Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-25193: Allocation of Resources Without Limits or Throttling (CWE-770)
value: hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 7.5
Published: 2023-02-04T20:15Z
Repository: https://github.com/harfbuzz/harfbuzz
Language: C++
Files changed: src/hb-ot-layout-gsubgpos.hh
Commit date: 2023-02-01 20:00:43 -0700
Commit message: [layout] Limit how far we skip when looking back

See comments.

Diff: diff --git a/src/hb-ot-layout-gsubgpos.hh b/src/hb-ot-layout-gsubgpos.hh
index bf74672a10..8ca6918055 100644
--- a/src/hb-ot-layout-gsubgpos.hh
+++ b/src/hb-ot-layout-gsubgpos.hh
@@ -576,10 +576,17 @@ struct hb_ot_apply_context_t :
       /* The alternate condition below is faster at string boundaries,
        * but produces subpar "unsafe-to-concat" values. */
       unsigned stop = num_items - 1;
       if (c->buffer->flags & HB_BUFFER_FLAG_PRODUCE_UNSAFE_TO_CONCAT)
         stop = 1 - 1;
+
+      /* When looking back, limit how far we search; this function is mostly
+       * used for looking back for base glyphs when attaching marks. If we
+       * don't limit, we can get O(n^2) behavior where n is the number of
+       * consecutive marks. */
+      stop = (unsigned) hb_max ((int) stop, (int) idx - HB_MAX_CONTEXT_LENGTH);
+
       while (idx > stop)
       {
 	idx--;
 	hb_glyph_info_t &info = c->buffer->out_info[idx];
 

Fixed code: 
      /* When looking back, limit how far we search; this function is mostly
       * used for looking back for base glyphs when attaching marks. If we
       * don't limit, we can get O(n^2) behavior where n is the number of
       * consecutive marks. */
      stop = (unsigned) hb_max ((int) stop, (int) idx - HB_MAX_CONTEXT_LENGTH);
CVE-2022-21678: Incorrect Authorization (CWE-863)
value: Discourse is an open source discussion platform. Prior to version 2.8.0.beta11 in the `tests-passed` branch, version 2.8.0.beta11 in the `beta` branch, and version 2.7.13 in the `stable` branch, the bios of users who made their profiles private were still visible in the `<meta>` tags on their users' pages. The problem is patched in `tests-passed` version 2.8.0.beta11, `beta` version 2.8.0.beta11, and `stable` version 2.7.13 of Discourse.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 4.3
Published: 2022-01-13T18:15Z
Repository: https://github.com/discourse/discourse
Language: Ruby
Files changed: lib/guardian/user_guardian.rb, spec/requests/users_controller_spec.rb
Commit date: 2022-01-05 10:23:36 +0800
Commit message: FIX: Hide user's bio if profile is restricted

The bio was sometimes visible in the meta tags even though it it should
not have been.

Diff: diff --git a/lib/guardian/user_guardian.rb b/lib/guardian/user_guardian.rb
index 564bdcfa352..b0d20bd12be 100644
--- a/lib/guardian/user_guardian.rb
+++ b/lib/guardian/user_guardian.rb
@@ -99,11 +99,11 @@ module UserGuardian
   def can_check_sso_details?(user)
     user && is_admin?
   end
 
   def restrict_user_fields?(user)
-    user.trust_level == TrustLevel[0] && anonymous?
+    (user.trust_level == TrustLevel[0] && anonymous?) || !can_see_profile?(user)
   end
 
   def can_see_staff_info?(user)
     user && is_staff?
   end
diff --git a/spec/requests/users_controller_spec.rb b/spec/requests/users_controller_spec.rb
index b9149740e6b..2309239b779 100644
--- a/spec/requests/users_controller_spec.rb
+++ b/spec/requests/users_controller_spec.rb
@@ -3672,10 +3672,20 @@ describe UsersController do
 
       expect(response.status).to eq(200)
       expect(response.body).to include(user1.username)
     end
 
+    it "should not be able to view a private user profile" do
+      user1.user_profile.update!(bio_raw: "Hello world!")
+      user1.user_option.update!(hide_profile_and_presence: true)
+
+      get "/u/#{user1.username}"
+
+      expect(response.status).to eq(200)
+      expect(response.body).not_to include("Hello world!")
+    end
+
     describe 'when username contains a period' do
       before_all do
         user1.update!(username: 'test.test')
       end
 

Vulnerable code:     user.trust_level == TrustLevel[0] && anonymous?
Fixed code:     (user.trust_level == TrustLevel[0] && anonymous?) || !can_see_profile?(user)
    it "should not be able to view a private user profile" do
      user1.user_profile.update!(bio_raw: "Hello world!")
      user1.user_option.update!(hide_profile_and_presence: true)

      get "/u/#{user1.username}"

      expect(response.status).to eq(200)
      expect(response.body).not_to include("Hello world!")
    end
CVE-2022-21678: Incorrect Authorization (CWE-863)
value: Discourse is an open source discussion platform. Prior to version 2.8.0.beta11 in the `tests-passed` branch, version 2.8.0.beta11 in the `beta` branch, and version 2.7.13 in the `stable` branch, the bios of users who made their profiles private were still visible in the `<meta>` tags on their users' pages. The problem is patched in `tests-passed` version 2.8.0.beta11, `beta` version 2.8.0.beta11, and `stable` version 2.7.13 of Discourse.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 4.3
Published: 2022-01-13T18:15Z
Repository: https://github.com/discourse/discourse
Language: Unknown
Commit date: 2022-01-06 18:27:59 +0200
Commit message: SECURITY: Hide user's bio if profile is restricted (#15477)

The bio was sometimes visible in the meta tags even though it it should
not have been.
CVE-2023-22454: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, pending post titles can be used for cross-site scripting attacks. Pending posts can be created by unprivileged users when a category has the "require moderator approval of all new topics" setting set. This vulnerability can lead to a full XSS on sites which have modified or disabled Discourse’s default Content Security Policy. A patch is available in versions 2.8.14 and 3.0.0.beta16.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-05T20:15Z
Repository: https://github.com/discourse/discourse
Language: JavaScript
Files changed: app/assets/javascripts/discourse/app/routes/user-activity-pending.js
Commit date: 2023-01-05 06:08:05 +0800
Commit message: SECURITY: Sanitize PendingPost titles before rendering to prevent XSS (#19726)

Co-authored-by: Daniel Waterworth <me@danielwaterworth.com>
Diff: diff --git a/app/assets/javascripts/discourse/app/routes/user-activity-pending.js b/app/assets/javascripts/discourse/app/routes/user-activity-pending.js
index d01768110fa0..9089fa6b5c55 100644
--- a/app/assets/javascripts/discourse/app/routes/user-activity-pending.js
+++ b/app/assets/javascripts/discourse/app/routes/user-activity-pending.js
@@ -1,16 +1,28 @@
 import DiscourseRoute from "discourse/routes/discourse";
+import { emojiUnescape } from "discourse/lib/text";
+import { escapeExpression } from "discourse/lib/utilities";
 
 export default DiscourseRoute.extend({
   beforeModel() {
     this.username = this.modelFor("user").username_lower;
   },
 
   model() {
-    return this.store.findAll("pending-post", {
-      username: this.username,
-    });
+    return this.store
+      .findAll("pending-post", {
+        username: this.username,
+      })
+      .then((pendingPosts) => {
+        for (let pendingPost of pendingPosts.content) {
+          pendingPost.title = emojiUnescape(
+            escapeExpression(pendingPost.title)
+          );
+        }
+
+        return pendingPosts;
+      });
   },
 
   activate() {
     this.appEvents.on(
       `count-updated:${this.username}:pending_posts_count`,

Vulnerable code:     return this.store.findAll("pending-post", {
      username: this.username,
    });
Fixed code: import { emojiUnescape } from "discourse/lib/text";
import { escapeExpression } from "discourse/lib/utilities";
    return this.store
      .findAll("pending-post", {
        username: this.username,
      })
      .then((pendingPosts) => {
        for (let pendingPost of pendingPosts.content) {
          pendingPost.title = emojiUnescape(
            escapeExpression(pendingPost.title)
          );
        }

        return pendingPosts;
      });
CVE-2023-22455: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, tag descriptions, which can be updated by moderators, can be used for cross-site scripting attacks. This vulnerability can lead to a full XSS on sites which have modified or disabled Discourse’s default Content Security Policy. Versions 2.8.14 and 3.0.0.beta16 contain a patch.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-05T21:15Z
Repository: https://github.com/discourse/discourse
Language: JavaScript
Files changed: app/assets/javascripts/discourse/app/lib/render-tag.js
Commit date: 2023-01-05 06:08:32 +0800
Commit message: SECURITY: escape quotes in tag description when rendering (#19730)

Co-authored-by: Daniel Waterworth <me@danielwaterworth.com>
Diff: diff --git a/app/assets/javascripts/discourse/app/lib/render-tag.js b/app/assets/javascripts/discourse/app/lib/render-tag.js
index 418b37f1b4ac..d0fbb81515ef 100644
--- a/app/assets/javascripts/discourse/app/lib/render-tag.js
+++ b/app/assets/javascripts/discourse/app/lib/render-tag.js
@@ -1,9 +1,10 @@
 import User from "discourse/models/user";
 import { escapeExpression } from "discourse/lib/utilities";
 import getURL from "discourse-common/lib/get-url";
 import { helperContext } from "discourse-common/lib/helpers";
+import { escape } from "pretty-text/sanitizer";
 
 let _renderer = defaultRenderTag;
 
 export function replaceTagRenderer(fn) {
   _renderer = fn;
@@ -42,11 +43,11 @@ export function defaultRenderTag(tag, params) {
     "<" +
     tagName +
     href +
     " data-tag-name=" +
     tag +
-    (params.description ? ' title="' + params.description + '" ' : "") +
+    (params.description ? ' title="' + escape(params.description) + '" ' : "") +
     " class='" +
     classes.join(" ") +
     "'>" +
     visibleName +
     "</" +

Vulnerable code:     (params.description ? ' title="' + params.description + '" ' : "") +
Fixed code: import { escape } from "pretty-text/sanitizer";
    (params.description ? ' title="' + escape(params.description) + '" ' : "") +
CVE-2023-23621: Inefficient Regular Expression Complexity (CWE-1333)
value: Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branches, a malicious user can cause a regular expression denial of service using a carefully crafted user agent. This issue is patched in version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branches. There are no known workarounds.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2023-01-28T00:15Z
Repository: https://github.com/discourse/discourse
Language: Ruby
Files changed: lib/mobile_detection.rb
Commit date: 2023-01-25 18:55:33 +0200
Commit message: SECURITY: Prevent ReDoS in user agent parsing (#20002)

Co-authored-by: Penar Musaraj <pmusaraj@gmail.com>
Diff: diff --git a/lib/mobile_detection.rb b/lib/mobile_detection.rb
index b92523059e1c..aa4a8056eb19 100644
--- a/lib/mobile_detection.rb
+++ b/lib/mobile_detection.rb
@@ -34,9 +34,11 @@ module MobileDetection
     Firefox\/8[5-9]|
     Firefox\/9[0-9]|
     Firefox\/1[0-9][0-9]
   }x
 
+  USER_AGENT_MAX_LENGTH = 400
+
   def self.modern_mobile_device?(user_agent)
-    user_agent.match?(MODERN_MOBILE_REGEX)
+    user_agent[0...USER_AGENT_MAX_LENGTH].match?(MODERN_MOBILE_REGEX)
   end
 end

Vulnerable code:     user_agent.match?(MODERN_MOBILE_REGEX)
Fixed code:   USER_AGENT_MAX_LENGTH = 400

    user_agent[0...USER_AGENT_MAX_LENGTH].match?(MODERN_MOBILE_REGEX)
CVE-2023-37906: Allocation of Resources Without Limits or Throttling (CWE-770)
value: Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can edit a post in a topic and cause a DoS with a carefully crafted edit reason. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. There are no known workarounds for this vulnerability.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 4.3
Published: 2023-07-28T16:15Z
Repository: https://github.com/discourse/discourse
Language: Ruby
Files changed: app/models/post.rb, spec/models/post_spec.rb
Commit date: 2023-07-28 12:53:49 +0100
Commit message: SECURITY: Limit length of edit reason column

Diff: diff --git a/app/models/post.rb b/app/models/post.rb
index db19fa62db08..86cfa5962a40 100644
--- a/app/models/post.rb
+++ b/app/models/post.rb
@@ -62,10 +62,11 @@ class Post < ActiveRecord::Base
 
   has_many :post_hotlinked_media, dependent: :destroy, class_name: "PostHotlinkedMedia"
   has_many :reviewables, as: :target, dependent: :destroy
 
   validates_with PostValidator, unless: :skip_validation
+  validates :edit_reason, length: { maximum: 1000 }
 
   after_commit :index_search
 
   # We can pass several creating options to a post via attributes
   attr_accessor :image_sizes,
diff --git a/spec/models/post_spec.rb b/spec/models/post_spec.rb
index 66ece7915df8..12a46d8f77cd 100644
--- a/spec/models/post_spec.rb
+++ b/spec/models/post_spec.rb
@@ -59,10 +59,11 @@ RSpec.describe Post do
     args[:user] = user if user.present?
     Fabricate.build(:post, args)
   end
 
   it { is_expected.to validate_presence_of :raw }
+  it { is_expected.to validate_length_of(:edit_reason).is_at_most(1000) }
 
   # Min/max body lengths, respecting padding
   it { is_expected.not_to allow_value("x").for(:raw) }
   it { is_expected.not_to allow_value("x" * (SiteSetting.max_post_length + 1)).for(:raw) }
   it { is_expected.not_to allow_value((" " * SiteSetting.min_post_length) + "x").for(:raw) }

Fixed code:   validates :edit_reason, length: { maximum: 1000 }
  it { is_expected.to validate_length_of(:edit_reason).is_at_most(1000) }
CVE-2023-46130: Allocation of Resources Without Limits or Throttling (CWE-770)
value: Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, some theme components allow users to add svgs with unlimited `height` attributes, and this can affect the availability of subsequent replies in a topic. Most Discourse instances are unaffected, only instances with the svgbob or the mermaid theme component are within scope. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. As a workaround, disable or remove the relevant theme components. 
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 5.4
Published: 2023-11-10T15:15Z
Repository: https://github.com/discourse/discourse
Language: Other
Files changed: app/assets/stylesheets/common/base/topic-post.scss
Commit date: 2023-11-09 13:39:13 +1100
Commit message: SECURITY: Limit height of pre/svg elements

Ensures posts cannot have SVG or PRE elements that are too tall.

Diff: diff --git a/app/assets/stylesheets/common/base/topic-post.scss b/app/assets/stylesheets/common/base/topic-post.scss
index a8ebfc909a23..06aa23e5de39 100644
--- a/app/assets/stylesheets/common/base/topic-post.scss
+++ b/app/assets/stylesheets/common/base/topic-post.scss
@@ -206,10 +206,14 @@
     @supports not (aspect-ratio: 1) {
       // (see javascripts/discourse/app/initializers/image-aspect-ratio.js)
       height: var(--calculated-height);
     }
   }
+
+  svg {
+    max-height: 2000px;
+  }
 }
 
 // add staff color
 .moderator {
   .regular > .cooked {
@@ -1006,10 +1010,11 @@ aside.quote {
     }
   }
 }
 
 pre {
+  max-height: 2000px;
   code {
     word-wrap: normal;
     display: block;
     padding: 0.5em;
     color: var(--primary);

Fixed code: 
  svg {
    max-height: 2000px;
  }
  max-height: 2000px;
CVE-2023-49099: Improper Access Control (CWE-284)
value: Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users even when login is required. This vulnerability has been patched in 3.2.0.beta4 and 3.1.4.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 4.3
Published: 2024-01-12T21:15Z
Repository: https://github.com/discourse/discourse
Language: Ruby
Files changed: app/controllers/uploads_controller.rb, spec/requests/uploads_controller_spec.rb
Commit date: 2024-01-08 08:02:19 -0700
Commit message: SECURITY: Prevent guest users from accessing secure uploads when login required

Diff: diff --git a/app/controllers/uploads_controller.rb b/app/controllers/uploads_controller.rb
index 7132605ae346..00628ef51215 100644
--- a/app/controllers/uploads_controller.rb
+++ b/app/controllers/uploads_controller.rb
@@ -166,10 +166,11 @@ class UploadsController < ApplicationController
                 allow_other_host: true
   end
 
   def handle_secure_upload_request(upload, path_with_ext = nil)
     if upload.access_control_post_id.present?
+      raise Discourse::InvalidAccess if current_user.nil? && SiteSetting.login_required
       raise Discourse::InvalidAccess if !guardian.can_see?(upload.access_control_post)
     else
       return render_404 if current_user.nil?
     end
 
diff --git a/spec/requests/uploads_controller_spec.rb b/spec/requests/uploads_controller_spec.rb
index 5cbb96819a73..0524e0ec5538 100644
--- a/spec/requests/uploads_controller_spec.rb
+++ b/spec/requests/uploads_controller_spec.rb
@@ -576,10 +576,24 @@ RSpec.describe UploadsController do
             get secure_url
             expect(response.status).to eq(403)
           end
         end
 
+        context "when login is required and user is not signed in" do
+          let(:post) { Fabricate(:post) }
+
+          before do
+            SiteSetting.login_required = true
+            upload.update(access_control_post_id: post.id)
+          end
+
+          it "returns a 403" do
+            get secure_url
+            expect(response.status).to eq(403)
+          end
+        end
+
         context "when the prevent_anons_from_downloading_files setting is enabled and the user is anon" do
           before { SiteSetting.prevent_anons_from_downloading_files = true }
 
           it "returns a 404" do
             delete "/session/#{user.username}.json"

Fixed code:       raise Discourse::InvalidAccess if current_user.nil? && SiteSetting.login_required
        context "when login is required and user is not signed in" do
          let(:post) { Fabricate(:post) }

          before do
            SiteSetting.login_required = true
            upload.update(access_control_post_id: post.id)
          end

          it "returns a 403" do
            get secure_url
            expect(response.status).to eq(403)
          end
        end
CVE-2024-35227: Insufficient Information (NVD-CWE-noinfo)
value: Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, Oneboxing against a carefully crafted malicious URL can reduce the availability of a Discourse instance. The problem has been patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch. There are no known workarounds available for this vulnerability. 
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-03T18:15Z
Repository: https://github.com/discourse/discourse
Language: Ruby
Files changed: lib/onebox/engine/standard_embed.rb
Commit date: 2024-07-03 20:49:25 +0800
Commit message: SECURITY: Avoid the use of `Object#send` in `Onebox::Engine::StandardEmbed`

Use `Object#public_send` instead which is much safer

Diff: diff --git a/lib/onebox/engine/standard_embed.rb b/lib/onebox/engine/standard_embed.rb
index c21ca81801f60..e3175d6247d09 100644
--- a/lib/onebox/engine/standard_embed.rb
+++ b/lib/onebox/engine/standard_embed.rb
@@ -159,11 +159,11 @@ module Onebox
         @json_ld ||= Onebox::JsonLd.new(html_doc)
       end
 
       def set_from_normalizer_data(normalizer)
         normalizer.data.each do |k, _|
-          v = normalizer.send(k)
+          v = normalizer.public_send(k)
           @raw[k] ||= v unless v.nil?
         end
       end
 
       def set_opengraph_data_on_raw

Vulnerable code:           v = normalizer.send(k)
Fixed code:           v = normalizer.public_send(k)
CVE-2021-4070: Off-by-one Error (CWE-193)
value: Off-by-one Error in GitHub repository v2fly/v2ray-core prior to 4.44.0.
CWE description: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CVSS v3 base score: 9.1
Published: 2022-02-23T20:15Z
Repository: https://github.com/v2fly/v2ray-core
Language: Go
Files changed: proxy/vmess/encoding/commands.go, proxy/vmess/encoding/commands_test.go
Commit date: 2021-12-05 19:17:20 +0000
Commit message: Fix DoS attack vulnerability in CommandSwitchAccountFactory

Diff: diff --git a/proxy/vmess/encoding/commands.go b/proxy/vmess/encoding/commands.go
index f1f228f0..ff3ef2f0 100644
--- a/proxy/vmess/encoding/commands.go
+++ b/proxy/vmess/encoding/commands.go
@@ -137,11 +137,11 @@ func (f *CommandSwitchAccountFactory) Unmarshal(data []byte) (interface{}, error
 	if len(data) < levelStart+1 {
 		return nil, newError("insufficient length.")
 	}
 	cmd.Level = uint32(data[levelStart])
 	timeStart := levelStart + 1
-	if len(data) < timeStart {
+	if len(data) < timeStart+1 {
 		return nil, newError("insufficient length.")
 	}
 	cmd.ValidMin = data[timeStart]
 	return cmd, nil
 }
diff --git a/proxy/vmess/encoding/commands_test.go b/proxy/vmess/encoding/commands_test.go
index f22a2477..4c85bfcb 100644
--- a/proxy/vmess/encoding/commands_test.go
+++ b/proxy/vmess/encoding/commands_test.go
@@ -1,8 +1,9 @@
 package encoding_test
 
 import (
+	"github.com/stretchr/testify/assert"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
 
 	"github.com/v2fly/v2ray-core/v4/common"
@@ -33,5 +34,25 @@ func TestSwitchAccount(t *testing.T) {
 	}
 	if r := cmp.Diff(sa2, sa); r != "" {
 		t.Error(r)
 	}
 }
+
+func TestSwitchAccountBugOffByOne(t *testing.T) {
+	sa := &protocol.CommandSwitchAccount{
+		Port:     1234,
+		ID:       uuid.New(),
+		AlterIds: 1024,
+		Level:    128,
+		ValidMin: 16,
+	}
+
+	buffer := buf.New()
+	csaf := CommandSwitchAccountFactory{}
+	common.Must(csaf.Marshal(sa, buffer))
+
+	Payload := buffer.Bytes()
+
+	cmd, err := csaf.Unmarshal(Payload[:len(Payload)-1])
+	assert.Error(t, err)
+	assert.Nil(t, cmd)
+}

Vulnerable code: 	if len(data) < timeStart {
Fixed code: 	if len(data) < timeStart+1 {
	"github.com/stretchr/testify/assert"

func TestSwitchAccountBugOffByOne(t *testing.T) {
	sa := &protocol.CommandSwitchAccount{
		Port:     1234,
		ID:       uuid.New(),
		AlterIds: 1024,
		Level:    128,
		ValidMin: 16,
	}

	buffer := buf.New()
	csaf := CommandSwitchAccountFactory{}
	common.Must(csaf.Marshal(sa, buffer))

	Payload := buffer.Bytes()

	cmd, err := csaf.Unmarshal(Payload[:len(Payload)-1])
	assert.Error(t, err)
	assert.Nil(t, cmd)
}
CVE-2011-10001: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in iamdroppy phoenixcf. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file content/2-Community/articles.cfm. The manipulation leads to sql injection. The patch is named d156faf8bc36cd49c3b10d3697ef14167ad451d8. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218491.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-18T16:15Z
Repository: https://github.com/iamdroppy/phoenixcf
Language: Other
Files changed: content/2-Community/articles.cfm
Commit date: 2011-02-07 22:58:41 +0000
Commit message: Fixed potential SQL exploit
Diff: diff --git a/content/2-Community/articles.cfm b/content/2-Community/articles.cfm
index 1a6cc95..3417d5e 100644
--- a/content/2-Community/articles.cfm
+++ b/content/2-Community/articles.cfm
@@ -56,10 +56,11 @@
 		ORDER BY id DESC
 		LIMIT 1
 	</cfquery>
 	<cfset url.story = #ThisStory.id#>
 <cfelse>
+	<cfset url.story = int(url.story)>
 	<cfquery name="ThisStory" datasource="#DSN#">
 		SELECT *
 		FROM cms_news
 		WHERE id = #url.story#
 		LIMIT 1
@@ -103,11 +104,12 @@
 
 <cfquery name="Comments" datasource="#DSN#">
 	SELECT *
 	FROM cms_comments
 	WHERE story = #url.story#
-	ORDER BY id ASC
+	ORDER BY id DESC
+	LIMIT 25
 </cfquery>
 
 	<div class="boxContent">
 		<cfset style = "left">
 		<cfoutput query="Comments">

Vulnerable code: 	ORDER BY id ASC
Fixed code: 	<cfset url.story = int(url.story)>
	ORDER BY id DESC
	LIMIT 25
CVE-2018-1000657: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Rust Programming Language Rust standard library version Commit bfa0e1f58acf1c28d500c34ed258f09ae021893e and later; stable release 1.3.0 and later contains a Buffer Overflow vulnerability in std::collections::vec_deque::VecDeque::reserve() function that can result in Arbitrary code execution, but no proof-of-concept exploit is currently published.. This vulnerability appears to have been fixed in after commit fdfafb510b1a38f727e920dccbeeb638d39a8e60; stable release 1.22.0 and later.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2018-08-20T19:31Z
Repository: https://github.com/rust-lang/rust
Language: Unknown
Commit date: 2017-09-27 01:23:24 +0000
Commit message: Auto merge of #44802 - sfackler:vecdeque-oob, r=Gankro

Fix capacity comparison in reserve

You can otherwise end up in a situation where you don't actually resize
but still call into handle_cap_increase which then corrupts head/tail.

Closes #44800

Not totally sure the right way to write a test for this - there are some debug asserts the old bad behavior will hit but we don't build the stdlib with debug assertions by default.

r? @Gankro
CVE-2020-36626: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as critical has been found in Modern Tribe Panel Builder Plugin. Affected is the function add_post_content_filtered_to_search_sql of the file ModularContent/SearchFilter.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 4528d4f855dbbf24e9fc12a162fda84ce3bedc2f. It is recommended to apply a patch to fix this issue. VDB-216738 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-27T15:15Z
Repository: https://github.com/moderntribe/panel-builder
Language: Unknown
Commit date: 2020-05-07 22:34:11 -0600
Commit message: Merge pull request #173 from moderntribe/security/fix-search-xss

Fix search XSS
CVE-2020-15097: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: loklak is an open-source server application which is able to collect messages from various sources, including twitter. The server contains a search index and a peer-to-peer index sharing interface. All messages are stored in an elasticsearch index. In loklak less than or equal to commit 5f48476, a path traversal vulnerability exists. Insufficient input validation in the APIs exposed by the loklak server allowed a directory traversal vulnerability. Any admin configuration and files readable by the app available on the hosted file system can be retrieved by the attacker. Furthermore, user-controlled content could be written to any admin config and files readable by the application. This has been patched in commit 50dd692. Users will need to upgrade their hosted instances of loklak to not be vulnerable to this exploit.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.1
Published: 2021-02-02T18:15Z
Repository: https://github.com/loklak/loklak_server
Language: Unknown
Commit date: 2020-07-02 09:46:45 -0700
Commit message: Merge pull request from GHSA-7557-4v29-rqw6

Fix directory traversal
CVE-2024-3081: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in EasyCorp EasyAdmin up to 4.8.9. It has been declared as problematic. Affected by this vulnerability is the function Autocomplete of the file assets/js/autocomplete.js of the component Autocomplete. The manipulation of the argument item leads to cross site scripting. The attack can be launched remotely. Upgrading to version 4.8.10 is able to address this issue. The identifier of the patch is 127436e4c3f56276d548070f99e61b7234200a11. It is recommended to upgrade the affected component. The identifier VDB-258613 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2024-03-29T15:15Z
Repository: https://github.com/EasyCorp/EasyAdminBundle
Language: Unknown
Commit date: 2024-01-13 15:13:19 +0100
Commit message: bug #6067 XSS in autocomplete (simoheinonen)

This PR was merged into the 4.x branch.

Discussion
----------

XSS in autocomplete

Similar to https://github.com/EasyCorp/EasyAdminBundle/pull/5971

Not exactly sure what the difference between "option" and "item" is but this seems to fix XSS with collection fields

Commits
-------

bee223eb Escape
CVE-2018-1000041: Insufficient Information (NVD-CWE-noinfo)
value: GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in the victim's Windows username and NTLM password hash being leaked to remote attackers through SMB. This attack appear to be exploitable via The victim must process a specially crafted SVG file containing an UNC path on Windows.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 8.8
Published: 2018-02-09T23:29Z
Repository: https://github.com/GNOME/librsvg
Language: Unknown
Commit date: 2017-12-04 18:55:28 -0600
Commit message: Merge branch 'no-xrefs-in-paint-servers'
CVE-2021-4245: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: A vulnerability classified as problematic has been found in chbrown rfc6902. This affects an unknown part of the file pointer.ts. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The exploit has been disclosed to the public and may be used. The name of the patch is c006ce9faa43d31edb34924f1df7b79c137096cf. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215883.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2022-12-15T20:15Z
Repository: https://github.com/chbrown/rfc6902
Language: TypeScript
Files changed: pointer.ts
Commit date: 2021-12-15 21:39:21 -0600
Commit message: Fix prototype pollution vulnerability

Closes #76

Diff: diff --git a/pointer.ts b/pointer.ts
index d5c5d57..d6fecfb 100644
--- a/pointer.ts
+++ b/pointer.ts
@@ -67,10 +67,13 @@ export class Pointer {
     let key = ''
     let value = object
     for (let i = 1, l = this.tokens.length; i < l; i++) {
       parent = value
       key = this.tokens[i]
+      if (key == '__proto__' || key == 'constructor' || key == 'prototype') {
+        continue
+      }
       // not sure if this the best way to handle non-existant paths...
       value = (parent || {})[key]
     }
     return {parent, key, value}
   }

Fixed code:       if (key == '__proto__' || key == 'constructor' || key == 'prototype') {
        continue
      }
CVE-2016-15013: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in ForumHulp searchresults. It has been rated as critical. Affected by this issue is the function list_keywords of the file event/listener.php. The manipulation of the argument word leads to sql injection. The name of the patch is dd8a312bb285ad9735a8e1da58e9e955837b7322. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217628.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-07T20:15Z
Repository: https://github.com/ForumHulp/searchresults
Language: PHP
Files changed: event/listener.php
Commit date: 2016-10-25 16:59:22 +0100
Commit message: SQL Injection Fix

This would fix a Major SQL Injection Flaw. I guess the $this->db->sql_escape is the right function.
Diff: diff --git a/event/listener.php b/event/listener.php
index 9e35c0d..9116b11 100644
--- a/event/listener.php
+++ b/event/listener.php
@@ -71,15 +71,15 @@ class listener implements EventSubscriberInterface
 			if (strlen($word) <= $this->config['fulltext_native_min_chars'])
 			{
 				continue;
 			}
 
-			$sql = 'SELECT word_id FROM ' . SEARCH_WORDLIST_TABLE . ' WHERE word_text = "' . $word . '"';
+			$sql = 'SELECT word_id FROM ' . SEARCH_WORDLIST_TABLE . ' WHERE word_text = "' . $this->db->sql_escape($word) . '"';
 			$resulttemp = $this->db->sql_query($sql);
 			$found = ($rowtemp = $this->db->sql_fetchrow($resulttemp));
 
-			$sql = 'SELECT search_keywords, last_time FROM ' . $this->searchresults_table . ' WHERE search_keywords = "' . $word . '"';
+			$sql = 'SELECT search_keywords, last_time FROM ' . $this->searchresults_table . ' WHERE search_keywords = "' . $this->db->sql_escape($word) . '"';
 			$result = $this->db->sql_query($sql);
 			$used = ($row = $this->db->sql_fetchrow($result));
 			$this->db->sql_freeresult($result);
 
 			$fields = array('last_time' => time(), 'in_post' => ($found) ? 1 : 0);

Vulnerable code: 			$sql = 'SELECT word_id FROM ' . SEARCH_WORDLIST_TABLE . ' WHERE word_text = "' . $word . '"';
			$sql = 'SELECT search_keywords, last_time FROM ' . $this->searchresults_table . ' WHERE search_keywords = "' . $word . '"';
Fixed code: 			$sql = 'SELECT word_id FROM ' . SEARCH_WORDLIST_TABLE . ' WHERE word_text = "' . $this->db->sql_escape($word) . '"';
			$sql = 'SELECT search_keywords, last_time FROM ' . $this->searchresults_table . ' WHERE search_keywords = "' . $this->db->sql_escape($word) . '"';
CVE-2021-39359: Improper Certificate Validation (CWE-295)
value: In GNOME libgda through 6.0.0, gda-web-provider.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.
CWE description: The product does not validate, or incorrectly validates, a certificate.
CVSS v3 base score: 5.9
Published: 2021-08-22T19:15Z
Repository: https://github.com/GNOME/libgda
Language: Unknown
Commit date: 2021-10-20 23:02:45 +0000
Commit message: Merge branch 'master' into 'master'

Fix CVE-2021-39359 by forcing TLS certificate validation

Closes #249

See merge request GNOME/libgda!189
CVE-2011-2932: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a "UTF-8 escaping vulnerability."
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2011-08-29T18:55Z
Repository: https://github.com/rails/rails
Language: Ruby
Files changed: activesupport/lib/active_support/core_ext/string/output_safety.rb, activesupport/test/core_ext/string_ext_test.rb
Commit date: 2011-08-16 15:24:58 -0700
Commit message: properly escape html to avoid invalid utf8 causing XSS attacks

Diff: diff --git a/activesupport/lib/active_support/core_ext/string/output_safety.rb b/activesupport/lib/active_support/core_ext/string/output_safety.rb
index 6d6c4912b..f111c8e5a 100644
--- a/activesupport/lib/active_support/core_ext/string/output_safety.rb
+++ b/activesupport/lib/active_support/core_ext/string/output_safety.rb
@@ -18,11 +18,11 @@ module Util
     def html_escape(s)
       s = s.to_s
       if s.html_safe?
         s
       else
-        s.gsub(/[&"><]/) { |special| HTML_ESCAPE[special] }.html_safe
+        s.to_s.gsub(/&/, "&amp;").gsub(/\"/, "&quot;").gsub(/>/, "&gt;").gsub(/</, "&lt;").html_safe
       end
     end
 
     # Aliasing twice issues a warning "discarding old...". Remove first to avoid it.
     remove_method(:h)
diff --git a/activesupport/test/core_ext/string_ext_test.rb b/activesupport/test/core_ext/string_ext_test.rb
index a4bba056d..81a284dde 100644
--- a/activesupport/test/core_ext/string_ext_test.rb
+++ b/activesupport/test/core_ext/string_ext_test.rb
@@ -5,14 +5,21 @@
 
 require 'active_support/inflector'
 require 'active_support/core_ext/string'
 require 'active_support/time'
 require 'active_support/core_ext/string/strip'
+require 'active_support/core_ext/string/output_safety'
 
 class StringInflectionsTest < Test::Unit::TestCase
   include InflectorTestCases
 
+  def test_erb_escape
+    string = [192, 60].pack('CC')
+    expected = 192.chr + "&lt;"
+    assert_equal expected, ERB::Util.html_escape(string)
+  end
+
   def test_strip_heredoc_on_an_empty_string
     assert_equal '', ''.strip_heredoc
   end
 
   def test_strip_heredoc_on_a_string_with_no_lines

Vulnerable code:         s.gsub(/[&"><]/) { |special| HTML_ESCAPE[special] }.html_safe
Fixed code:         s.to_s.gsub(/&/, "&amp;").gsub(/\"/, "&quot;").gsub(/>/, "&gt;").gsub(/</, "&lt;").html_safe
require 'active_support/core_ext/string/output_safety'
  def test_erb_escape
    string = [192, 60].pack('CC')
    expected = 192.chr + "&lt;"
    assert_equal expected, ERB::Util.html_escape(string)
  end
CVE-2022-23633: Improper Removal of Sensitive Information Before Storage or Transfer (CWE-212)
value: Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.
CWE description: The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
CVSS v3 base score: 5.9
Published: 2022-02-11T21:15Z
Repository: https://github.com/rails/rails
Language: Ruby
Files changed: activesupport/lib/active_support/reloader.rb
Commit date: 2022-02-11 11:48:19 -0800
Commit message: Fix reloader to work with new Executor signature

This is a follow up to [CVE-2022-23633].

Diff: diff --git a/activesupport/lib/active_support/reloader.rb b/activesupport/lib/active_support/reloader.rb
index 2f81cd4f80b..e751866a270 100644
--- a/activesupport/lib/active_support/reloader.rb
+++ b/activesupport/lib/active_support/reloader.rb
@@ -56,11 +56,11 @@ def self.reload!
         end
       end
       prepare!
     end
 
-    def self.run! # :nodoc:
+    def self.run!(reset: false) # :nodoc:
       if check!
         super
       else
         Null
       end

Vulnerable code:     def self.run! # :nodoc:
Fixed code:     def self.run!(reset: false) # :nodoc:
CVE-2012-2675: Numeric Errors (CWE-189)
value: Multiple integer overflows in the (1) CallMalloc (malloc) and (2) nedpcalloc (calloc) functions in nedmalloc (nedmalloc.c) before 1.10 beta2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.
CWE description: Weaknesses in this category are related to improper calculation or conversion of numbers.
Published: 2012-07-25T19:55Z
Repository: https://github.com/ned14/nedmalloc
Language: C
Files changed: nedmalloc.c
Commit date: 2012-04-14 17:22:35 -0400
Commit message: Avoid overflowing allocation size in CallMalloc()

The wraparound could happen if USE_MAGIC_HEADERS is enabled.

Diff: diff --git a/nedmalloc.c b/nedmalloc.c
index 7170574..0f99a8a 100644
--- a/nedmalloc.c
+++ b/nedmalloc.c
@@ -326,11 +326,15 @@ static FORCEINLINE NEDMALLOCNOALIASATTR NEDMALLOCPTRATTR void *CallMalloc(void *
 {
 	void *RESTRICT ret=0;
 #if USE_MAGIC_HEADERS
 	size_t _alignment=alignment;
 	size_t *_ret=0;
-	size+=alignment+3*sizeof(size_t);
+	size_t bytes=size+alignment+3*sizeof(size_t);
+	/* Avoid addition overflow. */
+	if(bytes<size)
+		return 0;
+	size=bytes;
 	_alignment=0;
 #endif
 #if USE_ALLOCATOR==0
 	ret=(flags & M2_ZERO_MEMORY) ? syscalloc(1, size) : sysmalloc(size);	/* magic headers takes care of alignment */
 #elif USE_ALLOCATOR==1

Vulnerable code: 	size+=alignment+3*sizeof(size_t);
Fixed code: 	size_t bytes=size+alignment+3*sizeof(size_t);
	/* Avoid addition overflow. */
	if(bytes<size)
		return 0;
	size=bytes;
CVE-2012-2675: Numeric Errors (CWE-189)
value: Multiple integer overflows in the (1) CallMalloc (malloc) and (2) nedpcalloc (calloc) functions in nedmalloc (nedmalloc.c) before 1.10 beta2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.
CWE description: Weaknesses in this category are related to improper calculation or conversion of numbers.
Published: 2012-07-25T19:55Z
Repository: https://github.com/ned14/nedmalloc
Language: C
Files changed: nedmalloc.c
Commit date: 2012-04-14 16:39:42 -0400
Commit message: Avoid overflowing allocation size in calloc()

Diff: diff --git a/nedmalloc.c b/nedmalloc.c
index 1b7922e..7170574 100644
--- a/nedmalloc.c
+++ b/nedmalloc.c
@@ -2016,12 +2016,16 @@ NEDMALLOCNOALIASATTR NEDMALLOCPTRATTR void * nedpmalloc(nedpool *p, size_t size)
 	unsigned flags=NEDMALLOC_FORCERESERVE(p, 0, size);
 	return nedpmalloc2(p, size, 0, flags);
 }
 NEDMALLOCNOALIASATTR NEDMALLOCPTRATTR void * nedpcalloc(nedpool *p, size_t no, size_t size) THROWSPEC
 {
-	unsigned flags=NEDMALLOC_FORCERESERVE(p, 0, no*size);
-	return nedpmalloc2(p, size*no, 0, M2_ZERO_MEMORY|flags);
+	size_t bytes=no*size;
+	/* Avoid multiplication overflow. */
+	if(size && no!=bytes/size)
+		return 0;
+	unsigned flags=NEDMALLOC_FORCERESERVE(p, 0, bytes);
+	return nedpmalloc2(p, bytes, 0, M2_ZERO_MEMORY|flags);
 }
 NEDMALLOCNOALIASATTR NEDMALLOCPTRATTR void * nedprealloc(nedpool *p, void *mem, size_t size) THROWSPEC
 {
 	unsigned flags=NEDMALLOC_FORCERESERVE(p, mem, size);
 #if ENABLE_USERMODEPAGEALLOCATOR

Vulnerable code: 	unsigned flags=NEDMALLOC_FORCERESERVE(p, 0, no*size);
	return nedpmalloc2(p, size*no, 0, M2_ZERO_MEMORY|flags);
Fixed code: 	size_t bytes=no*size;
	/* Avoid multiplication overflow. */
	if(size && no!=bytes/size)
		return 0;
	unsigned flags=NEDMALLOC_FORCERESERVE(p, 0, bytes);
	return nedpmalloc2(p, bytes, 0, M2_ZERO_MEMORY|flags);