAQ/Faq.php
+++ b/phpmyfaq/src/phpMyFAQ/Faq.php
@@ -423,11 +423,11 @@ class Faq
                     $visits = 0;
                 } else {
                     $visits = $row->visits;
                 }
 
-                $title = $row->question;
+                $title = Strings::htmlentities($row->question);
                 $url = sprintf(
                     '%sindex.php?%saction=faq&amp;cat=%d&amp;id=%d&amp;artlang=%s',
                     $this->config->getDefaultUrl(),
                     $sids,
                     $row->category_id,

Vulnerable code:                 $title = $row->question;
Fixed code:                 $title = Strings::htmlentities($row->question);
CVE-2024-32866: Insufficient Information (NVD-CWE-noinfo)
value: Conform, a type-safe form validation library, allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this feature in versions prior to 1.1.1, an attacker can exploit the feature to trigger prototype pollution by passing a crafted input to `parseWith...` functions. Applications that use conform for server-side validation of form data or URL parameters are affected by this vulnerability. Version 1.1.1 contains a patch for the issue.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-23T21:15Z
Repository: https://github.com/edmundhung/conform
Language: TypeScript
Files changed: packages/conform-dom/formdata.ts
Commit date: 2024-04-23 21:45:52 +0200
Commit message: Merge pull request from GHSA-624g-8qjg-8qxf


Diff: diff --git a/packages/conform-dom/formdata.ts b/packages/conform-dom/formdata.ts
index 7492927..afacb01 100644
--- a/packages/conform-dom/formdata.ts
+++ b/packages/conform-dom/formdata.ts
@@ -36,11 +36,17 @@ export function getPaths(name: string | undefined): Array<string | number> {
 	}
 
 	return name
 		.split(/\.|(\[\d*\])/)
 		.reduce<Array<string | number>>((result, segment) => {
-			if (typeof segment !== 'undefined' && segment !== '') {
+			if (
+				typeof segment !== 'undefined' &&
+				segment !== '' &&
+				segment !== '__proto__' &&
+				segment !== 'constructor' &&
+				segment !== 'prototype'
+			) {
 				if (segment.startsWith('[') && segment.endsWith(']')) {
 					const index = segment.slice(1, -1);
 
 					result.push(Number(index));
 				} else {
@@ -112,11 +118,15 @@ export function setValue(
 	while (pointer != null && ++index < length) {
 		const key = paths[index] as string | number;
 		const nextKey = paths[index + 1];
 		const newValue =
 			index != lastIndex
-				? pointer[key] ?? (typeof nextKey === 'number' ? [] : {})
+				? Object.hasOwn(pointer, key)
+					? pointer[key]
+					: typeof nextKey === 'number'
+					? []
+					: {}
 				: valueFn(pointer[key]);
 
 		pointer[key] = newValue;
 		pointer = pointer[key];
 	}
@@ -131,10 +141,14 @@ export function getValue(target: unknown, name: string): unknown {
 	for (const path of getPaths(name)) {
 		if (typeof pointer === 'undefined' || pointer == null) {
 			break;
 		}
 
+		if (!Object.hasOwn(pointer, path)) {
+			return;
+		}
+
 		if (isPlainObject(pointer) && typeof path === 'string') {
 			pointer = pointer[path];
 		} else if (Array.isArray(pointer) && typeof path === 'number') {
 			pointer = pointer[path];
 		} else {

Vulnerable code: 			if (typeof segment !== 'undefined' && segment !== '') {
				? pointer[key] ?? (typeof nextKey === 'number' ? [] : {})
Fixed code: 			if (
				typeof segment !== 'undefined' &&
				segment !== '' &&
				segment !== '__proto__' &&
				segment !== 'constructor' &&
				segment !== 'prototype'
			) {
				? Object.hasOwn(pointer, key)
					? pointer[key]
					: typeof nextKey === 'number'
					? []
					: {}
		if (!Object.hasOwn(pointer, path)) {
			return;
		}
CVE-2023-25564: Out-of-bounds Write (CWE-787)
value: GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, memory corruption can be triggered when decoding UTF16 strings. The variable `outlen` was not initialized and could cause writing a zero to an arbitrary place in memory if `ntlm_str_convert()` were to fail, which would leave `outlen` uninitialized. This can lead to a denial of service if the write hits unmapped memory or randomly corrupts a byte in the application memory space. This vulnerability can trigger an out-of-bounds write, leading to memory corruption. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point. This issue is fixed in version 1.2.0.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.2
Published: 2023-02-14T18:15Z
Repository: https://github.com/gssapi/gss-ntlmssp
Language: C
Files changed: src/ntlm.c
Commit date: 2023-02-12 11:02:55 -0500
Commit message: GHSL-2023-013: Memory corruption decoding UTF16

Memory corruption when decoding UTF16 strings (GHSL-2023-013)

Fixes defect GHSL-2023-013 found by the GitHub Security Lab team via
oss-fuzz.

The variable outlen was not initialized and could cause writing a zero
to an arbitrary place in memory if ntlm_str_convert() were to fail,
which would leave outlen uninitialized.

This can lead to a DoS if the write hits unmapped memory or randomly
corrupting a byte in the application memory space.

Make sure to zero out only if ntlm_str_convert() succeeds, but for good
measure also initialize outlen to 0.

Fixes CVE-2023-25564

Signed-off-by: Simo Sorce <simo@redhat.com>

Diff: diff --git a/src/ntlm.c b/src/ntlm.c
index df2458a..0ac1c03 100644
--- a/src/ntlm.c
+++ b/src/ntlm.c
@@ -297,11 +297,11 @@ static int ntlm_decode_u16l_str_hdr(struct ntlm_ctx *ctx,
                                     size_t payload_offs, char **str)
 {
     char *in, *out = NULL;
     uint16_t str_len;
     uint32_t str_offs;
-    size_t outlen;
+    size_t outlen = 0;
     int ret = 0;
 
     str_len = le16toh(str_hdr->len);
     if (str_len == 0) goto done;
 
@@ -318,17 +318,18 @@ static int ntlm_decode_u16l_str_hdr(struct ntlm_ctx *ctx,
     out = malloc(str_len * 2 + 1);
     if (!out) return ENOMEM;
 
     ret = ntlm_str_convert(ctx->to_oem, in, out, str_len, &outlen);
 
-    /* make sure to terminate output string */
-    out[outlen] = '\0';
-
 done:
     if (ret) {
         safefree(out);
+    } else {
+        /* make sure to terminate output string */
+        out[outlen] = '\0';
     }
+
     *str = out;
     return ret;
 }
 
 struct wire_version ntlmssp_version = {

Vulnerable code:     size_t outlen;
    /* make sure to terminate output string */
    out[outlen] = '\0';

Fixed code:     size_t outlen = 0;
    } else {
        /* make sure to terminate output string */
        out[outlen] = '\0';
CVE-2023-25565: Release of Invalid Pointer or Reference (CWE-763)
value: GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assumes the `cb` and `sh` buffers contain a copy of the data that needs to be freed. However, that is not the case. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point. This will likely trigger an assertion failure in `free`, causing a denial-of-service. This issue is fixed in version 1.2.0.
CWE description: The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.
CVSS v3 base score: 7.5
Published: 2023-02-14T18:15Z
Repository: https://github.com/gssapi/gss-ntlmssp
Language: C
Files changed: src/ntlm.c
Commit date: 2023-02-12 11:04:14 -0500
Commit message: GHSL-2023-012: Incorrect free when decoding target

Incorrect free when decoding target information (GHSL-2023-012)

Fixes defect GHSL-2023-012 found by the GitHub Security Lab team via
oss-fuzz.

The error condition incorrectly assumed the cb and sh buffers would
contain a copy of the data that needed to freed. However that is not the
case.

This will generally cause an assertion when trying to free a pointer
that was never allocated, and potentially memory corruption depending on
the contents fo the target_info buffer.

This may cause a DoS condition.

Signed-off-by: Simo Sorce <simo@redhat.com>

Diff: diff --git a/src/ntlm.c b/src/ntlm.c
index 0ac1c03..d3d7d1b 100644
--- a/src/ntlm.c
+++ b/src/ntlm.c
@@ -729,12 +729,10 @@ int ntlm_decode_target_info(struct ntlm_ctx *ctx, struct ntlm_buffer *buffer,
         ret = ERR_DECODE;
     }
 
 done:
     if (ret) {
-        ntlm_free_buffer_data(&sh);
-        ntlm_free_buffer_data(&cb);
         safefree(nb_computer);
         safefree(nb_domain);
         safefree(dns_computer);
         safefree(dns_domain);
         safefree(dns_tree);

Vulnerable code:         ntlm_free_buffer_data(&sh);
        ntlm_free_buffer_data(&cb);
CVE-2023-25567: Out-of-bounds Read (CWE-125)
value: GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-bounds read when decoding target information prior to version 1.2.0. The length of the `av_pair` is not checked properly for two of the elements which can trigger an out-of-bound read. The out-of-bounds read can be triggered via the main `gss_accept_sec_context` entry point and could cause a denial-of-service if the memory is unmapped. The issue is fixed in version 1.2.0.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2023-02-14T18:15Z
Repository: https://github.com/gssapi/gss-ntlmssp
Language: C
Files changed: src/ntlm.c
Commit date: 2023-02-12 11:06:10 -0500
Commit message: GHSL-2023-011: Out-of-bounds read when decoding

Out-of-bounds read when decoding target information (GHSL-2023-011)

Fixes defect GHSL-2023-011 found by the GitHub Security Lab team via
oss-fuzz.

The lenght of the av_pair is not checked properly for two of the
elements. In case the lenght is shorter than requires this may cause an
out-of-bound read that either reads garbage or may cause a crash by
reading unmapped memory.

This can be exploited to crash the service causing a DoS.

Signed-off-by: Simo Sorce <simo@redhat.com>

Diff: diff --git a/src/ntlm.c b/src/ntlm.c
index d3d7d1b..0f71bfd 100644
--- a/src/ntlm.c
+++ b/src/ntlm.c
@@ -683,15 +683,23 @@ int ntlm_decode_target_info(struct ntlm_ctx *ctx, struct ntlm_buffer *buffer,
             sh.data = av_pair->value;
             sh.length = av_len;
             break;
         case MSV_AV_TIMESTAMP:
             if (!av_timestamp) continue;
+            if (av_len < sizeof(timestamp)) {
+                ret = ERR_DECODE;
+                goto done;
+            }
             memcpy(&timestamp, av_pair->value, sizeof(timestamp));
             timestamp = le64toh(timestamp);
             break;
         case MSV_AV_FLAGS:
             if (!av_flags) continue;
+            if (av_len < sizeof(flags)) {
+                ret = ERR_DECODE;
+                goto done;
+            }
             memcpy(&flags, av_pair->value, sizeof(flags));
             flags = le32toh(flags);
             break;
         case MSV_AV_DNS_TREE_NAME:
             if (!dns_tree_name) continue;

Fixed code:             if (av_len < sizeof(timestamp)) {
                ret = ERR_DECODE;
                goto done;
            }
            if (av_len < sizeof(flags)) {
                ret = ERR_DECODE;
                goto done;
            }
CVE-2016-8637: Incorrect Permission Assignment for Critical Resource (CWE-732)
value: A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.
CWE description: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CVSS v3 base score: 7.8
Published: 2018-08-01T13:29Z
Repository: https://github.com/dracutdevs/dracut
Language: Shell
Files changed: dracut.sh
Commit date: 2016-11-07 10:41:38 +0100
Commit message: dracut.sh: create the initramfs non-world readable also if early cpio is used

Fixes: 5f2c30d9bcd614d546d5c55c6897e33f88b9ab90
Previously fixed CVE-2012-4453: e1b48995c26c4f06d1a718539cb1bd5b0179af91

Signed-off-by: Andreas Stieger <astieger@suse.com>

Diff: diff --git a/dracut.sh b/dracut.sh
index 40ca08f6..2d79bbcc 100755
--- a/dracut.sh
+++ b/dracut.sh
@@ -1698,11 +1698,11 @@ if [[ $create_early_cpio = yes ]]; then
             | xargs -r -0 touch -h -m -c -r "$dracutbasedir/dracut-functions.sh"
     fi
 
     # The microcode blob is _before_ the initramfs blob, not after
     if ! (
-            cd "$early_cpio_dir/d"
+            umask 077; cd "$early_cpio_dir/d"
             find . -print0 | sort -z \
                 | cpio ${CPIO_REPRODUCIBLE:+--reproducible} --null $cpio_owner_root -H newc -o --quiet > "${DRACUT_TMPDIR}/initramfs.img"
         ); then
         dfatal "dracut: creation of $outfile failed"
         exit 1

Vulnerable code:             cd "$early_cpio_dir/d"
Fixed code:             umask 077; cd "$early_cpio_dir/d"
CVE-2024-27302: Insufficient Information (NVD-CWE-noinfo)
value: go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-06T19:15Z
Repository: https://github.com/zeromicro/go-zero
Language: Go
Files changed: rest/internal/cors/handlers.go, rest/internal/cors/handlers_test.go
Commit date: 2023-03-04 23:34:11 +0800
Commit message: Merge pull request from GHSA-fgxv-gw55-r5fq

* fix: Authorization Bypass Through User-Controlled Key

* chore: add not safe domain test
Diff: diff --git a/rest/internal/cors/handlers.go b/rest/internal/cors/handlers.go
index e2a64b74..58187bcb 100644
--- a/rest/internal/cors/handlers.go
+++ b/rest/internal/cors/handlers.go
@@ -75,16 +75,22 @@ func checkAndSetHeaders(w http.ResponseWriter, r *http.Request, origins []string
 		setHeader(w, origin)
 	}
 }
 
 func isOriginAllowed(allows []string, origin string) bool {
-	for _, o := range allows {
-		if o == allOrigins {
+	origin = strings.ToLower(origin)
+	for _, allow := range allows {
+		if allow == allOrigins {
 			return true
 		}
 
-		if strings.HasSuffix(origin, o) {
+		allow = strings.ToLower(allow)
+		if origin == allow {
+			return true
+		}
+
+		if strings.HasSuffix(origin, "."+allow) {
 			return true
 		}
 	}
 
 	return false
diff --git a/rest/internal/cors/handlers_test.go b/rest/internal/cors/handlers_test.go
index 2082228a..c9de97a3 100644
--- a/rest/internal/cors/handlers_test.go
+++ b/rest/internal/cors/handlers_test.go
@@ -51,10 +51,15 @@ func TestCorsHandlerWithOrigins(t *testing.T) {
 		{
 			name:      "not allow origin",
 			origins:   []string{"http://local", "http://remote"},
 			reqOrigin: "http://another",
 		},
+		{
+			name:      "not safe origin",
+			origins:   []string{"safe.com"},
+			reqOrigin: "not-safe.com",
+		},
 	}
 
 	methods := []string{
 		http.MethodOptions,
 		http.MethodGet,

Vulnerable code: 	for _, o := range allows {
		if o == allOrigins {
		if strings.HasSuffix(origin, o) {
Fixed code: 	origin = strings.ToLower(origin)
	for _, allow := range allows {
		if allow == allOrigins {
		allow = strings.ToLower(allow)
		if origin == allow {
			return true
		}

		if strings.HasSuffix(origin, "."+allow) {
		{
			name:      "not safe origin",
			origins:   []string{"safe.com"},
			reqOrigin: "not-safe.com",
		},
CVE-2023-45138: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly. Starting in version 0.11 and prior to version 1.9.2, it's possible for a user without any specific right to perform script injection and remote code execution just by inserting an appropriate title when creating a new Change Request. This vulnerability is particularly critical as Change Request aims at being created by user without any particular rights. The vulnerability has been fixed in Change Request 1.9.2. It's possible to workaround the issue without upgrading by editing the document `ChangeRequest.Code.ChangeRequestSheet` and by performing the same change as in the fix commit.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 9.6
Published: 2023-10-12T17:15Z
Repository: https://github.com/xwiki-contrib/application-changerequest
Language: XML
Files changed: application-changerequest-ui/src/main/resources/ChangeRequest/Code/ChangeRequestSheet.xml
Commit date: 2023-06-27 09:44:50 +0200
Commit message: CRAPP-298: Bad rendering of title with UTF-8

  * Fix rendering of the title

Diff: diff --git a/application-changerequest-ui/src/main/resources/ChangeRequest/Code/ChangeRequestSheet.xml b/application-changerequest-ui/src/main/resources/ChangeRequest/Code/ChangeRequestSheet.xml
index ef1e0fd..7f492d2 100644
--- a/application-changerequest-ui/src/main/resources/ChangeRequest/Code/ChangeRequestSheet.xml
+++ b/application-changerequest-ui/src/main/resources/ChangeRequest/Code/ChangeRequestSheet.xml
@@ -75,11 +75,11 @@
 #set ($saveTitleUrl = "${saveTitleUrl}?form_token=$services.csrf.token")
   &lt;form id="crTitleForm" method="post" action="$escapetool.xml($saveTitleUrl)"&gt;
     &lt;input type="hidden" name="changeType" value="settitle" /&gt;
     &lt;h1 class="editable"&gt;
       &lt;span class="edit-title-icon"&gt;$services.icon.renderHTML('pencil')&lt;/span&gt;
-      &lt;label class="sr-only" for="edit-title-input"&gt;$doc.title&lt;/label&gt;
+      &lt;label class="sr-only" for="edit-title-input"&gt;$services.rendering.escape($doc.title, 'xwiki/2.1')&lt;/label&gt;
       &lt;input type="text" id="edit-title-input" name="new-title" value="$escapetool.xml($doc.title)" /&gt;
     &lt;/h1&gt;
     &lt;div class="title-button-wrapper hidden"&gt;
       &lt;input type="button" id="cancel-title" data-original-title="$escapetool.xml($doc.title)" class="btn btn-default" value="Cancel" /&gt;
       &lt;input type="submit" id="save-title" class="btn btn-primary" value="Save" /&gt;

Vulnerable code:       &lt;label class="sr-only" for="edit-title-input"&gt;$doc.title&lt;/label&gt;
Fixed code:       &lt;label class="sr-only" for="edit-title-input"&gt;$services.rendering.escape($doc.title, 'xwiki/2.1')&lt;/label&gt;
CVE-2016-6829: Use of Hard-coded Credentials (CWE-798)
value: The trove service user in (1) Openstack deployment (aka crowbar-openstack) and (2) Trove Barclamp (aka barclamp-trove and crowbar-barclamp-trove) in the Crowbar Framework has a default password, which makes it easier for remote attackers to obtain access via unspecified vectors.
CWE description: The product contains hard-coded credentials, such as a password or cryptographic key.
CVSS v3 base score: 9.8
Published: 2016-12-09T20:59Z
Repository: https://github.com/crowbar/barclamp-trove
Language: Unknown
Commit date: 2016-09-14 11:08:25 +0200
Commit message: Merge pull request #43 from s-t-e-v-e-n-k/backport-trove-random-password

Backport trove random password
CVE-2020-7622: Other (NVD-CWE-Other)
value: This affects the package io.jooby:jooby-netty before 1.6.9, from 2.0.0 and before 2.2.1. The DefaultHttpHeaders is set to false which means it does not validates that the header isn't being abused for HTTP Response Splitting.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 9.8
Published: 2020-04-06T15:15Z
Repository: https://github.com/jooby-project/jooby
Language: Java
Files changed: modules/jooby-netty/src/main/java/io/jooby/internal/netty/NettyContext.java
Commit date: 2019-10-12 10:30:52 -0300
Commit message: CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting fix #GHSA-gv3v-92v6-m48j

Diff: diff --git a/modules/jooby-netty/src/main/java/io/jooby/internal/netty/NettyContext.java b/modules/jooby-netty/src/main/java/io/jooby/internal/netty/NettyContext.java
index f2fcb0cd1..3809634db 100644
--- a/modules/jooby-netty/src/main/java/io/jooby/internal/netty/NettyContext.java
+++ b/modules/jooby-netty/src/main/java/io/jooby/internal/netty/NettyContext.java
@@ -97,11 +97,11 @@ import static io.netty.handler.codec.http.LastHttpContent.EMPTY_LAST_CONTENT;
 import static java.nio.charset.StandardCharsets.UTF_8;
 
 public class NettyContext implements DefaultContext, ChannelFutureListener {
 
   private static final HttpHeaders NO_TRAILING = EmptyHttpHeaders.INSTANCE;
-  final DefaultHttpHeaders setHeaders = new DefaultHttpHeaders(false);
+  final DefaultHttpHeaders setHeaders = new DefaultHttpHeaders(true);
   private final int bufferSize;
   InterfaceHttpPostRequestDecoder decoder;
   private Router router;
   private Route route;
   ChannelHandlerContext ctx;

Vulnerable code:   final DefaultHttpHeaders setHeaders = new DefaultHttpHeaders(false);
Fixed code:   final DefaultHttpHeaders setHeaders = new DefaultHttpHeaders(true);
CVE-2013-7456: Out-of-bounds Read (CWE-125)
value: gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.1.1, as used in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7, allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted image that is mishandled by the imagescale function.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.6
Published: 2016-08-07T10:59Z
Repository: https://github.com/libgd/libgd
Language: C
Files changed: src/gd_interpolation.c
Commit date: 2013-09-23 18:03:08 -0400
Commit message: Fixed memory overrun bug in gdImageScaleTwoPass

_gdContributionsCalc would compute a window size and then adjust
the left and right positions of the window to make a window within
that size.  However, it was storing the values in the struct *before*
it made the adjustment.  This change fixes that.

Diff: diff --git a/src/gd_interpolation.c b/src/gd_interpolation.c
index 43891e6..71cc150 100644
--- a/src/gd_interpolation.c
+++ b/src/gd_interpolation.c
@@ -951,22 +951,22 @@ static inline LineContribType *_gdContributionsCalc(unsigned int line_size, unsi
 		register int iLeft = MAX(0, (int)floor (dCenter - width_d));
 		int iRight = MIN((int)ceil(dCenter + width_d), (int)src_size - 1);
 		double dTotalWeight = 0.0;
 		int iSrc;
 
-		res->ContribRow[u].Left = iLeft;
-		res->ContribRow[u].Right = iRight;
-
 		/* Cut edge points to fit in filter window in case of spill-off */
 		if (iRight - iLeft + 1 > windows_size)  {
 			if (iLeft < ((int)src_size - 1 / 2))  {
 				iLeft++;
 			} else {
 				iRight--;
 			}
 		}
 
+		res->ContribRow[u].Left = iLeft;
+		res->ContribRow[u].Right = iRight;
+
 		for (iSrc = iLeft; iSrc <= iRight; iSrc++) {
 			dTotalWeight += (res->ContribRow[u].Weights[iSrc-iLeft] =  scale_f_d * (*pFilter)(scale_f_d * (dCenter - (double)iSrc)));
 		}
 
 		if (dTotalWeight < 0.0) {

Vulnerable code: 		res->ContribRow[u].Left = iLeft;
		res->ContribRow[u].Right = iRight;

Fixed code: 		res->ContribRow[u].Left = iLeft;
		res->ContribRow[u].Right = iRight;
CVE-2015-8877: Resource Management Errors (CWE-399)
value: The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function.
CWE description: Weaknesses in this category are related to improper management of system resources.
CVSS v3 base score: 7.5
Published: 2016-05-22T01:59Z
Repository: https://github.com/libgd/libgd
Language: C
Files changed: src/gd_interpolation.c
Commit date: 2015-08-05 03:01:06 +0200
Commit message: gdImageScaleTwoPass memory leak fix

Fixing memory leak in gdImageScaleTwoPass, as reported by @cmb69 and
confirmed by @vapier.  This bug actually bit me in production and I'm
very thankful that it was reported with an easy fix.

Fixes #173.

Diff: diff --git a/src/gd_interpolation.c b/src/gd_interpolation.c
index fcc11e6..f00c946 100644
--- a/src/gd_interpolation.c
+++ b/src/gd_interpolation.c
@@ -1085,11 +1085,11 @@ gdImageScaleTwoPass(const gdImagePtr src, const unsigned int new_width,
         gdImageSetInterpolationMethod(dst, src->interpolation_id);
         _gdScalePass(tmp_im, src_height, dst, new_height, new_width, VERTICAL);
     }/* if */
 
     if (src != tmp_im) {
-        gdFree(tmp_im);
+        gdImageDestroy(tmp_im);
     }/* if */
 
 	return dst;
 }/* gdImageScaleTwoPass*/
 

Vulnerable code:         gdFree(tmp_im);
Fixed code:         gdImageDestroy(tmp_im);
CVE-2016-10166: Integer Underflow (Wrap or Wraparound) (CWE-191)
value: Integer underflow in the _gdContributionsAlloc function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors related to decrementing the u variable.
CWE description: The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CVSS v3 base score: 9.8
Published: 2017-03-15T15:59Z
Repository: https://github.com/libgd/libgd
Language: C
Files changed: src/gd_interpolation.c
Commit date: 2016-12-13 15:16:03 +0100
Commit message: Fix potential unsigned underflow

No need to decrease `u`, so we don't do it. While we're at it, we also factor
out the overflow check of the loop, what improves performance and readability.

This issue has been reported by Stefan Esser to security@libgd.org.

Diff: diff --git a/src/gd_interpolation.c b/src/gd_interpolation.c
index e83f0bbb..b9a20655 100644
--- a/src/gd_interpolation.c
+++ b/src/gd_interpolation.c
@@ -827,12 +827,17 @@ int getPixelInterpolated(gdImagePtr im, const double x, const double y, const in
 
 static inline LineContribType * _gdContributionsAlloc(unsigned int line_length, unsigned int windows_size)
 {
 	unsigned int u = 0;
 	LineContribType *res;
-	int overflow_error = 0;
+	size_t weights_size;
 
+	if (overflow2(windows_size, sizeof(double))) {
+		return NULL;
+	} else {
+		weights_size = windows_size * sizeof(double);
+	}
 	res = (LineContribType *) gdMalloc(sizeof(LineContribType));
 	if (!res) {
 		return NULL;
 	}
 	res->WindowSize = windows_size;
@@ -845,19 +850,15 @@ static inline LineContribType * _gdContributionsAlloc(unsigned int line_length,
 	if (res->ContribRow == NULL) {
 		gdFree(res);
 		return NULL;
 	}
 	for (u = 0 ; u < line_length ; u++) {
-		if (overflow2(windows_size, sizeof(double))) {
-			overflow_error = 1;
-		} else {
-			res->ContribRow[u].Weights = (double *) gdMalloc(windows_size * sizeof(double));
-		}
-		if (overflow_error == 1 || res->ContribRow[u].Weights == NULL) {
+		res->ContribRow[u].Weights = (double *) gdMalloc(weights_size);
+		if (res->ContribRow[u].Weights == NULL) {
 			unsigned int i;
-			u--;
-			for (i=0;i<=u;i++) {
+
+			for (i=0;i<u;i++) {
 				gdFree(res->ContribRow[i].Weights);
 			}
 			gdFree(res->ContribRow);
 			gdFree(res);
 			return NULL;

Vulnerable code: 	int overflow_error = 0;
		if (overflow2(windows_size, sizeof(double))) {
			overflow_error = 1;
		} else {
			res->ContribRow[u].Weights = (double *) gdMalloc(windows_size * sizeof(double));
		}
		if (overflow_error == 1 || res->ContribRow[u].Weights == NULL) {
			u--;
			for (i=0;i<=u;i++) {
Fixed code: 	size_t weights_size;
	if (overflow2(windows_size, sizeof(double))) {
		return NULL;
	} else {
		weights_size = windows_size * sizeof(double);
	}
		res->ContribRow[u].Weights = (double *) gdMalloc(weights_size);
		if (res->ContribRow[u].Weights == NULL) {

			for (i=0;i<u;i++) {
CVE-2016-6128: Improper Input Validation (CWE-20)
value: The gdImageCropThreshold function in gd_crop.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 7.0.9, allows remote attackers to cause a denial of service (application crash) via an invalid color index.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2016-08-07T10:59Z
Repository: https://github.com/libgd/libgd
Language: C
Files changed: tests/gdimagecrop/php_bug_72494.c
Commit date: 2016-06-27 11:42:44 +0700
Commit message: fix php 72494, invalid color index not handled, can lead to crash

Diff: diff --git a/tests/gdimagecrop/php_bug_72494.c b/tests/gdimagecrop/php_bug_72494.c
new file mode 100644
index 00000000..adaa379f
--- /dev/null
+++ b/tests/gdimagecrop/php_bug_72494.c
@@ -0,0 +1,23 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "gd.h"
+
+#include "gdtest.h"
+
+int main()
+{
+	gdImagePtr im, exp;
+	int error = 0;
+
+	im = gdImageCreate(50, 50);
+
+	if (!im) {
+		gdTestErrorMsg("gdImageCreate failed.\n");
+		return 1;
+	}
+
+	gdImageCropThreshold(im, 1337, 0);
+	gdImageDestroy(im);
+	/* this bug tests a crash, it never reaches this point if the bug exists*/
+	return 0;
+}

Fixed code: #include <stdio.h>
#include <stdlib.h>
#include "gd.h"

#include "gdtest.h"

int main()
{
	gdImagePtr im, exp;
	int error = 0;

	im = gdImageCreate(50, 50);

	if (!im) {
		gdTestErrorMsg("gdImageCreate failed.\n");
		return 1;
	}

	gdImageCropThreshold(im, 1337, 0);
	gdImageDestroy(im);
	/* this bug tests a crash, it never reaches this point if the bug exists*/
	return 0;
}