Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2020-14093: Cleartext Transmission of Sensitive Information (CWE-319)
value: Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response.
CWE description: The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
CVSS v3 base score: 5.9
Published: 2020-06-15T05:15Z
Repository: https://github.com/muttmua/mutt
Language: C
Files changed: imap/imap.c
Commit date: 2020-06-14 13:52:53 -0700
Commit message: Prevent possible IMAP MITM via PREAUTH response.

This is similar to CVE-2014-2567 and CVE-2020-12398.  STARTTLS is not
allowed in the Authenticated state, so previously Mutt would
implicitly mark the connection as authenticated and skip any
encryption checking/enabling.

No credentials are exposed, but it does allow messages to be sent to
an attacker, via postpone or fcc'ing for instance.

Reuse the $ssl_starttls quadoption "in reverse" to prompt to abort the
connection if it is unencrypted.

Thanks very much to Damian Poddebniak and Fabian Ising from the
Münster University of Applied Sciences for reporting this issue, and
their help in testing the fix.

Diff: diff --git a/imap/imap.c b/imap/imap.c
index 63362176..3ca10df4 100644
--- a/imap/imap.c
+++ b/imap/imap.c
@@ -528,10 +528,26 @@ int imap_open_connection (IMAP_DATA* idata)
     }
 #endif
   }
   else if (ascii_strncasecmp ("* PREAUTH", idata->buf, 9) == 0)
   {
+#if defined(USE_SSL)
+    /* An unencrypted PREAUTH response is most likely a MITM attack.
+     * Require a confirmation. */
+    if (!idata->conn->ssf)
+    {
+      if (option(OPTSSLFORCETLS) ||
+          (query_quadoption (OPT_SSLSTARTTLS,
+                             _("Abort unencrypted PREAUTH connection?")) != MUTT_NO))
+      {
+        mutt_error _("Encrypted connection unavailable");
+        mutt_sleep (1);
+        goto err_close_conn;
+      }
+    }
+#endif
+
     idata->state = IMAP_AUTHENTICATED;
     if (imap_check_capabilities (idata) != 0)
       goto bail;
     FREE (&idata->capstr);
   }

Fixed code: #if defined(USE_SSL)
    /* An unencrypted PREAUTH response is most likely a MITM attack.
     * Require a confirmation. */
    if (!idata->conn->ssf)
    {
      if (option(OPTSSLFORCETLS) ||
          (query_quadoption (OPT_SSLSTARTTLS,
                             _("Abort unencrypted PREAUTH connection?")) != MUTT_NO))
      {
        mutt_error _("Encrypted connection unavailable");
        mutt_sleep (1);
        goto err_close_conn;
      }
    }
#endif
CVE-2018-12684: Out-of-bounds Read (CWE-125)
value: Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Denial of Service or Information Disclosure via a crafted SSI file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.1
Published: 2018-06-22T19:29Z
Repository: https://github.com/civetweb/civetweb
Language: C
Files changed: src/civetweb.c
Commit date: 2018-06-16 13:53:54 +0200
Commit message: Check length of memcmp

Diff: diff --git a/src/civetweb.c b/src/civetweb.c
index 4c885513..f3fcb8c0 100644
--- a/src/civetweb.c
+++ b/src/civetweb.c
@@ -11609,14 +11609,14 @@ send_ssi_file(struct mg_connection *conn,
 
 				if (in_ssi_tag) {
 					/* Handle SSI tag */
 					buf[len] = 0;
 
-					if (!memcmp(buf + 5, "include", 7)) {
+					if ((len > 12) && !memcmp(buf + 5, "include", 7)) {
 						do_ssi_include(conn, path, buf + 12, include_level + 1);
 #if !defined(NO_POPEN)
-					} else if (!memcmp(buf + 5, "exec", 4)) {
+					} else if ((len > 9) && !memcmp(buf + 5, "exec", 4)) {
 						do_ssi_exec(conn, buf + 9);
 #endif /* !NO_POPEN */
 					} else {
 						mg_cry_internal(conn,
 						                "%s: unknown SSI "

Vulnerable code: 					if (!memcmp(buf + 5, "include", 7)) {
					} else if (!memcmp(buf + 5, "exec", 4)) {
Fixed code: 					if ((len > 12) && !memcmp(buf + 5, "include", 7)) {
					} else if ((len > 9) && !memcmp(buf + 5, "exec", 4)) {
CVE-2018-12684: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Denial of Service or Information Disclosure via a crafted SSI file.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.1
Published: 2018-06-22T19:29Z
Repository: https://github.com/civetweb/civetweb
Language: C
Files changed: src/civetweb.c
Commit date: 2018-06-16 13:53:54 +0200
Commit message: Check length of memcmp

Diff: diff --git a/src/civetweb.c b/src/civetweb.c
index 4c885513..f3fcb8c0 100644
--- a/src/civetweb.c
+++ b/src/civetweb.c
@@ -11609,14 +11609,14 @@ send_ssi_file(struct mg_connection *conn,
 
 				if (in_ssi_tag) {
 					/* Handle SSI tag */
 					buf[len] = 0;
 
-					if (!memcmp(buf + 5, "include", 7)) {
+					if ((len > 12) && !memcmp(buf + 5, "include", 7)) {
 						do_ssi_include(conn, path, buf + 12, include_level + 1);
 #if !defined(NO_POPEN)
-					} else if (!memcmp(buf + 5, "exec", 4)) {
+					} else if ((len > 9) && !memcmp(buf + 5, "exec", 4)) {
 						do_ssi_exec(conn, buf + 9);
 #endif /* !NO_POPEN */
 					} else {
 						mg_cry_internal(conn,
 						                "%s: unknown SSI "

Vulnerable code: 					if (!memcmp(buf + 5, "include", 7)) {
					} else if (!memcmp(buf + 5, "exec", 4)) {
Fixed code: 					if ((len > 12) && !memcmp(buf + 5, "include", 7)) {
					} else if ((len > 9) && !memcmp(buf + 5, "exec", 4)) {
CVE-2018-18074: Insufficiently Protected Credentials (CWE-522)
value: The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
CWE description: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CVSS v3 base score: 7.5
Published: 2018-10-09T17:29Z
Repository: https://github.com/requests/requests
Language: Unknown
Commit date: 2018-09-14 20:08:04 +0800
Commit message: Merge pull request #4718 from bmerry/fix-4716

Strip Authorization header whenever root URL changes
CVE-2021-3644: Insufficient Information (NVD-CWE-noinfo)
value: A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possibly retrieve the item which was stored in the vault. The highest threat from this vulnerability is data confidentiality and integrity.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 3.3
Published: 2022-08-26T16:15Z
Repository: https://github.com/wildfly/wildfly-core
Language: Unknown
Commit date: 2021-07-16 08:58:36 +0200
Commit message: Merge pull request #4668 from darranl/WFCORE-5511/main

[WFCORE-5511] wildfly-core: Invalid Sensitivity Classification of Vault Expression
CVE-2018-6003: Uncontrolled Recursion (CWE-674)
value: An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.
CWE description: The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
CVSS v3 base score: 7.5
Published: 2018-01-22T20:29Z
Repository: https://gitlab.com/gnutls/libtasn1
Language: Other
Files changed: NEWS, lib/libtasn1.h
Commit date: 2018-01-16 18:45:36 +0100
Commit message: released 4.13

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

Diff: diff --git a/NEWS b/NEWS
index f9ac241..3fac146 100644
--- a/NEWS
+++ b/NEWS
@@ -1,8 +1,8 @@
 GNU Libtasn1 NEWS                                     -*- outline -*-
 
-* Noteworthy changes in release 4.13 (unreleased) [stable]
+* Noteworthy changes in release 4.13 (released 2018-01-16) [stable]
 - On indefinite string decoding, set a maximum level of allowed recursions
   (3) to protect the BER decoder from a stack exhaustion.
 
 * Noteworthy changes in release 4.12 (released 2017-05-29) [stable]
 - Corrected so-name version
diff --git a/lib/libtasn1.h b/lib/libtasn1.h
index 626b11e..ea26b78 100644
--- a/lib/libtasn1.h
+++ b/lib/libtasn1.h
@@ -42,11 +42,11 @@
 #ifdef __cplusplus
 extern "C"
 {
 #endif
 
-#define ASN1_VERSION "4.12"
+#define ASN1_VERSION "4.13"
 
 #if defined(__GNUC__) && !defined(ASN1_INTERNAL_BUILD)
 # define _ASN1_GCC_VERSION (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__)
 # if _ASN1_GCC_VERSION >= 30100
 #  define _ASN1_GCC_ATTR_DEPRECATED __attribute__ ((__deprecated__))

Vulnerable code: * Noteworthy changes in release 4.13 (unreleased) [stable]
#define ASN1_VERSION "4.12"
Fixed code: * Noteworthy changes in release 4.13 (released 2018-01-16) [stable]
#define ASN1_VERSION "4.13"
CVE-2022-22851: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the specialization parameter in doctors.php
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-01-26T16:15Z
Repository: https://github.com/Sant268/CVE-2022-22851
Language: Markdown
Files changed: CVE-2022-22851.md
Commit date: 2022-01-23 21:35:19 +0530
Commit message: Create CVE-2022-22851.md

Diff: diff --git a/CVE-2022-22851.md b/CVE-2022-22851.md
new file mode 100644
index 0000000..b65f098
--- /dev/null
+++ b/CVE-2022-22851.md
@@ -0,0 +1,19 @@
+# CVE-2022-22851
+# Exploit Title: HPRMS - 'doctors' Stored XSS
+# Exploit Author: (Sant268)
+# Vendor Homepage: https://www.sourcecodester.com/
+# Software Link: https://www.sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html
+# Version: HPRMS 1.0
+# Tested on: Ubuntu 20, Apache
+# CVE: CVE-2022-22851
+
+- Description:
+A XSS issue in HPRMS v.1.0 allows remote attackers to inject JavaScript via /articles in the description parameter.
+
+- Payload used:
+<img src =q onerror=prompt(8)>
+
+- Steps to reproduce:
+1- Go to http://victim.com/admin/?page=doctors
+2- Add a Doctor, paste the payload in specialisation
+3- Alert will pop whenever the page is accessed.

Fixed code: # CVE-2022-22851
# Exploit Title: HPRMS - 'doctors' Stored XSS
# Exploit Author: (Sant268)
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html
# Version: HPRMS 1.0
# Tested on: Ubuntu 20, Apache
# CVE: CVE-2022-22851

- Description:
A XSS issue in HPRMS v.1.0 allows remote attackers to inject JavaScript via /articles in the description parameter.

- Payload used:
<img src =q onerror=prompt(8)>

- Steps to reproduce:
1- Go to http://victim.com/admin/?page=doctors
2- Add a Doctor, paste the payload in specialisation
3- Alert will pop whenever the page is accessed.
CVE-2022-31001: Out-of-bounds Read (CWE-125)
value: Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to FreeSWITCH, which may cause crash. This type of crash may be caused by `#define MATCH(s, m) (strncmp(s, m, n = sizeof(m) - 1) == 0)`, which will make `n` bigger and trigger out-of-bound access when `IS_NON_WS(s[n])`. Version 1.13.8 contains a patch for this issue.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2022-05-31T20:15Z
Repository: https://github.com/freeswitch/sofia-sip
Language: Unknown
Commit date: 2022-05-25 16:58:18 +0300
Commit message: Merge pull request from GHSA-79jq-hh82-cv9g

Fix Out-of-bound read in sip_method_d
CVE-2022-31002: Out-of-bounds Read (CWE-125)
value: Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to FreeSWITCH, which may cause a crash. This type of crash may be caused by a URL ending with `%`. Version 1.13.8 contains a patch for this issue.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2022-05-31T19:15Z
Repository: https://github.com/freeswitch/sofia-sip
Language: Unknown
Commit date: 2022-05-25 16:54:12 +0300
Commit message: Merge pull request from GHSA-g3x6-p824-x6hm

Fix Out-of-bound read in url_canonize2 and url_canonize3
CVE-2022-31003: Heap-based Buffer Overflow (CWE-122)
value: Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, when parsing each line of a sdp message, `rest = record + 2` will access the memory behind `\0` and cause an out-of-bounds write. An attacker can send a message with evil sdp to FreeSWITCH, causing a crash or more serious consequence, such as remote code execution. Version 1.13.8 contains a patch for this issue.
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 9.8
Published: 2022-05-31T20:15Z
Repository: https://github.com/freeswitch/sofia-sip
Language: Unknown
Commit date: 2022-05-25 16:50:00 +0300
Commit message: Merge pull request from GHSA-8w5j-6g2j-pxcp

Fix Heap-buffer-overflow in parse_descs and parse_message
CVE-2022-31003: Out-of-bounds Write (CWE-787)
value: Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, when parsing each line of a sdp message, `rest = record + 2` will access the memory behind `\0` and cause an out-of-bounds write. An attacker can send a message with evil sdp to FreeSWITCH, causing a crash or more serious consequence, such as remote code execution. Version 1.13.8 contains a patch for this issue.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2022-05-31T20:15Z
Repository: https://github.com/freeswitch/sofia-sip
Language: Unknown
Commit date: 2022-05-25 16:50:00 +0300
Commit message: Merge pull request from GHSA-8w5j-6g2j-pxcp

Fix Heap-buffer-overflow in parse_descs and parse_message
CVE-2023-22741: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. In affected versions Sofia-SIP **lacks both message length and attributes length checks** when it handles STUN packets, leading to controllable heap-over-flow. For example, in stun_parse_attribute(), after we get the attribute's type and length value, the length will be used directly to copy from the heap, regardless of the message's left size. Since network users control the overflowed length, and the data is written to heap chunks later, attackers may achieve remote code execution by heap grooming or other exploitation methods. The bug was introduced 16 years ago in sofia-sip 1.12.4 (plus some patches through 12/21/2006) to in tree libs with git-svn-id: http://svn.freeswitch.org/svn/freeswitch/trunk@3774 d0543943-73ff-0310-b7d9-9358b9ac24b2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 9.8
Published: 2023-01-19T22:15Z
Repository: https://github.com/freeswitch/sofia-sip
Language: Unknown
Commit date: 2022-12-27 22:01:48 +0300
Commit message: Merge pull request #182 from QiuhaoLi/fix-stun-parser-oob

stun: add checks for STUN messag len and attr len
CVE-2017-20163: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability has been found in Red Snapper NView and classified as critical. This vulnerability affects the function mutate of the file src/Session.php. The manipulation of the argument session leads to sql injection. The name of the patch is cbd255f55d476b29e5680f66f48c73ddb3d416a8. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217516.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-05T20:15Z
Repository: https://github.com/RedSnapper/NView
Language: PHP
Files changed: src/Session.php
Commit date: 2017-04-28 13:45:36 +0100
Commit message: sql injection

Client uncovered sql injection attack in reference to xsession.
Diff: diff --git a/src/Session.php b/src/Session.php
index 41f46f3..1f3af98 100644
--- a/src/Session.php
+++ b/src/Session.php
@@ -31,13 +31,13 @@ class Session extends Singleton {
 		if (isset($_COOKIE["xsession"])) {
 			$session = static::$session;
 			$code = @$_SERVER['REMOTE_ADDR'] . @$_SERVER['SSL_SESSION_ID'] . "_wxf9[9]Z(9.2)";
 			$vector = $_SERVER['SCRIPT_URI'] . "37b807ea4118db8d";
 			$mutated = hash('sha256', openssl_encrypt(gzdeflate($session), "aes-256-cbc", $code, OPENSSL_RAW_DATA, substr($vector, 0, 16)));
-
-			Settings::$sql->query("update sio_session set id='$mutated' where id='$session'");
-			Settings::$sql->query("update sio_sessiondata set sid='$mutated' where sid='$session'");
+			$sqlSession = Settings::$sql->escape_string($session);
+			Settings::$sql->query("update sio_session set id='$mutated' where id='$sqlSession'");
+			Settings::$sql->query("update sio_sessiondata set sid='$mutated' where sid='$sqlSession'");
 			static::$sqlsess = $mutated;
 			static::$session = $mutated;
 			setcookie("xsession", static::$session, static::$cookieLife, '/', '', true, true); // 8640000 = 100 days
 		}
 	}

Vulnerable code: 
			Settings::$sql->query("update sio_session set id='$mutated' where id='$session'");
			Settings::$sql->query("update sio_sessiondata set sid='$mutated' where sid='$session'");
Fixed code: 			$sqlSession = Settings::$sql->escape_string($session);
			Settings::$sql->query("update sio_session set id='$mutated' where id='$sqlSession'");
			Settings::$sql->query("update sio_sessiondata set sid='$mutated' where sid='$sqlSession'");
CVE-2015-7809: Permissions, Privileges, and Access Controls (CWE-264)
value: The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the _self variable in a template.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Published: 2015-11-06T21:59Z
Repository: https://github.com/fabpot/Twig
Language: PHP
Files changed: lib/Twig/Template.php, test/Twig/Tests/TemplateTest.php
Commit date: 2015-08-12 17:44:05 +0200
Commit message: fixed sandbox security issue

Diff: diff --git a/lib/Twig/Template.php b/lib/Twig/Template.php
index 6eb2c360..4a9fe9aa 100644
--- a/lib/Twig/Template.php
+++ b/lib/Twig/Template.php
@@ -152,10 +152,15 @@ abstract class Twig_Template implements Twig_TemplateInterface
             $template = null;
             $block = null;
         }
 
         if (null !== $template) {
+            // avoid RCEs when sandbox is enabled
+            if (!$template instanceof Twig_Template) {
+                throw new \LogicException('A block must be a method on a Twig_Template instance.');
+            }
+
             try {
                 $template->$block($context, $blocks);
             } catch (Twig_Error $e) {
                 if (!$e->getTemplateFile()) {
                     $e->setTemplateFile($template->getTemplateName());
diff --git a/test/Twig/Tests/TemplateTest.php b/test/Twig/Tests/TemplateTest.php
index 71724859..172eabff 100644
--- a/test/Twig/Tests/TemplateTest.php
+++ b/test/Twig/Tests/TemplateTest.php
@@ -8,10 +8,19 @@
  * For the full copyright and license information, please view the LICENSE
  * file that was distributed with this source code.
  */
 class Twig_Tests_TemplateTest extends PHPUnit_Framework_TestCase
 {
+    /**
+     * @expectedException LogicException
+     */
+    public function testDisplayBlocksAcceptTemplateOnlyAsBlocks()
+    {
+        $template = $this->getMockForAbstractClass('Twig_Template', array(), '', false);
+        $template->displayBlock('foo', array(), array('foo' => array(new stdClass(), 'foo')));
+    }
+
     /**
      * @dataProvider getAttributeExceptions
      */
     public function testGetAttributeExceptions($template, $message, $useExt)
     {

Fixed code:             // avoid RCEs when sandbox is enabled
            if (!$template instanceof Twig_Template) {
                throw new \LogicException('A block must be a method on a Twig_Template instance.');
            }

    /**
     * @expectedException LogicException
     */
    public function testDisplayBlocksAcceptTemplateOnlyAsBlocks()
    {
        $template = $this->getMockForAbstractClass('Twig_Template', array(), '', false);
        $template->displayBlock('foo', array(), array('foo' => array(new stdClass(), 'foo')));
    }
CVE-2021-32419: Out-of-bounds Write (CWE-787)
value: An issue in Schism Tracker v20200412 fixed in v.20200412 allows attacker to obtain sensitive information via the fmt_mtm_load_song function in fmt/mtm.c.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.3
Published: 2023-02-17T18:15Z
Repository: https://github.com/schismtracker/schismtracker
Language: C
Files changed: fmt/mtm.c
Commit date: 2021-04-06 17:54:56 -0400
Commit message: Remove unused out-of-bounds memory access from MTM loader (#249)

Diff: diff --git a/fmt/mtm.c b/fmt/mtm.c
index 3a4e200f..77fade02 100644
--- a/fmt/mtm.c
+++ b/fmt/mtm.c
@@ -205,11 +205,10 @@ int fmt_mtm_load_song(song_t *song, slurp_t *fp, unsigned int lflags)
 			continue;
 		}
 
 		song->patterns[pat] = csf_allocate_pattern(MAX(rows, 32));
 		song->pattern_size[pat] = song->pattern_alloc_size[pat] = 64;
-		tracknote = trackdata[n];
 		for (chan = 0; chan < 32; chan++) {
 			slurp_read(fp, &tmp, 2);
 			tmp = bswapLE16(tmp);
 			if (tmp == 0) {
 				continue;

Vulnerable code: 		tracknote = trackdata[n];