Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2024-34075: Insufficient Information (NVD-CWE-noinfo)
value: kurwov is a fast, dependency-free library for creating Markov Chains. An unsafe sanitization of dataset contents on the `MarkovData#getNext` method used in `Markov#generate` and `Markov#choose` allows a maliciously crafted string on the dataset to throw and stop the function from running properly. If a string contains a forbidden substring (i.e. `__proto__`) followed by a space character, the code will access a special property in `MarkovData#finalData` by removing the last character of the string, bypassing the dataset sanitization (as it is supposed to be already sanitized before this function is called). Any dataset can be contaminated with the substring making it unable to properly generate anything in some cases. This issue has been addressed in version 3.2.5 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-03T18:15Z
Repository: https://github.com/xiboon/kurwov
Language: Unknown
Commit date: 2024-05-03 19:30:55 +0200
Commit message: Merge pull request from GHSA-hfrv-h3q8-9jpr

fix denial of service vulnerability
CVE-2022-0768: Server-Side Request Forgery (SSRF) (CWE-918)
value: Server-Side Request Forgery (SSRF) in GitHub repository rudloff/alltube prior to 3.0.2.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 9.1
Published: 2022-02-28T10:15Z
Repository: https://github.com/rudloff/alltube
Language: Unknown
Commit date: 2022-02-27 12:32:36 +0100
Commit message: Merge branch 'hotfix/3.0.2'
CVE-2021-40540: Insufficient Information (NVD-CWE-noinfo)
value: ulfius_uri_logger in Ulfius HTTP Framework before 2.7.4 omits con_info initialization and a con_info->request NULL check for certain malformed HTTP requests.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2021-09-07T02:15Z
Repository: https://github.com/babelouest/ulfius
Language: C
Files changed: src/ulfius.c
Commit date: 2021-09-06 16:30:07 -0400
Commit message: Fix bug when malformed HTTP requests are sent, thanks Jeremy Brown!

Diff: diff --git a/src/ulfius.c b/src/ulfius.c
index 0df284c..0d7da36 100644
--- a/src/ulfius.c
+++ b/src/ulfius.c
@@ -205,21 +205,23 @@ static int ulfius_validate_instance(const struct _u_instance * u_instance) {
 void * ulfius_uri_logger (void * cls, const char * uri) {
   struct connection_info_struct * con_info = o_malloc (sizeof (struct connection_info_struct));
   UNUSED(cls);
 
   if (con_info != NULL) {
+    memset(con_info, 0, sizeof(struct connection_info_struct));
     con_info->callback_first_iteration = 1;
     con_info->u_instance = NULL;
     u_map_init(&con_info->map_url_initial);
     con_info->request = o_malloc(sizeof(struct _u_request));
     if (con_info->request == NULL) {
       y_log_message(Y_LOG_LEVEL_ERROR, "Ulfius - Error allocating memory for con_info->request");
       o_free(con_info);
       return NULL;
     }
 
-    if (NULL == con_info->request || ulfius_init_request(con_info->request) != U_OK) {
+    if (ulfius_init_request(con_info->request) != U_OK) {
+      y_log_message(Y_LOG_LEVEL_ERROR, "Ulfius - Error initializing con_info->request");
       ulfius_clean_request_full(con_info->request);
       o_free(con_info);
       return NULL;
     }
     con_info->request->http_url = o_strdup(uri);
@@ -431,11 +433,10 @@ static int ulfius_webservice_dispatcher (void * cls,
                                          const char * version,
                                          const char * upload_data,
                                          size_t * upload_data_size,
                                          void ** con_cls) {
 #endif
-
   struct _u_endpoint * endpoint_list = ((struct _u_instance *)cls)->endpoint_list, ** current_endpoint_list = NULL, * current_endpoint = NULL;
   struct connection_info_struct * con_info = * con_cls;
   int mhd_ret = MHD_NO, callback_ret = U_OK, i, close_loop = 0, inner_error = U_OK, mhd_response_flag;
 #ifndef U_DISABLE_WEBSOCKET
   // Websocket variables

Vulnerable code:     if (NULL == con_info->request || ulfius_init_request(con_info->request) != U_OK) {

Fixed code:     memset(con_info, 0, sizeof(struct connection_info_struct));
    if (ulfius_init_request(con_info->request) != U_OK) {
      y_log_message(Y_LOG_LEVEL_ERROR, "Ulfius - Error initializing con_info->request");
CVE-2014-3544: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-07-29T11:10Z
Repository: https://github.com/moodle/moodle
Language: PHP
Files changed: user/profile.php
Commit date: 2014-07-07 16:05:06 +0100
Commit message: MDL-45683 user: Escaping Skype ID used in profile

Diff: diff --git a/user/profile.php b/user/profile.php
index 3ac9b7a243..291fc131f6 100644
--- a/user/profile.php
+++ b/user/profile.php
@@ -332,11 +332,11 @@ if ($user->icq && !isset($hiddenfields['icqnumber'])) {
     echo html_writer::tag('dd', html_writer::link($imurl, s($user->icq) . $statusicon));
 }
 
 if ($user->skype && !isset($hiddenfields['skypeid'])) {
     $imurl = 'skype:'.urlencode($user->skype).'?call';
-    $iconurl = new moodle_url('http://mystatus.skype.com/smallicon/'.$user->skype);
+    $iconurl = new moodle_url('http://mystatus.skype.com/smallicon/'.urlencode($user->skype));
     if (strpos($CFG->httpswwwroot, 'https:') === 0) {
         // Bad luck, skype devs are lazy to set up SSL on their servers - see MDL-37233.
         $statusicon = '';
     } else {
         $statusicon = html_writer::empty_tag('img',

Vulnerable code:     $iconurl = new moodle_url('http://mystatus.skype.com/smallicon/'.$user->skype);
Fixed code:     $iconurl = new moodle_url('http://mystatus.skype.com/smallicon/'.urlencode($user->skype));
CVE-2024-38522: Insufficient Information (NVD-CWE-noinfo)
value: Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The CSP policy applied on the `tips.hushline.app` website and bundled by default in this repository is trivial to bypass. This vulnerability has been patched in version 0.1.0.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-28T17:15Z
Repository: https://github.com/scidsg/hushline
Language: Markdown
Files changed: SECURITY.md
Commit date: 2024-06-20 11:17:20 -0700
Commit message: Remove unpkg.com from the CSP header

Diff: diff --git a/SECURITY.md b/SECURITY.md
index f3c4343..a1ec499 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -44,11 +44,11 @@ Hush Line implements a series of HTTP security headers to protect our users and
 ## Content-Security-Policy (CSP)
 
 The Content-Security-Policy (CSP) header is a powerful tool used by web applications to mitigate the risk of Cross-Site Scripting (XSS) attacks and other types of code injection attacks. By specifying which content sources are trustworthy, CSP prevents the browser from loading malicious assets. Here's a breakdown of the CSP directive used:
 
 - `default-src 'self';` Only allow content from the site's own origin. This is the default policy for loading resources such as JavaScript, images, CSS, fonts, AJAX requests, frames, HTML5 media, and other data.
-- `script-src 'self' https://js.stripe.com https://unpkg.com;` Allow scripts to be loaded from the site's own origin, Stripe (for payment processing), and unpkg (a content delivery network for npm packages).
+- `script-src 'self' https://js.stripe.com;` Allow scripts to be loaded from the site's own origin and Stripe (for payment processing).
 - `img-src 'self' data: https:;` Allow images from the site's origin, inline images using data URIs, and images loaded over HTTPS from any origin.
 - `style-src 'self';` Only allow stylesheets from the site's own origin.
 - `frame-ancestors 'none';` Prevent the site from being framed (embedded within an <iframe>) by other sites, mitigating Clickjacking attacks.
 - `connect-src 'self' https://api.stripe.com;` Restrict the origins to which you can connect (via XHR, WebSockets, and EventSource).
 - `child-src https://js.stripe.com;` Define valid sources for web workers and nested browsing contexts loaded using elements such as <frame> and <iframe>.

Vulnerable code: - `script-src 'self' https://js.stripe.com https://unpkg.com;` Allow scripts to be loaded from the site's own origin, Stripe (for payment processing), and unpkg (a content delivery network for npm packages).
Fixed code: - `script-src 'self' https://js.stripe.com;` Allow scripts to be loaded from the site's own origin and Stripe (for payment processing).
CVE-2019-19960: Other (NVD-CWE-Other)
value: In wolfSSL before 4.3.0, wc_ecc_mulmod_ex does not properly resist side-channel attacks.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 5.3
Published: 2019-12-25T00:15Z
Repository: https://github.com/wolfSSL/wolfssl
Language: Unknown
Commit date: 2019-12-17 15:16:16 -0800
Commit message: Merge pull request #2637 from SparkiDev/ecc_cache_resist

Improve wc_ecc_mulmod_ex cache attack resistance
CVE-2019-19963: Other (NVD-CWE-Other)
value: An issue was discovered in wolfSSL before 4.3.0 in a non-default configuration where DSA is enabled. DSA signing uses the BEEA algorithm during modular inversion of the nonce, leading to a side-channel attack against the nonce.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 5.3
Published: 2019-12-25T00:15Z
Repository: https://github.com/wolfSSL/wolfssl
Language: Unknown
Commit date: 2019-12-05 16:20:21 -0800
Commit message: Merge pull request #2629 from SparkiDev/dsa_blinding

Blinding for DSA sign
CVE-2020-36177: Out-of-bounds Write (CWE-787)
value: RsaPad_PSS in wolfcrypt/src/rsa.c in wolfSSL before 4.6.0 has an out-of-bounds write for certain relationships between key size and digest size.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2021-01-06T16:15Z
Repository: https://github.com/wolfSSL/wolfssl
Language: Unknown
Commit date: 2020-11-03 14:43:56 -0800
Commit message: Merge pull request #3426 from SparkiDev/rsa_pss_fix

RSA-PSS: Handle edge case with encoding message to hash
CVE-2019-10664: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2019-03-31T14:29Z
Repository: https://github.com/domoticz/domoticz
Language: C++
Files changed: main/WebServer.cpp
Commit date: 2019-03-29 15:04:04 +0100
Commit message: Fixed possible SQL Injection Vulnerability (Thanks to Fabio Carretto!)

Diff: diff --git a/main/WebServer.cpp b/main/WebServer.cpp
index 6c538faf2..ece2155fd 100644
--- a/main/WebServer.cpp
+++ b/main/WebServer.cpp
@@ -10770,11 +10770,11 @@ namespace http {
 			std::string idx = request::findValue(&req, "idx");
 			if (idx == "") {
 				return;
 			}
 			std::vector<std::vector<std::string> > result;
-			result = m_sql.safe_queryBlob("SELECT Image FROM Floorplans WHERE ID=%s", idx.c_str());
+			result = m_sql.safe_queryBlob("SELECT Image FROM Floorplans WHERE ID=%d", atol(idx.c_str()));
 			if (result.empty())
 				return;
 			reply::set_content(&rep, result[0][0].begin(), result[0][0].end());
 			std::string oname = "floorplan";
 			if (result[0][0].size() > 10)

Vulnerable code: 			result = m_sql.safe_queryBlob("SELECT Image FROM Floorplans WHERE ID=%s", idx.c_str());
Fixed code: 			result = m_sql.safe_queryBlob("SELECT Image FROM Floorplans WHERE ID=%d", atol(idx.c_str()));
CVE-2019-10678: Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)
value: Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options.
CWE description: The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
CVSS v3 base score: 7.5
Published: 2019-03-31T21:29Z
Repository: https://github.com/domoticz/domoticz
Language: C++
Files changed: main/Helper.cpp
Commit date: 2019-03-29 15:23:06 +0100
Commit message: Do not allow enters/returns in arguments (thanks to Fabio Carretto)

Diff: diff --git a/main/Helper.cpp b/main/Helper.cpp
index dddc1e65d..3f120f628 100644
--- a/main/Helper.cpp
+++ b/main/Helper.cpp
@@ -1012,10 +1012,12 @@ const char *szInsecureArgumentOptions[] = {
 	";",
 	"&",
 	"$",
 	"<",
 	">",
+	"\n",
+	"\r",
 	NULL
 };
 
 bool IsArgumentSecure(const std::string &arg)
 {

Fixed code: 	"\n",
	"\r",
CVE-2014-3589: Improper Input Validation (CWE-20)
value: PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a denial of service via a crafted block size.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2014-08-25T14:55Z
Repository: https://github.com/python-pillow/Pillow
Language: Python
Files changed: PIL/IcnsImagePlugin.py, Tests/check_icns_dos.py
Commit date: 2014-08-13 09:25:11 -0700
Commit message: Icns DOS fix --  CVE-2014-3589

Found and reported by Andrew Drake of dropbox.com

Diff: diff --git a/PIL/IcnsImagePlugin.py b/PIL/IcnsImagePlugin.py
index 6951c93..ca7a149 100644
--- a/PIL/IcnsImagePlugin.py
+++ b/PIL/IcnsImagePlugin.py
@@ -177,10 +177,12 @@ class IcnsFile:
         if sig != b'icns':
             raise SyntaxError('not an icns file')
         i = HEADERSIZE
         while i < filesize:
             sig, blocksize = nextheader(fobj)
+            if blocksize <= 0:
+                raise SyntaxError('invalid block header')
             i += HEADERSIZE
             blocksize -= HEADERSIZE
             dct[sig] = (i, blocksize)
             fobj.seek(blocksize, 1)
             i += blocksize
diff --git a/Tests/check_icns_dos.py b/Tests/check_icns_dos.py
new file mode 100644
index 0000000..ce6338a
--- /dev/null
+++ b/Tests/check_icns_dos.py
@@ -0,0 +1,10 @@
+# Tests potential DOS of IcnsImagePlugin with 0 length block.
+# Run from anywhere that PIL is importable. 
+
+from PIL import Image
+from io import BytesIO
+
+if bytes is str:
+    Image.open(BytesIO(bytes('icns\x00\x00\x00\x10hang\x00\x00\x00\x00')))
+else:
+    Image.open(BytesIO(bytes('icns\x00\x00\x00\x10hang\x00\x00\x00\x00', 'latin-1')))

Fixed code:             if blocksize <= 0:
                raise SyntaxError('invalid block header')
# Tests potential DOS of IcnsImagePlugin with 0 length block.
# Run from anywhere that PIL is importable. 

from PIL import Image
from io import BytesIO

if bytes is str:
    Image.open(BytesIO(bytes('icns\x00\x00\x00\x10hang\x00\x00\x00\x00')))
else:
    Image.open(BytesIO(bytes('icns\x00\x00\x00\x10hang\x00\x00\x00\x00', 'latin-1')))
CVE-2016-0775: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 6.5
Published: 2016-04-13T16:59Z
Repository: https://github.com/python-pillow/Pillow
Language: C
Files changed: Tests/check_fli_overflow.py, libImaging/FliDecode.c
Commit date: 2016-02-04 08:13:02 -0800
Commit message: FLI overflow error fix and testcase CVE-2016-0775

Diff: diff --git a/Tests/check_fli_overflow.py b/Tests/check_fli_overflow.py
new file mode 100644
index 00000000..d89a8276
--- /dev/null
+++ b/Tests/check_fli_overflow.py
@@ -0,0 +1,16 @@
+from helper import unittest, PillowTestCase
+from PIL import Image
+
+TEST_FILE = "Tests/images/fli_overflow.fli"
+
+
+class TestFliOverflow(PillowTestCase):
+    def test_fli_overflow(self):
+
+        # this should not crash with a malloc error or access violation
+        im = Image.open(TEST_FILE)
+        im.load()
+        
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/Tests/images/fli_overflow.fli b/Tests/images/fli_overflow.fli
new file mode 100644
index 00000000..bea12160
Binary files /dev/null and b/Tests/images/fli_overflow.fli differ
diff --git a/libImaging/FliDecode.c b/libImaging/FliDecode.c
index 75eebe86..6d22c6c4 100644
--- a/libImaging/FliDecode.c
+++ b/libImaging/FliDecode.c
@@ -183,11 +183,11 @@ ImagingFliDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes)
 	    break;
 	case 16:
 	    /* COPY chunk */
 	    for (y = 0; y < state->ysize; y++) {
 		UINT8* buf = (UINT8*) im->image[y];
-		memcpy(buf+x, data, state->xsize);
+		memcpy(buf, data, state->xsize);
 		data += state->xsize;
 	    }
 	    break;
 	case 18:
 	    /* PSTAMP chunk */

Vulnerable code: 		memcpy(buf+x, data, state->xsize);
Fixed code: from helper import unittest, PillowTestCase
from PIL import Image

TEST_FILE = "Tests/images/fli_overflow.fli"


class TestFliOverflow(PillowTestCase):
    def test_fli_overflow(self):

        # this should not crash with a malloc error or access violation
        im = Image.open(TEST_FILE)
        im.load()
        

if __name__ == '__main__':
    unittest.main()
		memcpy(buf, data, state->xsize);
CVE-2016-4009: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which triggers a heap-based buffer overflow.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2016-04-13T16:59Z
Repository: https://github.com/python-pillow/Pillow
Language: C
Files changed: libImaging/Resample.c
Commit date: 2016-02-04 07:19:54 -0800
Commit message: fix integer overflow in Resample.c

Diff: diff --git a/libImaging/Resample.c b/libImaging/Resample.c
index 103e07e4..0d401c1d 100644
--- a/libImaging/Resample.c
+++ b/libImaging/Resample.c
@@ -136,15 +136,27 @@ ImagingResampleHorizontal(Imaging imIn, int xsize, int filter)
     support = support * filterscale;
 
     /* maximum number of coofs */
     kmax = (int) ceil(support) * 2 + 1;
 
+    // check for overflow
+    if (kmax > 0 && xsize > SIZE_MAX / kmax)
+        return (Imaging) ImagingError_MemoryError();
+
+    // sizeof(float) should be greater than 0
+    if (xsize * kmax > SIZE_MAX / sizeof(float))
+        return (Imaging) ImagingError_MemoryError();
+
     /* coefficient buffer */
     kk = malloc(xsize * kmax * sizeof(float));
     if ( ! kk)
         return (Imaging) ImagingError_MemoryError();
 
+    // sizeof(int) should be greater than 0 as well
+    if (xsize > SIZE_MAX / (2 * sizeof(int)))
+        return (Imaging) ImagingError_MemoryError();
+
     xbounds = malloc(xsize * 2 * sizeof(int));
     if ( ! xbounds) {
         free(kk);
         return (Imaging) ImagingError_MemoryError();
     }

Fixed code:     // check for overflow
    if (kmax > 0 && xsize > SIZE_MAX / kmax)
        return (Imaging) ImagingError_MemoryError();

    // sizeof(float) should be greater than 0
    if (xsize * kmax > SIZE_MAX / sizeof(float))
        return (Imaging) ImagingError_MemoryError();

    // sizeof(int) should be greater than 0 as well
    if (xsize > SIZE_MAX / (2 * sizeof(int)))
        return (Imaging) ImagingError_MemoryError();
CVE-2020-10378: Out-of-bounds Read (CWE-125)
value: In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2020-06-25T19:15Z
Repository: https://github.com/python-pillow/Pillow
Language: C
Files changed: src/libImaging/PcxDecode.c
Commit date: 2020-04-01 10:50:51 +0300
Commit message: Fix OOB Access on PcxDecode.c

Diff: diff --git a/src/libImaging/PcxDecode.c b/src/libImaging/PcxDecode.c
index 9e9504ce5..e5a38f4be 100644
--- a/src/libImaging/PcxDecode.c
+++ b/src/libImaging/PcxDecode.c
@@ -20,14 +20,11 @@ int
 ImagingPcxDecode(Imaging im, ImagingCodecState state, UINT8* buf, Py_ssize_t bytes)
 {
     UINT8 n;
     UINT8* ptr;
 
-    if (strcmp(im->mode, "1") == 0 && state->xsize > state->bytes * 8) {
-        state->errcode = IMAGING_CODEC_OVERRUN;
-        return -1;
-    } else if (strcmp(im->mode, "P") == 0 && state->xsize > state->bytes) {
+    if ((state->xsize * state->bits + 7) / 8 > state->bytes) {
         state->errcode = IMAGING_CODEC_OVERRUN;
         return -1;
     }
 
     ptr = buf;

Vulnerable code:     if (strcmp(im->mode, "1") == 0 && state->xsize > state->bytes * 8) {
        state->errcode = IMAGING_CODEC_OVERRUN;
        return -1;
    } else if (strcmp(im->mode, "P") == 0 && state->xsize > state->bytes) {
Fixed code:     if ((state->xsize * state->bits + 7) / 8 > state->bytes) {
CVE-2020-10379: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 7.8
Published: 2020-06-25T19:15Z
Repository: https://github.com/python-pillow/Pillow
Language: Unknown
Commit date: 2020-04-01 12:51:04 +0300
Commit message: Merge pull request #4507 from hugovk/fix_tiff

Fix 2 buffer overflows in TIFF decoding
CVE-2022-45198: Other (NVD-CWE-Other)
value: Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 7.5
Published: 2022-11-14T07:15Z
Repository: https://github.com/python-pillow/Pillow
Language: Unknown
Commit date: 2022-06-30 10:23:13 +0000
Commit message: Merge pull request #6403 from radarhere/gif_decompression_bomb

Added release notes for #6402
CVE-2022-45199: Uncontrolled Resource Consumption (CWE-400)
value: Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 7.5
Published: 2022-11-14T07:15Z
Repository: https://github.com/python-pillow/Pillow
Language: Unknown
Commit date: 2022-10-29 13:16:49 +0300
Commit message: Merge pull request #6700 from hugovk/security-samples_per_pixel-sec
CVE-2023-43669: Insufficient Information (NVD-CWE-noinfo)
value: The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service (minutes of CPU consumption) via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted (e.g., thousands of times) and the average amount of data for each parse attempt (e.g., millions of bytes).
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2023-09-21T06:15Z
Repository: https://github.com/snapview/tungstenite-rs
Language: Markdown
Files changed: CHANGELOG.md
Commit date: 2023-09-23 14:10:53 +0200
Commit message: Update changelog

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 90f612e..37a94d0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
+# 0.20.1
+
+- Fixes [CVE-2023-43669](https://github.com/snapview/tungstenite-rs/pull/379).
+
 # 0.20.0
 - Remove many implicit flushing behaviours. In general reading and writing messages will no 
   longer flush until calling `flush`. An exception is automatic responses (e.g. pongs) 
   which will continue to be written and flushed when reading and writing.
   This allows writing a batch of messages and flushing once, improving performance.

Fixed code: # 0.20.1

- Fixes [CVE-2023-43669](https://github.com/snapview/tungstenite-rs/pull/379).
CVE-2022-4524: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, was found in Roots soil Plugin up to 4.0.x. Affected is the function language_attributes of the file src/Modules/CleanUpModule.php. The manipulation of the argument language leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 4.1.0 is able to address this issue. The name of the patch is 0c9151e00ab047da253e5cdbfccb204dd423269d. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215904.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-15T21:15Z
Repository: https://github.com/roots/soil
Language: PHP
Files changed: src/Modules/CleanUpModule.php
Commit date: 2022-07-31 14:38:30 -0500
Commit message: 🔒️ XSS fix on `language_attributes` (#285)


Diff: diff --git a/src/Modules/CleanUpModule.php b/src/Modules/CleanUpModule.php
index 91e6482..6b18021 100644
--- a/src/Modules/CleanUpModule.php
+++ b/src/Modules/CleanUpModule.php
@@ -247,11 +247,11 @@ class CleanUpModule extends AbstractModule
 
         if (is_rtl()) {
             $attributes[] = 'dir="rtl"';
         }
 
-        $lang = get_bloginfo('language');
+        $lang = esc_attr(get_bloginfo('language'));
 
         if ($lang) {
             $attributes[] = "lang=\"{$lang}\"";
         }
 

Vulnerable code:         $lang = get_bloginfo('language');
Fixed code:         $lang = esc_attr(get_bloginfo('language'));
CVE-2021-45010: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to upload malicious PHP files to the webroot, leading to code execution.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 8.8
Published: 2022-03-15T12:15Z
Repository: https://github.com/prasathmani/tinyfilemanager
Language: PHP
Files changed: tinyfilemanager.php
Commit date: 2021-11-12 08:31:02 +0530
Commit message: Patched the RCE (#636)

I have patched the file upload directory traversal to Authenticated Remote Code Execution Vulnerability.
Diff: diff --git a/tinyfilemanager.php b/tinyfilemanager.php
index 714524c..3d7052a 100644
--- a/tinyfilemanager.php
+++ b/tinyfilemanager.php
@@ -878,11 +878,11 @@ if (!empty($_FILES) && !FM_READONLY) {
         echo json_encode($response); exit();
     }
 
     $targetPath = $path . $ds;
     if ( is_writable($targetPath) ) {
-        $fullPath = $path . '/' . $_REQUEST['fullpath'];
+        $fullPath = $path . '/' . str_replace("./","_",$_REQUEST['fullpath']);
         $folder = substr($fullPath, 0, strrpos($fullPath, "/"));
 
         if(file_exists ($fullPath) && !$override_file_name) {
             $ext_1 = $ext ? '.'.$ext : '';
             $fullPath = str_replace($ext_1, '', $fullPath) .'_'. date('ymdHis'). $ext_1;

Vulnerable code:         $fullPath = $path . '/' . $_REQUEST['fullpath'];
Fixed code:         $fullPath = $path . '/' . str_replace("./","_",$_REQUEST['fullpath']);
CVE-2022-1000: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Path Traversal in GitHub repository prasathmani/tinyfilemanager prior to 2.4.7.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.8
Published: 2022-03-17T11:15Z
Repository: https://github.com/prasathmani/tinyfilemanager
Language: PHP
Files changed: tinyfilemanager.php
Commit date: 2022-02-12 10:34:05 +0530
Commit message: apply fix to path traversal vulnerability (#718)

Co-authored-by: João Maurício <joao.goncalves.mauricio@pwc.com>
Diff: diff --git a/tinyfilemanager.php b/tinyfilemanager.php
index 4ceb10c..6cca6c1 100644
--- a/tinyfilemanager.php
+++ b/tinyfilemanager.php
@@ -865,11 +865,11 @@ if (!empty($_FILES) && !FM_READONLY) {
         'info'   => 'Oops! Try again'
     );
 
     $filename = $f['file']['name'];
     $tmp_name = $f['file']['tmp_name'];
-    $ext = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
+    $ext = pathinfo($filename, PATHINFO_FILENAME) != '' ? strtolower(pathinfo($filename, PATHINFO_EXTENSION)) : '';
     $isFileAllowed = ($allowed) ? in_array($ext, $allowed) : true;
 
     if(!fm_isvalid_filename($filename) && !fm_isvalid_filename($_REQUEST['fullpath'])) {
         $response = array (
             'status'    => 'error',
@@ -878,16 +878,16 @@ if (!empty($_FILES) && !FM_READONLY) {
         echo json_encode($response); exit();
     }
 
     $targetPath = $path . $ds;
     if ( is_writable($targetPath) ) {
-        $fullPath = $path . '/' . str_replace("./","_",$_REQUEST['fullpath']);
+        $fullPath = $path . '/' . basename($_REQUEST['fullpath']);
         $folder = substr($fullPath, 0, strrpos($fullPath, "/"));
 
         if(file_exists ($fullPath) && !$override_file_name) {
             $ext_1 = $ext ? '.'.$ext : '';
-            $fullPath = str_replace($ext_1, '', $fullPath) .'_'. date('ymdHis'). $ext_1;
+            $fullPath = $path . '/' . basename($_REQUEST['fullpath'], $ext_1) .'_'. date('ymdHis'). $ext_1;
         }
 
         if (!is_dir($folder)) {
             $old = umask(0);
             mkdir($folder, 0777, true);

Vulnerable code:     $ext = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
        $fullPath = $path . '/' . str_replace("./","_",$_REQUEST['fullpath']);
            $fullPath = str_replace($ext_1, '', $fullPath) .'_'. date('ymdHis'). $ext_1;
Fixed code:     $ext = pathinfo($filename, PATHINFO_FILENAME) != '' ? strtolower(pathinfo($filename, PATHINFO_EXTENSION)) : '';
        $fullPath = $path . '/' . basename($_REQUEST['fullpath']);
            $fullPath = $path . '/' . basename($_REQUEST['fullpath'], $ext_1) .'_'. date('ymdHis'). $ext_1;
CVE-2023-51664: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the `tj-actions/changed-files` workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. This issue may lead to arbitrary command execution in the GitHub Runner. This vulnerability has been addressed in version 41.0.0. Users are advised to upgrade.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2023-12-27T17:15Z
Repository: https://github.com/tj-actions/changed-files
Language: TypeScript
Files changed: src/utils.ts
Commit date: 2023-12-24 16:32:32 +0000
Commit message: fix: update characters escaped by safe output (#1815)


Diff: diff --git a/dist/index.js b/dist/index.js
index 09f612b4..384d5203 100644
Binary files a/dist/index.js and b/dist/index.js differ
diff --git a/dist/index.js.map b/dist/index.js.map
index 313dd399..090c692e 100644
Binary files a/dist/index.js.map and b/dist/index.js.map differ
diff --git a/src/utils.ts b/src/utils.ts
index 7da47790..023ba300 100644
--- a/src/utils.ts
+++ b/src/utils.ts
@@ -1353,14 +1353,11 @@ export const setOutput = async ({
     cleanedValue = value.toString().trim()
   }
 
   // if safeOutput is true, escape special characters for bash shell
   if (safeOutput) {
-    cleanedValue = cleanedValue.replace(
-      /[^\x20-\x7E]|[:*?"<>|;`$()&!]/g,
-      '\\$&'
-    )
+    cleanedValue = cleanedValue.replace(/[^\x20-\x7E]|[:*?<>|;`$()&!]/g, '\\$&')
   }
 
   core.setOutput(key, cleanedValue)
 
   if (writeOutputFiles) {

Vulnerable code:     cleanedValue = cleanedValue.replace(
      /[^\x20-\x7E]|[:*?"<>|;`$()&!]/g,
      '\\$&'
    )
Fixed code:     cleanedValue = cleanedValue.replace(/[^\x20-\x7E]|[:*?<>|;`$()&!]/g, '\\$&')
CVE-2023-51664: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the `tj-actions/changed-files` workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. This issue may lead to arbitrary command execution in the GitHub Runner. This vulnerability has been addressed in version 41.0.0. Users are advised to upgrade.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2023-12-27T17:15Z
Repository: https://github.com/tj-actions/changed-files
Language: TypeScript
Files changed: README.md, src/utils.ts
Commit date: 2023-12-23 03:56:31 -0700
Commit message: fix: update safe output regex and the docs (#1805)

Co-authored-by: jackton1 <jackton1@users.noreply.github.com>
Co-authored-by: GitHub Action <action@github.com>
Co-authored-by: Tonye Jack <jtonye@ymail.com>
Diff: diff --git a/README.md b/README.md
index 431aefb0..64e85de6 100644
--- a/README.md
+++ b/README.md
@@ -570,10 +570,16 @@ Support this project with a :star:
     # Separator used to split the `recover_files` input
     # Type: string
     # Default: "\n"
     recover_files_separator: ''
 
+    # Apply sanitization to output filenames before being set as 
+    # output. 
+    # Type: boolean
+    # Default: "true"
+    safe_output: ''
+
     # Split character for output strings.
     # Type: string
     # Default: " "
     separator: ''
 
diff --git a/dist/index.js b/dist/index.js
index 6903619a..09f612b4 100644
Binary files a/dist/index.js and b/dist/index.js differ
diff --git a/dist/index.js.map b/dist/index.js.map
index 327f792c..313dd399 100644
Binary files a/dist/index.js.map and b/dist/index.js.map differ
diff --git a/src/utils.ts b/src/utils.ts
index 46e9b4f8..7da47790 100644
--- a/src/utils.ts
+++ b/src/utils.ts
@@ -1353,11 +1353,14 @@ export const setOutput = async ({
     cleanedValue = value.toString().trim()
   }
 
   // if safeOutput is true, escape special characters for bash shell
   if (safeOutput) {
-    cleanedValue = cleanedValue.replace(/[$()`|&;]/g, '\\$&')
+    cleanedValue = cleanedValue.replace(
+      /[^\x20-\x7E]|[:*?"<>|;`$()&!]/g,
+      '\\$&'
+    )
   }
 
   core.setOutput(key, cleanedValue)
 
   if (writeOutputFiles) {

Vulnerable code:     cleanedValue = cleanedValue.replace(/[$()`|&;]/g, '\\$&')
Fixed code:     # Apply sanitization to output filenames before being set as 
    # output. 
    # Type: boolean
    # Default: "true"
    safe_output: ''

    cleanedValue = cleanedValue.replace(
      /[^\x20-\x7E]|[:*?"<>|;`$()&!]/g,
      '\\$&'
    )
CVE-2021-44833: Incorrect Default Permissions (CWE-276)
value: The CLI 1.0.0 for Amazon AWS OpenSearch has weak permissions for the configuration file.
CWE description: During installation, installed file permissions are set to allow anyone to modify those files.
CVSS v3 base score: 9.8
Published: 2021-12-12T06:15Z
Repository: https://github.com/opensearch-project/opensearch-cli
Language: Go
Files changed: commands/root.go
Commit date: 2021-10-28 11:48:43 -0700
Commit message: Update default folder and file permission

Update folder path to 700 and file path to 600.

Signed-off-by: Vijayan Balasubramanian <balasvij@amazon.com>

Diff: diff --git a/commands/root.go b/commands/root.go
index 8a7a295..f8167e5 100644
--- a/commands/root.go
+++ b/commands/root.go
@@ -38,11 +38,12 @@ import (
 const (
 	configFileType        = "yaml"
 	defaultConfigFileName = "config"
 	flagConfig            = "config"
 	flagProfileName       = "profile"
-	folderPermission      = 0755 // only owner can write, while everyone can read and execute
+	FolderPermission      = 0700 // only owner can read, write and execute
+	FilePermission        = 0600 // only owner can read and write
 	ConfigEnvVarName      = "OPENSEARCH_CLI_CONFIG"
 	RootCommandName       = "opensearch-cli"
 	version               = "1.0.0"
 )
 
@@ -116,19 +117,22 @@ func createDefaultConfigFileIfNotExists() error {
 	if isExists(defaultFilePath) {
 		return nil
 	}
 	folderPath := filepath.Dir(defaultFilePath)
 	if !isExists(folderPath) {
-		err := os.Mkdir(folderPath, folderPermission)
+		err := os.Mkdir(folderPath, FolderPermission)
 		if err != nil {
 			return err
 		}
 	}
 	f, err := os.Create(defaultFilePath)
 	if err != nil {
 		return err
 	}
+	if err = f.Chmod(FilePermission); err != nil {
+		return err
+	}
 	return f.Close()
 }
 
 //isExists check if given path exists or not
 //if path is just a name, it will check in current directory

Vulnerable code: 	folderPermission      = 0755 // only owner can write, while everyone can read and execute
		err := os.Mkdir(folderPath, folderPermission)
Fixed code: 	FolderPermission      = 0700 // only owner can read, write and execute
	FilePermission        = 0600 // only owner can read and write
		err := os.Mkdir(folderPath, FolderPermission)
	if err = f.Chmod(FilePermission); err != nil {
		return err
	}
CVE-2023-45286: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CWE-362)
value: A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn't had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request. The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.
CWE description: The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
CVSS v3 base score: 5.9
Published: 2023-11-28T17:15Z
Repository: https://github.com/go-resty/resty
Language: Go
Files changed: middleware.go
Commit date: 2023-12-27 11:07:45 +0530
Commit message: Don't put the same bytes.Buffer into sync.Pool twice (#745)


Diff: diff --git a/middleware.go b/middleware.go
index a43a41b..ac2bbc9 100644
--- a/middleware.go
+++ b/middleware.go
@@ -479,11 +479,10 @@ func handleContentType(c *Client, r *Request) {
 	}
 }
 
 func handleRequestBody(c *Client, r *Request) error {
 	var bodyBytes []byte
-	releaseBuffer(r.bodyBuf)
 	r.bodyBuf = nil
 
 	switch body := r.Body.(type) {
 	case io.Reader:
 		if c.setContentLength || r.setContentLength { // keep backward compatibility

Vulnerable code: 	releaseBuffer(r.bodyBuf)
CVE-2024-27301: Insufficient Information (NVD-CWE-noinfo)
value: Support App is an opensource application specialized in managing Apple devices. It's possible to abuse a vulnerability inside the postinstall installer script to make the installer execute arbitrary code as root. The cause of the vulnerability is the fact that the shebang `#!/bin/zsh` is being used. When the installer is executed it asks for the users password to be executed as root. However, it'll still be using the $HOME of the user and therefore loading the file  `$HOME/.zshenv` when the `postinstall` script is executed.
An attacker could add malicious code to `$HOME/.zshenv` and it will be executed when the app is installed. An attacker may leverage this vulnerability to escalate privilege on the system. This issue has been addressed in version 2.5.1 Rev 2. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-14T19:15Z
Repository: https://github.com/root3nl/SupportApp
Language: Unknown
Commit date: 2024-03-14 11:15:13 +0100
Commit message: Merge pull request from GHSA-jr78-247f-rhqc

Add -no-rcs to zsh shebang
CVE-2014-9140: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Buffer overflow in the ppp_hdlc function in print-ppp.c in tcpdump 4.6.2 and earlier allows remote attackers to cause a denial of service (crash) cia a crafted PPP packet.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2014-12-05T16:59Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: C
Files changed: print-ppp.c
Commit date: 2014-10-22 12:31:21 -0700
Commit message: Do bounds checking when unescaping PPP.

Clean up a const issue while we're at it.

Diff: diff --git a/print-ppp.c b/print-ppp.c
index 8e098f05..9a983e61 100644
--- a/print-ppp.c
+++ b/print-ppp.c
@@ -1349,34 +1349,34 @@ trunc:
 
 static void
 ppp_hdlc(netdissect_options *ndo,
          const u_char *p, int length)
 {
-	u_char *b, *s, *t, c;
+	u_char *b, *t, c;
+	const u_char *s;
 	int i, proto;
 	const void *se;
 
         if (length <= 0)
                 return;
 
-	b = (uint8_t *)malloc(length);
+	b = (u_char *)malloc(length);
 	if (b == NULL)
 		return;
 
 	/*
 	 * Unescape all the data into a temporary, private, buffer.
 	 * Do this so that we dont overwrite the original packet
 	 * contents.
 	 */
-	for (s = (u_char *)p, t = b, i = length; i > 0; i--) {
+	for (s = p, t = b, i = length; i > 0 && ND_TTEST(*s); i--) {
 		c = *s++;
 		if (c == 0x7d) {
-			if (i > 1) {
-				i--;
-				c = *s++ ^ 0x20;
-			} else
-				continue;
+			if (i <= 1 || !ND_TTEST(*s))
+				break;
+			i--;
+			c = *s++ ^ 0x20;
 		}
 		*t++ = c;
 	}
 
 	se = ndo->ndo_snapend;

Vulnerable code: 	u_char *b, *s, *t, c;
	b = (uint8_t *)malloc(length);
	for (s = (u_char *)p, t = b, i = length; i > 0; i--) {
			if (i > 1) {
				i--;
				c = *s++ ^ 0x20;
			} else
				continue;
Fixed code: 	u_char *b, *t, c;
	const u_char *s;
	b = (u_char *)malloc(length);
	for (s = p, t = b, i = length; i > 0 && ND_TTEST(*s); i--) {
			if (i <= 1 || !ND_TTEST(*s))
				break;
			i--;
			c = *s++ ^ 0x20;
CVE-2015-3138: Improper Input Validation (CWE-20)
value: print-wb.c in tcpdump before 4.7.4 allows remote attackers to cause a denial of service (segmentation fault and process crash).
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2017-09-28T01:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: C
Files changed: print-wb.c
Commit date: 2015-03-25 22:48:37 +0000
Commit message: whiteboard: fixup a few reversed tests (GH #446)

This is a follow-up to commit 3a3ec26.

Diff: diff --git a/print-wb.c b/print-wb.c
index 3e3b0645..4fa5e380 100644
--- a/print-wb.c
+++ b/print-wb.c
@@ -199,11 +199,11 @@ wb_id(netdissect_options *ndo,
 
 	nid = EXTRACT_16BITS(&id->pi_ps.nid);
 	len -= sizeof(*io) * nid;
 	io = (struct id_off *)(id + 1);
 	cp = (char *)(io + nid);
-	if (!ND_TTEST2(cp, len)) {
+	if (ND_TTEST2(cp, len)) {
 		ND_PRINT((ndo, "\""));
 		fn_print(ndo, (u_char *)cp, (u_char *)cp + len);
 		ND_PRINT((ndo, "\""));
 	}
 
@@ -264,20 +264,20 @@ wb_prep(netdissect_options *ndo,
 	if (len < sizeof(*prep)) {
 		return (-1);
 	}
 	n = EXTRACT_32BITS(&prep->pp_n);
 	ps = (const struct pgstate *)(prep + 1);
-	while (--n >= 0 && !ND_TTEST(*ps)) {
+	while (--n >= 0 && ND_TTEST(*ps)) {
 		const struct id_off *io, *ie;
 		char c = '<';
 
 		ND_PRINT((ndo, " %u/%s:%u",
 		    EXTRACT_32BITS(&ps->slot),
 		    ipaddr_string(ndo, &ps->page.p_sid),
 		    EXTRACT_32BITS(&ps->page.p_uid)));
 		io = (struct id_off *)(ps + 1);
-		for (ie = io + ps->nid; io < ie && !ND_TTEST(*io); ++io) {
+		for (ie = io + ps->nid; io < ie && ND_TTEST(*io); ++io) {
 			ND_PRINT((ndo, "%c%s:%u", c, ipaddr_string(ndo, &io->id),
 			    EXTRACT_32BITS(&io->off)));
 			c = ',';
 		}
 		ND_PRINT((ndo, ">"));

Vulnerable code: 	if (!ND_TTEST2(cp, len)) {
	while (--n >= 0 && !ND_TTEST(*ps)) {
		for (ie = io + ps->nid; io < ie && !ND_TTEST(*io); ++io) {
Fixed code: 	if (ND_TTEST2(cp, len)) {
	while (--n >= 0 && ND_TTEST(*ps)) {
		for (ie = io + ps->nid; io < ie && ND_TTEST(*io); ++io) {