Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2017-13049: Out-of-bounds Read (CWE-125)
value: The Rx protocol parser in tcpdump before 4.9.2 has a buffer over-read in print-rx.c:ubik_print().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: print-rx.c, tests/TESTLIST, tests/rx_ubik-oobr.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-13049/Rx: add a missing bounds check for Ubik

One of the case blocks in ubik_print() didn't check bounds before
fetching 32 bits of packet data and could overread past the captured
packet data by that amount.

This fixes a buffer over-read discovered by Henri Salo from Nixu
Corporation.

Add a test using the capture file supplied by the reporter(s).

Diff: diff --git a/print-rx.c b/print-rx.c
index 9df6b6aeec..741d3043d2 100644
--- a/print-rx.c
+++ b/print-rx.c
@@ -2575,10 +2575,11 @@ ubik_print(netdissect_options *ndo,
 			INTOUT();
 			ND_PRINT((ndo, " pos"));
 			INTOUT();
 			ND_PRINT((ndo, " length"));
 			INTOUT();
+			ND_TCHECK_32BITS(bp);
 			temp = EXTRACT_32BITS(bp);
 			bp += sizeof(int32_t);
 			tok2str(ubik_lock_types, "type %d", temp);
 			break;
 		case 20003:		/* Write */
diff --git a/tests/TESTLIST b/tests/TESTLIST
index 63e7eee000..08cb0d9ac0 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -571,10 +571,13 @@ mlppp-oobr		mlppp-oobr.pcap			mlppp-oobr.out
 
 # bad packets from Kim Gwan Yeong
 mptcp-dss-oobr		mptcp-dss-oobr.pcap		mptcp-dss-oobr.out	-v
 icmp6_nodeinfo_oobr	icmp6_nodeinfo_oobr.pcap	icmp6_nodeinfo_oobr.out
 
+# bad packets from Henri Salo
+rx_ubik-oobr		rx_ubik-oobr.pcap		rx_ubik-oobr.out -c1
+
 # RTP tests
 # fuzzed pcap
 rtp-seg-fault-1  rtp-seg-fault-1.pcap  rtp-seg-fault-1.out  -v -T rtp
 rtp-seg-fault-2  rtp-seg-fault-2.pcap  rtp-seg-fault-2.out  -v -T rtp
 
diff --git a/tests/rx_ubik-oobr.out b/tests/rx_ubik-oobr.out
new file mode 100644
index 0000000000..f192432d4a
--- /dev/null
+++ b/tests/rx_ubik-oobr.out
@@ -0,0 +1 @@
+IP truncated-ip - 2598 bytes missing! 222.241.104.198.3503 > 131.63.241.146.7002:  rx data pt ubik call disk-lock tid 50266112.32382 file 2122216448 pos 545160708 length 1087685554 [|ubik] (2632)
diff --git a/tests/rx_ubik-oobr.pcap b/tests/rx_ubik-oobr.pcap
new file mode 100644
index 0000000000..69caac9013
Binary files /dev/null and b/tests/rx_ubik-oobr.pcap differ

Fixed code: 			ND_TCHECK_32BITS(bp);
# bad packets from Henri Salo
rx_ubik-oobr		rx_ubik-oobr.pcap		rx_ubik-oobr.out -c1

IP truncated-ip - 2598 bytes missing! 222.241.104.198.3503 > 131.63.241.146.7002:  rx data pt ubik call disk-lock tid 50266112.32382 file 2122216448 pos 545160708 length 1087685554 [|ubik] (2632)
CVE-2017-13054: Out-of-bounds Read (CWE-125)
value: The LLDP parser in tcpdump before 4.9.2 has a buffer over-read in print-lldp.c:lldp_private_8023_print().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: print-lldp.c, tests/TESTLIST, tests/lldp_8023_mtu-oobr.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-13054/LLDP: add a missing length check

In lldp_private_8023_print() the case block for subtype 4 (Maximum Frame
Size TLV, IEEE 802.3bc-2009 Section 79.3.4) did not include the length
check and could over-read the input buffer, put it right.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s).

Diff: diff --git a/print-lldp.c b/print-lldp.c
index add7e6a5f9..e87b16bd0f 100644
--- a/print-lldp.c
+++ b/print-lldp.c
@@ -896,10 +896,13 @@ lldp_private_8023_print(netdissect_options *ndo,
                bittok2str(lldp_aggregation_values, "none", *(tptr+4)),
                EXTRACT_32BITS(tptr + 5)));
         break;
 
     case LLDP_PRIVATE_8023_SUBTYPE_MTU:
+        if (tlv_len < 6) {
+            return hexdump;
+        }
         ND_PRINT((ndo, "\n\t    MTU size %u", EXTRACT_16BITS(tptr + 4)));
         break;
 
     default:
         hexdump = TRUE;
diff --git a/tests/TESTLIST b/tests/TESTLIST
index a3e038b3fc..eb0839e0c0 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -569,10 +569,11 @@ rsvp_fast_reroute-oobr	rsvp_fast_reroute-oobr.pcap	rsvp_fast_reroute-oobr.out -v
 esis_opt_prot-oobr	esis_opt_prot-oobr.pcap		esis_opt_prot-oobr.out	-v -c1
 rsvp_uni-oobr-1	rsvp_uni-oobr-1.pcap	rsvp_uni-oobr-1.out	-v -c1
 rsvp_uni-oobr-2	rsvp_uni-oobr-2.pcap	rsvp_uni-oobr-2.out	-v -c1
 rsvp_uni-oobr-3	rsvp_uni-oobr-3.pcap	rsvp_uni-oobr-3.out	-v -c3
 rpki-rtr-oob		rpki-rtr-oob.pcap	rpki-rtr-oob.out	-v -c1
+lldp_8023_mtu-oobr	lldp_8023_mtu-oobr.pcap	lldp_8023_mtu-oobr.out	-v -c1
 
 # bad packets from Katie Holly
 mlppp-oobr		mlppp-oobr.pcap			mlppp-oobr.out
 
 # bad packets from Kim Gwan Yeong
diff --git a/tests/lldp_8023_mtu-oobr.out b/tests/lldp_8023_mtu-oobr.out
new file mode 100644
index 0000000000..5185583963
--- /dev/null
+++ b/tests/lldp_8023_mtu-oobr.out
@@ -0,0 +1,4 @@
+LLDP, length 4293194266
+	Organization specific TLV (127), length 4: OUI IEEE 802.3 Private (0x00120f)
+	  Max frame size Subtype (4)
+	[|LLDP]
diff --git a/tests/lldp_8023_mtu-oobr.pcap b/tests/lldp_8023_mtu-oobr.pcap
new file mode 100644
index 0000000000..dc6d3df398
Binary files /dev/null and b/tests/lldp_8023_mtu-oobr.pcap differ

Fixed code:         if (tlv_len < 6) {
            return hexdump;
        }
lldp_8023_mtu-oobr	lldp_8023_mtu-oobr.pcap	lldp_8023_mtu-oobr.out	-v -c1
LLDP, length 4293194266
	Organization specific TLV (127), length 4: OUI IEEE 802.3 Private (0x00120f)
	  Max frame size Subtype (4)
	[|LLDP]
CVE-2017-13725: Out-of-bounds Read (CWE-125)
value: The IPv6 routing header parser in tcpdump before 4.9.2 has a buffer over-read in print-rt6.c:rt6_print().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: tests/TESTLIST, tests/hoobr_rt6_print.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-13725/IPv6 R.H.: Add a capture file.

This is from Kamil Frankowicz testing an existing fix.

This is a test for the print-rt6.c fix I made after inspecting the code.

Diff: diff --git a/tests/TESTLIST b/tests/TESTLIST
index eaaeae1bdd..0c4d45a114 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -455,10 +455,11 @@ hoobr_juniper		hoobr_juniper.pcap		hoobr_juniper.out
 hoobr_juniper2		hoobr_juniper2.pcap		hoobr_juniper2.out
 hoobr_juniper3		hoobr_juniper3.pcap		hoobr_juniper3.out
 hoobr_parse_field	hoobr_parse_field.pcap		hoobr_parse_field.out
 hoobr_chdlc_print	hoobr_chdlc_print.pcap		hoobr_chdlc_print.out
 hoobr_lookup_nsap	hoobr_lookup_nsap.pcap		hoobr_lookup_nsap.out
+hoobr_rt6_print		hoobr_rt6_print.pcap		hoobr_rt6_print.out
 
 # bad packets from Wilfried Kirsch
 slip-bad-direction	slip-bad-direction.pcap		slip-bad-direction.out	-ve
 
 # bad packets from Otto Airamo and Antti Levomäki
diff --git a/tests/hoobr_rt6_print.out b/tests/hoobr_rt6_print.out
new file mode 100644
index 0000000000..4fb3c4a827
--- /dev/null
+++ b/tests/hoobr_rt6_print.out
@@ -0,0 +1,3 @@
+unknown ip 3
+unknown ip 3
+IP6 3030:3030:3030:3030:3030:3030:3030:3030 > 3030:3030:3030:3030:3030:3030:3030:3030: [|srcrt]
diff --git a/tests/hoobr_rt6_print.pcap b/tests/hoobr_rt6_print.pcap
new file mode 100644
index 0000000000..d2d9507f5f
Binary files /dev/null and b/tests/hoobr_rt6_print.pcap differ

Fixed code: hoobr_rt6_print		hoobr_rt6_print.pcap		hoobr_rt6_print.out
unknown ip 3
unknown ip 3
IP6 3030:3030:3030:3030:3030:3030:3030:3030 > 3030:3030:3030:3030:3030:3030:3030:3030: [|srcrt]
CVE-2017-13725: Out-of-bounds Read (CWE-125)
value: The IPv6 routing header parser in tcpdump before 4.9.2 has a buffer over-read in print-rt6.c:rt6_print().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: C
Files changed: print-rt6.c
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-13725/IPv6 R.H.: Check for the existence of all fields before fetching them.

Don't fetch the length field from the header until after we've checked
for the existence of a field at or after that field.

(Found by code inspection, not by a capture.)

Diff: diff --git a/print-rt6.c b/print-rt6.c
index 35dbed981b..0395791d76 100644
--- a/print-rt6.c
+++ b/print-rt6.c
@@ -43,17 +43,17 @@ rt6_print(netdissect_options *ndo, register const u_char *bp, const u_char *bp2
 	register const u_char *ep;
 	int i, len;
 	register const struct in6_addr *addr;
 
 	dp = (const struct ip6_rthdr *)bp;
-	len = dp->ip6r_len;
 
 	/* 'ep' points to the end of available data. */
 	ep = ndo->ndo_snapend;
 
 	ND_TCHECK(dp->ip6r_segleft);
 
+	len = dp->ip6r_len;
 	ND_PRINT((ndo, "srcrt (len=%d", dp->ip6r_len));	/*)*/
 	ND_PRINT((ndo, ", type=%d", dp->ip6r_type));
 	ND_PRINT((ndo, ", segleft=%d", dp->ip6r_segleft));
 
 	switch (dp->ip6r_type) {

Vulnerable code: 	len = dp->ip6r_len;
Fixed code: 	len = dp->ip6r_len;
CVE-2018-16301: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:read_infile(). To trigger this vulnerability the attacker needs to create a 4GB file on the local filesystem and to specify the file name as the value of the -F command-line argument of tcpdump.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 7.8
Published: 2019-10-03T16:15Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: CHANGES
Commit date: 2022-02-07 12:36:46 +0000
Commit message: Add CVE-2018-16301 to CHANGES. [skip ci]

One of the effects of commit faf8fb7 was fixing a buffer overflow that
was discovered and reported by Include Security (case reference "F2").
Their work was sponsored by Mozilla under the Secure Open Source
program.  The vulnerability was assigned CVE-2018-16301 on 2018-09-01
(MITRE request reference "scr562827"), but was not properly documented
afterwards.  Add a line to the change log section for 4.99.0, which at
the time of this writing is the first release to incorporate the fix.

See also https://github.com/the-tcpdump-group/libpcap/issues/855

Diff: diff --git a/CHANGES b/CHANGES
index 97fdb08833..a5380cb5bd 100644
--- a/CHANGES
+++ b/CHANGES
@@ -68,10 +68,11 @@ Wednesday, June 9, 2021 by gharris
     Solaris:
       Fix a compile error with Sun C
 
 Wednesday, December 30, 2020, by mcr@sandelman.ca, denis and fxl.
   Summary for 4.99.0 tcpdump release
+    CVE-2018-16301: For the -F option handle large input files safely.
     Improve the contents, wording and formatting of the man page.
     Print unsupported link-layer protocol packets in hex.
     Add support for new network protocols and DLTs: Arista, Autosar SOME/IP,
       Broadcom LI and Ethernet switches tag, IEEE 802.15.9, IP-over-InfiniBand
       (IPoIB), Linux SLL2, Linux vsockmon, MACsec, Marvell Distributed Switch

Fixed code:     CVE-2018-16301: For the -F option handle large input files safely.
CVE-2020-8036: Out-of-bounds Read (CWE-125)
value: The tok2strbuf() function in tcpdump 4.10.0-PRE-GIT was used by the SOME/IP dissector in an unsafe way.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2020-11-04T18:15Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: C
Files changed: print-someip.c
Commit date: 2020-02-29 16:21:12 +0100
Commit message: SOME/IP: Fix terminating a "struct tok" array

Moreover:
Declare static and const the "struct tok" arrays.

Diff: diff --git a/print-someip.c b/print-someip.c
index 3f3fcfc67e..bd6a74f39c 100644
--- a/print-someip.c
+++ b/print-someip.c
@@ -40,11 +40,11 @@
  *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  *    |                            Payload                            |
  *    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  */
 
-struct tok message_type_values[] = {
+static const struct tok message_type_values[] = {
     { 0x00, "REQUEST" },
     { 0x01, "REQUEST_NO_RETURN" },
     { 0x02, "NOTIFICATION" },
     { 0x80, "RESPONSE" },
     { 0x81, "ERROR" },
@@ -54,11 +54,11 @@ struct tok message_type_values[] = {
     { 0xa0, "TP_RESPONSE" },
     { 0xa1, "TP_ERROR" },
     { 0, NULL }
 };
 
-struct tok return_code_values[] = {
+static const struct tok return_code_values[] = {
     { 0x00, "E_OK" },
     { 0x01, "E_NOT_OK" },
     { 0x02, "E_UNKNOWN_SERVICE" },
     { 0x03, "E_UNKNOWN_METHOD" },
     { 0x04, "E_NOT_READY" },
@@ -71,10 +71,11 @@ struct tok return_code_values[] = {
     { 0x0b, "E_E2E_REPEATED" },
     { 0x0c, "E_E2E_WRONG_SEQUENCE" },
     { 0x0d, "E_E2E" },
     { 0x0e, "E_E2E_NOT_AVAILABLE" },
     { 0x0f, "E_E2E_NO_NEW_DATA" },
+    { 0, NULL }
 };
 
 void
 someip_print(netdissect_options *ndo, const u_char *bp, u_int len)
 {

Vulnerable code: struct tok message_type_values[] = {
struct tok return_code_values[] = {
Fixed code: static const struct tok message_type_values[] = {
static const struct tok return_code_values[] = {
    { 0, NULL }
CVE-2022-0272: Improper Restriction of XML External Entity Reference (CWE-611)
value: Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 9.8
Published: 2022-04-21T17:15Z
Repository: https://github.com/detekt/detekt
Language: Kotlin
Files changed: detekt-core/src/main/kotlin/io/gitlab/arturbosch/detekt/core/baseline/BaselineFormat.kt
Commit date: 2022-01-18 18:21:06 +0100
Commit message: Parse Baseline in a secure way (#4499)


Diff: diff --git a/detekt-core/src/main/kotlin/io/gitlab/arturbosch/detekt/core/baseline/BaselineFormat.kt b/detekt-core/src/main/kotlin/io/gitlab/arturbosch/detekt/core/baseline/BaselineFormat.kt
index a34097ac6..ac8c41e77 100644
--- a/detekt-core/src/main/kotlin/io/gitlab/arturbosch/detekt/core/baseline/BaselineFormat.kt
+++ b/detekt-core/src/main/kotlin/io/gitlab/arturbosch/detekt/core/baseline/BaselineFormat.kt
@@ -1,10 +1,11 @@
 package io.gitlab.arturbosch.detekt.core.baseline
 
 import org.xml.sax.SAXParseException
 import java.nio.file.Files
 import java.nio.file.Path
+import javax.xml.XMLConstants
 import javax.xml.parsers.SAXParserFactory
 import javax.xml.stream.XMLStreamException
 import javax.xml.stream.XMLStreamWriter
 
 internal class BaselineFormat {
@@ -15,11 +16,15 @@ internal class BaselineFormat {
     class InvalidState(msg: String, error: Throwable) : IllegalStateException(msg, error)
 
     fun read(path: Path): Baseline {
         try {
             Files.newInputStream(path).use {
-                val reader = SAXParserFactory.newInstance().newSAXParser()
+                val reader = SAXParserFactory.newInstance()
+                    .apply {
+                        setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)
+                    }
+                    .newSAXParser()
                 val handler = BaselineHandler()
                 reader.parse(it, handler)
                 return handler.createBaseline()
             }
         } catch (error: SAXParseException) {

Vulnerable code:                 val reader = SAXParserFactory.newInstance().newSAXParser()
Fixed code: import javax.xml.XMLConstants
                val reader = SAXParserFactory.newInstance()
                    .apply {
                        setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)
                    }
                    .newSAXParser()
CVE-2015-10078: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, has been found in atwellpub Resend Welcome Email Plugin 1.0.1 on WordPress. This issue affects the function send_welcome_email_url of the file resend-welcome-email.php. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is b14c1f66d307783f0ae74f88088a85999107695c. It is recommended to upgrade the affected component. The identifier VDB-220637 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-02-12T14:15Z
Repository: https://github.com/atwellpub/resend-welcome-email
Language: PHP
Files changed: resend-welcome-email.php
Commit date: 2015-04-27 11:17:42 -0700
Commit message: Escaping result of wp_nonce_url, since it does not use proper esc_url function internally. See this post for details: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html

Diff: diff --git a/resend-welcome-email.php b/resend-welcome-email.php
index 9aa8b95..4f13899 100644
--- a/resend-welcome-email.php
+++ b/resend-welcome-email.php
@@ -122,14 +122,14 @@ if ( !class_exists( 'Resend_Welcome_Email' )) {
 		 * @param  WP_User $user The user to be switched to.
 		 * @return string|bool The required URL, or false if there's no old user or the user doesn't have the required capability.
 		 */
 		public static function send_welcome_email_url( WP_User $user ) {
 
-			return wp_nonce_url( add_query_arg( array(
+			return esc_url(wp_nonce_url( add_query_arg( array(
 				'action'  => 'resend_welcome_email',
 				'user_id' => $user->ID
-			), '') , "send_welcome_email_{$user->ID}" );
+			), '') , "send_welcome_email_{$user->ID}" ));
 
 		}
 		
 		/**
 		 * Resends the welcome email

Vulnerable code: 			return wp_nonce_url( add_query_arg( array(
			), '') , "send_welcome_email_{$user->ID}" );
Fixed code: 			return esc_url(wp_nonce_url( add_query_arg( array(
			), '') , "send_welcome_email_{$user->ID}" ));
CVE-2023-49793: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Zip files uploaded to the server endpoint of `CodeChecker store` are not properly sanitized. An attacker, using a path traversal attack, can load and display files on the machine of `CodeChecker server`. The vulnerable endpoint is `/Default/v6.53/CodeCheckerService@massStoreRun`. The path traversal vulnerability allows reading data on the machine of the `CodeChecker server`, with the same permission level as the `CodeChecker server`.
The attack requires a user account on the `CodeChecker server`, with permission to store to a server, and view the stored report. This vulnerability has been patched in version 6.23.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 6.5
Published: 2024-06-24T18:15Z
Repository: https://github.com/Ericsson/codechecker
Language: Unknown
Commit date: 2023-12-08 16:12:11 +0100
Commit message: Merge pull request from GHSA-h26w-r4m5-8rrf

[cmd] Better sanitization for stored file names
CVE-2020-11011: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: In Phproject before version 1.7.8, there's a vulnerability which allows users with access to file uploads to execute arbitrary code. This is patched in version 1.7.8.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 8.8
Published: 2020-04-22T17:15Z
Repository: https://github.com/Alanaktion/phproject
Language: Unknown
Commit date: 2020-04-20 16:58:19 -0600
Commit message: Merge pull request from GHSA-4j97-6w6q-gxjx

Add file type blacklist and prevent execution of uploaded files
CVE-2016-10504: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Heap-based buffer overflow vulnerability in the opj_mqc_byteout function in mqc.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service (application crash) via a crafted bmp file.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 6.5
Published: 2017-08-30T09:29Z
Repository: https://github.com/uclouvain/openjpeg
Language: C
Files changed: src/lib/openjp2/tcd.c
Commit date: 2017-07-29 19:13:49 +0200
Commit message: Fix write heap buffer overflow in opj_mqc_byteout(). Discovered by Ke Liu of Tencent's Xuanwu LAB (#835)

Diff: diff --git a/src/lib/openjp2/tcd.c b/src/lib/openjp2/tcd.c
index 56779852..08c5a765 100644
--- a/src/lib/openjp2/tcd.c
+++ b/src/lib/openjp2/tcd.c
@@ -1180,12 +1180,13 @@ static OPJ_BOOL opj_tcd_code_block_enc_allocate(opj_tcd_cblk_enc_t *
 static OPJ_BOOL opj_tcd_code_block_enc_allocate_data(opj_tcd_cblk_enc_t *
         p_code_block)
 {
     OPJ_UINT32 l_data_size;
 
-    l_data_size = (OPJ_UINT32)((p_code_block->x1 - p_code_block->x0) *
-                               (p_code_block->y1 - p_code_block->y0) * (OPJ_INT32)sizeof(OPJ_UINT32));
+    /* The +1 is needed for https://github.com/uclouvain/openjpeg/issues/835 */
+    l_data_size = 1 + (OPJ_UINT32)((p_code_block->x1 - p_code_block->x0) *
+                                   (p_code_block->y1 - p_code_block->y0) * (OPJ_INT32)sizeof(OPJ_UINT32));
 
     if (l_data_size > p_code_block->data_size) {
         if (p_code_block->data) {
             /* We refer to data - 1 since below we incremented it */
             opj_free(p_code_block->data - 1);

Vulnerable code:     l_data_size = (OPJ_UINT32)((p_code_block->x1 - p_code_block->x0) *
                               (p_code_block->y1 - p_code_block->y0) * (OPJ_INT32)sizeof(OPJ_UINT32));
Fixed code:     /* The +1 is needed for https://github.com/uclouvain/openjpeg/issues/835 */
    l_data_size = 1 + (OPJ_UINT32)((p_code_block->x1 - p_code_block->x0) *
                                   (p_code_block->y1 - p_code_block->y0) * (OPJ_INT32)sizeof(OPJ_UINT32));
CVE-2016-10507: Integer Overflow or Wraparound (CWE-190)
value: Integer overflow vulnerability in the bmp24toimage function in convertbmp.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted bmp file.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 6.5
Published: 2017-08-30T09:29Z
Repository: https://github.com/uclouvain/openjpeg
Language: Unknown
Commit date: 2016-09-20 18:59:30 +0200
Commit message: Merge pull request #834 from trylab/issue833

Fix issue 833.
CVE-2016-4796: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Heap-based buffer overflow in the color_cmyk_to_rgb in common/color.c in OpenJPEG before 2.1.1 allows remote attackers to cause a denial of service (crash) via a crafted .j2k file.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 5.5
Published: 2017-02-03T16:59Z
Repository: https://github.com/uclouvain/openjpeg
Language: C
Files changed: src/bin/common/color.c, tests/nonregression/test_suite.ctest.in
Commit date: 2016-05-08 19:18:05 +0200
Commit message: Fix Heap Buffer Overflow in function color_cmyk_to_rgb

Fix uclouvain/openjpeg#774

Diff: diff --git a/src/bin/common/color.c b/src/bin/common/color.c
index 944df73b..234c7bdf 100644
--- a/src/bin/common/color.c
+++ b/src/bin/common/color.c
@@ -853,11 +853,18 @@ void color_cmyk_to_rgb(opj_image_t *image)
 	unsigned int w, h, max, i;
 
 	w = image->comps[0].w;
 	h = image->comps[0].h;
 
-	if(image->numcomps < 4) return;
+	if (
+			(image->numcomps < 4)
+		 || (image->comps[0].dx != image->comps[1].dx) || (image->comps[0].dx != image->comps[2].dx) || (image->comps[0].dx != image->comps[3].dx)
+		 || (image->comps[0].dy != image->comps[1].dy) || (image->comps[0].dy != image->comps[2].dy) || (image->comps[0].dy != image->comps[3].dy)
+			) {
+		fprintf(stderr,"%s:%d:color_cmyk_to_rgb\n\tCAN NOT CONVERT\n", __FILE__,__LINE__);
+		return;
+	}
 
 	max = w * h;
 	
 	sC = 1.0F / (float)((1 << image->comps[0].prec) - 1);
 	sM = 1.0F / (float)((1 << image->comps[1].prec) - 1);
diff --git a/tests/nonregression/test_suite.ctest.in b/tests/nonregression/test_suite.ctest.in
index c48f66b2..13112216 100644
--- a/tests/nonregression/test_suite.ctest.in
+++ b/tests/nonregression/test_suite.ctest.in
@@ -557,5 +557,7 @@ opj_decompress -i @INPUT_NR_PATH@/basn6a08.jp2 -o @TEMP_PATH@/basn6a08_tif-15.ti
 !opj_decompress -i @INPUT_NR_PATH@/issue725.jp2 -o @TEMP_PATH@/issue725.png
 # issue 726
 opj_decompress -i @INPUT_NR_PATH@/issue726.j2k -o @TEMP_PATH@/issue726.png
 # issue 733
 !opj_decompress -i @INPUT_NR_PATH@/issue733.jp2 -o @TEMP_PATH@/issue733.png
+# issue 774
+!opj_decompress -i @INPUT_NR_PATH@/issue774.jp2 -o @TEMP_PATH@/issue774.png

Vulnerable code: 	if(image->numcomps < 4) return;
Fixed code: 	if (
			(image->numcomps < 4)
		 || (image->comps[0].dx != image->comps[1].dx) || (image->comps[0].dx != image->comps[2].dx) || (image->comps[0].dx != image->comps[3].dx)
		 || (image->comps[0].dy != image->comps[1].dy) || (image->comps[0].dy != image->comps[2].dy) || (image->comps[0].dy != image->comps[3].dy)
			) {
		fprintf(stderr,"%s:%d:color_cmyk_to_rgb\n\tCAN NOT CONVERT\n", __FILE__,__LINE__);
		return;
	}
# issue 774
!opj_decompress -i @INPUT_NR_PATH@/issue774.jp2 -o @TEMP_PATH@/issue774.png
CVE-2016-4797: Divide By Zero (CWE-369)
value: Divide-by-zero vulnerability in the opj_tcd_init_tile function in tcd.c in OpenJPEG before 2.1.1 allows remote attackers to cause a denial of service (application crash) via a crafted jp2 file. NOTE: this issue exists because of an incorrect fix for CVE-2014-7947.
CWE description: The product divides a value by zero.
CVSS v3 base score: 5.5
Published: 2017-02-03T16:59Z
Repository: https://github.com/uclouvain/openjpeg
Language: C
Files changed: src/lib/openjp2/tcd.c, tests/nonregression/test_suite.ctest.in
Commit date: 2016-05-08 18:40:12 +0200
Commit message: Fix division by zero

Fix uclouvain/openjpeg#733

Diff: diff --git a/src/lib/openjp2/tcd.c b/src/lib/openjp2/tcd.c
index 7ecd97cf..b8cd3072 100644
--- a/src/lib/openjp2/tcd.c
+++ b/src/lib/openjp2/tcd.c
@@ -718,11 +718,12 @@ static INLINE OPJ_BOOL opj_tcd_init_tile(opj_tcd_t *p_tcd, OPJ_UINT32 p_tile_no,
 		l_tilec->y1 = opj_int_ceildiv(l_tile->y1, (OPJ_INT32)l_image_comp->dy);
 		/*fprintf(stderr, "\tTile compo border = %d,%d,%d,%d\n", l_tilec->x0, l_tilec->y0,l_tilec->x1,l_tilec->y1);*/
 		
 		/* compute l_data_size with overflow check */
 		l_data_size = (OPJ_UINT32)(l_tilec->x1 - l_tilec->x0);
-		if ((((OPJ_UINT32)-1) / l_data_size) < (OPJ_UINT32)(l_tilec->y1 - l_tilec->y0)) {
+		/* issue 733, l_data_size == 0U, probably something wrong should be checked before getting here */
+		if ((l_data_size > 0U) && ((((OPJ_UINT32)-1) / l_data_size) < (OPJ_UINT32)(l_tilec->y1 - l_tilec->y0))) {
 			opj_event_msg(manager, EVT_ERROR, "Not enough memory for tile data\n");
 			return OPJ_FALSE;
 		}
 		l_data_size = l_data_size * (OPJ_UINT32)(l_tilec->y1 - l_tilec->y0);
 		
diff --git a/tests/nonregression/test_suite.ctest.in b/tests/nonregression/test_suite.ctest.in
index f22a89f5..c48f66b2 100644
--- a/tests/nonregression/test_suite.ctest.in
+++ b/tests/nonregression/test_suite.ctest.in
@@ -555,5 +555,7 @@ opj_decompress -i @INPUT_NR_PATH@/basn6a08.jp2 -o @TEMP_PATH@/basn6a08_tif-15.ti
 
 # issue 725
 !opj_decompress -i @INPUT_NR_PATH@/issue725.jp2 -o @TEMP_PATH@/issue725.png
 # issue 726
 opj_decompress -i @INPUT_NR_PATH@/issue726.j2k -o @TEMP_PATH@/issue726.png
+# issue 733
+!opj_decompress -i @INPUT_NR_PATH@/issue733.jp2 -o @TEMP_PATH@/issue733.png

Vulnerable code: 		if ((((OPJ_UINT32)-1) / l_data_size) < (OPJ_UINT32)(l_tilec->y1 - l_tilec->y0)) {
Fixed code: 		/* issue 733, l_data_size == 0U, probably something wrong should be checked before getting here */
		if ((l_data_size > 0U) && ((((OPJ_UINT32)-1) / l_data_size) < (OPJ_UINT32)(l_tilec->y1 - l_tilec->y0))) {
# issue 733
!opj_decompress -i @INPUT_NR_PATH@/issue733.jp2 -o @TEMP_PATH@/issue733.png
CVE-2016-7163: Integer Overflow or Wraparound (CWE-190)
value: Integer overflow in the opj_pi_create_decode function in pi.c in OpenJPEG allows remote attackers to execute arbitrary code via a crafted JP2 file, which triggers an out-of-bounds read or write.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 7.8
Published: 2016-09-21T14:25Z
Repository: https://github.com/uclouvain/openjpeg
Language: C
Files changed: src/lib/openjp2/pi.c
Commit date: 2016-09-08 07:34:46 +0200
Commit message: Cast to size_t before multiplication

Need to cast to size_t before multiplication otherwise overflow check is useless.
Diff: diff --git a/src/lib/openjp2/pi.c b/src/lib/openjp2/pi.c
index 36e2ff0c..809b33d7 100644
--- a/src/lib/openjp2/pi.c
+++ b/src/lib/openjp2/pi.c
@@ -1239,11 +1239,11 @@ opj_pi_iterator_t *opj_pi_create_decode(opj_image_t *p_image,
 	/* memory allocation for include */
 	/* prevent an integer overflow issue */
 	l_current_pi->include = 00;
 	if (l_step_l <= (SIZE_MAX / (l_tcp->numlayers + 1U)))
 	{
-		l_current_pi->include = (OPJ_INT16*) opj_calloc((l_tcp->numlayers +1) * l_step_l, sizeof(OPJ_INT16));
+		l_current_pi->include = (OPJ_INT16*) opj_calloc((size_t)(l_tcp->numlayers + 1U) * l_step_l, sizeof(OPJ_INT16));
 	}
 
 	if
 		(!l_current_pi->include)
 	{

Vulnerable code: 		l_current_pi->include = (OPJ_INT16*) opj_calloc((l_tcp->numlayers +1) * l_step_l, sizeof(OPJ_INT16));
Fixed code: 		l_current_pi->include = (OPJ_INT16*) opj_calloc((size_t)(l_tcp->numlayers + 1U) * l_step_l, sizeof(OPJ_INT16));
CVE-2016-7163: Integer Overflow or Wraparound (CWE-190)
value: Integer overflow in the opj_pi_create_decode function in pi.c in OpenJPEG allows remote attackers to execute arbitrary code via a crafted JP2 file, which triggers an out-of-bounds read or write.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 7.8
Published: 2016-09-21T14:25Z
Repository: https://github.com/uclouvain/openjpeg
Language: C
Files changed: src/lib/openjp2/pi.c
Commit date: 2016-09-06 07:55:49 +0200
Commit message: Fix an integer overflow issue (#809)

Prevent an integer overflow issue in function opj_pi_create_decode of
pi.c.
Diff: diff --git a/src/lib/openjp2/pi.c b/src/lib/openjp2/pi.c
index cffad668..36e2ff0c 100644
--- a/src/lib/openjp2/pi.c
+++ b/src/lib/openjp2/pi.c
@@ -1235,11 +1235,17 @@ opj_pi_iterator_t *opj_pi_create_decode(opj_image_t *p_image,
 
 	/* set values for first packet iterator */
 	l_current_pi = l_pi;
 
 	/* memory allocation for include */
-	l_current_pi->include = (OPJ_INT16*) opj_calloc((l_tcp->numlayers +1) * l_step_l, sizeof(OPJ_INT16));
+	/* prevent an integer overflow issue */
+	l_current_pi->include = 00;
+	if (l_step_l <= (SIZE_MAX / (l_tcp->numlayers + 1U)))
+	{
+		l_current_pi->include = (OPJ_INT16*) opj_calloc((l_tcp->numlayers +1) * l_step_l, sizeof(OPJ_INT16));
+	}
+
 	if
 		(!l_current_pi->include)
 	{
 		opj_free(l_tmp_data);
 		opj_free(l_tmp_ptr);

Vulnerable code: 	l_current_pi->include = (OPJ_INT16*) opj_calloc((l_tcp->numlayers +1) * l_step_l, sizeof(OPJ_INT16));
Fixed code: 	/* prevent an integer overflow issue */
	l_current_pi->include = 00;
	if (l_step_l <= (SIZE_MAX / (l_tcp->numlayers + 1U)))
	{
		l_current_pi->include = (OPJ_INT16*) opj_calloc((l_tcp->numlayers +1) * l_step_l, sizeof(OPJ_INT16));
	}
CVE-2017-12982: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The bmp_read_info_header function in bin/jp2/convertbmp.c in OpenJPEG 2.2.0 does not reject headers with a zero biBitCount, which allows remote attackers to cause a denial of service (memory allocation failure) in the opj_image_create function in lib/openjp2/image.c, related to the opj_aligned_alloc_n function in opj_malloc.c.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 5.5
Published: 2017-08-21T07:29Z
Repository: https://github.com/uclouvain/openjpeg
Language: C
Files changed: src/bin/jp2/convertbmp.c
Commit date: 2017-08-14 17:26:58 +0200
Commit message: bmp_read_info_header(): reject bmp files with biBitCount == 0 (#983)

Diff: diff --git a/src/bin/jp2/convertbmp.c b/src/bin/jp2/convertbmp.c
index b49e7a08..2715fdf2 100644
--- a/src/bin/jp2/convertbmp.c
+++ b/src/bin/jp2/convertbmp.c
@@ -390,10 +390,14 @@ static OPJ_BOOL bmp_read_info_header(FILE* IN, OPJ_BITMAPINFOHEADER* header)
     header->biPlanes  = (OPJ_UINT16)getc(IN);
     header->biPlanes |= (OPJ_UINT16)((OPJ_UINT32)getc(IN) << 8);
 
     header->biBitCount  = (OPJ_UINT16)getc(IN);
     header->biBitCount |= (OPJ_UINT16)((OPJ_UINT32)getc(IN) << 8);
+    if (header->biBitCount == 0) {
+        fprintf(stderr, "Error, invalid biBitCount %d\n", 0);
+        return OPJ_FALSE;
+    }
 
     if (header->biSize >= 40U) {
         header->biCompression  = (OPJ_UINT32)getc(IN);
         header->biCompression |= (OPJ_UINT32)getc(IN) << 8;
         header->biCompression |= (OPJ_UINT32)getc(IN) << 16;

Fixed code:     if (header->biBitCount == 0) {
        fprintf(stderr, "Error, invalid biBitCount %d\n", 0);
        return OPJ_FALSE;
    }
CVE-2017-14041: Out-of-bounds Write (CWE-787)
value: A stack-based buffer overflow was discovered in the pgxtoimage function in bin/jp2/convert.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2017-08-30T22:29Z
Repository: https://github.com/uclouvain/openjpeg
Language: C
Files changed: src/bin/jp2/convert.c
Commit date: 2017-08-18 13:39:20 +0200
Commit message: pgxtoimage(): fix write stack buffer overflow (#997)

Diff: diff --git a/src/bin/jp2/convert.c b/src/bin/jp2/convert.c
index 5459f7d44..e606c9be7 100644
--- a/src/bin/jp2/convert.c
+++ b/src/bin/jp2/convert.c
@@ -1183,11 +1183,11 @@ opj_image_t* pgxtoimage(const char *filename, opj_cparameters_t *parameters)
         fprintf(stderr, "Failed to open %s for reading !\n", filename);
         return NULL;
     }
 
     fseek(f, 0, SEEK_SET);
-    if (fscanf(f, "PG%[ \t]%c%c%[ \t+-]%d%[ \t]%d%[ \t]%d", temp, &endian1,
+    if (fscanf(f, "PG%31[ \t]%c%c%31[ \t+-]%d%31[ \t]%d%31[ \t]%d", temp, &endian1,
                &endian2, signtmp, &prec, temp, &w, temp, &h) != 9) {
         fclose(f);
         fprintf(stderr,
                 "ERROR: Failed to read the right number of element from the fscanf() function!\n");
         return NULL;

Vulnerable code:     if (fscanf(f, "PG%[ \t]%c%c%[ \t+-]%d%[ \t]%d%[ \t]%d", temp, &endian1,
Fixed code:     if (fscanf(f, "PG%31[ \t]%c%c%31[ \t+-]%d%31[ \t]%d%31[ \t]%d", temp, &endian1,
CVE-2017-14152: Out-of-bounds Write (CWE-787)
value: A mishandled zero case was discovered in opj_j2k_set_cinema_parameters in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_write_bytes_LE in lib/openjp2/cio.c and opj_j2k_write_sot in lib/openjp2/j2k.c) or possibly remote code execution.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2017-09-05T16:29Z
Repository: https://github.com/uclouvain/openjpeg
Language: C
Files changed: src/lib/openjp2/j2k.c
Commit date: 2017-08-15 11:55:58 +0200
Commit message: Fix assertion in debug mode / heap-based buffer overflow in opj_write_bytes_LE for Cinema profiles with numresolutions = 1 (#985)

Diff: diff --git a/src/lib/openjp2/j2k.c b/src/lib/openjp2/j2k.c
index a2521ebbc..54b490a8c 100644
--- a/src/lib/openjp2/j2k.c
+++ b/src/lib/openjp2/j2k.c
@@ -6571,14 +6571,20 @@ static void opj_j2k_set_cinema_parameters(opj_cparameters_t *parameters,
         break;
     }
 
     /* Precincts */
     parameters->csty |= 0x01;
-    parameters->res_spec = parameters->numresolution - 1;
-    for (i = 0; i < parameters->res_spec; i++) {
-        parameters->prcw_init[i] = 256;
-        parameters->prch_init[i] = 256;
+    if (parameters->numresolution == 1) {
+        parameters->res_spec = 1;
+        parameters->prcw_init[0] = 128;
+        parameters->prch_init[0] = 128;
+    } else {
+        parameters->res_spec = parameters->numresolution - 1;
+        for (i = 0; i < parameters->res_spec; i++) {
+            parameters->prcw_init[i] = 256;
+            parameters->prch_init[i] = 256;
+        }
     }
 
     /* The progression order shall be CPRL */
     parameters->prog_order = OPJ_CPRL;
 

Vulnerable code:     parameters->res_spec = parameters->numresolution - 1;
    for (i = 0; i < parameters->res_spec; i++) {
        parameters->prcw_init[i] = 256;
        parameters->prch_init[i] = 256;
Fixed code:     if (parameters->numresolution == 1) {
        parameters->res_spec = 1;
        parameters->prcw_init[0] = 128;
        parameters->prch_init[0] = 128;
    } else {
        parameters->res_spec = parameters->numresolution - 1;
        for (i = 0; i < parameters->res_spec; i++) {
            parameters->prcw_init[i] = 256;
            parameters->prch_init[i] = 256;
        }
CVE-2018-7648: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: An issue was discovered in mj2/opj_mj2_extract.c in OpenJPEG 2.3.0. The output prefix was not checked for length, which could overflow a buffer, when providing a prefix with 50 or more characters on the command line.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2018-03-02T16:29Z
Repository: https://github.com/uclouvain/openjpeg
Language: C
Files changed: src/bin/mj2/opj_mj2_extract.c
Commit date: 2018-09-22 23:12:39 +0200
Commit message: opj_mj2_extract: Check provided output prefix for length

This uses snprintf() with correct buffer length instead of sprintf(), which
prevents a buffer overflow when providing a long output prefix. Furthermore
the program exits with an error when the provided output prefix is too long.

Fixes #1088.

Diff: diff --git a/src/bin/mj2/opj_mj2_extract.c b/src/bin/mj2/opj_mj2_extract.c
index a062e17d8..fa67bf855 100644
--- a/src/bin/mj2/opj_mj2_extract.c
+++ b/src/bin/mj2/opj_mj2_extract.c
@@ -138,14 +138,25 @@ int main(int argc, char *argv[])
                            8); /* Skipping JP2C marker*/
         fseek(file, sample->offset + 8, SEEK_SET);
         fread(frame_codestream, sample->sample_size - 8, 1,
               file); /* Assuming that jp and ftyp markers size do*/
 
-        sprintf(outfilename, "%s_%05d.j2k", argv[2], snum);
+        {
+            int num = snprintf(outfilename, sizeof(outfilename),
+                               "%s_%05d.j2k", argv[2],
+                               snum);
+            if (num >= sizeof(outfilename)) {
+                fprintf(stderr, "maximum length of output prefix exceeded\n");
+                free(frame_codestream);
+                return 1;
+            }
+        }
+
         outfile = fopen(outfilename, "wb");
         if (!outfile) {
             fprintf(stderr, "failed to open %s for writing\n", outfilename);
+            free(frame_codestream);
             return 1;
         }
         fwrite(frame_codestream, sample->sample_size - 8, 1, outfile);
         fclose(outfile);
         free(frame_codestream);

Vulnerable code:         sprintf(outfilename, "%s_%05d.j2k", argv[2], snum);
Fixed code:         {
            int num = snprintf(outfilename, sizeof(outfilename),
                               "%s_%05d.j2k", argv[2],
                               snum);
            if (num >= sizeof(outfilename)) {
                fprintf(stderr, "maximum length of output prefix exceeded\n");
                free(frame_codestream);
                return 1;
            }
        }

            free(frame_codestream);
CVE-2021-34363: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the "undo archive operation" feature.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.1
Published: 2021-06-10T11:15Z
Repository: https://github.com/nvbn/thefuck
Language: Python
Files changed: thefuck/rules/dirty_untar.py, thefuck/rules/dirty_unzip.py
Commit date: 2021-06-08 22:04:51 +0200
Commit message: NA: Fix possible changes in files outside of working directory (#1206)


Diff: diff --git a/thefuck/rules/dirty_untar.py b/thefuck/rules/dirty_untar.py
index d94958b..638aa87 100644
--- a/thefuck/rules/dirty_untar.py
+++ b/thefuck/rules/dirty_untar.py
@@ -39,10 +39,14 @@ def get_new_command(command):
 
 
 def side_effect(old_cmd, command):
     with tarfile.TarFile(_tar_file(old_cmd.script_parts)[0]) as archive:
         for file in archive.getnames():
+            if not os.path.abspath(file).startswith(os.getcwd()):
+                # it's unsafe to overwrite files outside of the current directory
+                continue
+
             try:
                 os.remove(file)
             except OSError:
                 # does not try to remove directories as we cannot know if they
                 # already existed before
diff --git a/thefuck/rules/dirty_unzip.py b/thefuck/rules/dirty_unzip.py
index 5369dea..6b50798 100644
--- a/thefuck/rules/dirty_unzip.py
+++ b/thefuck/rules/dirty_unzip.py
@@ -43,10 +43,14 @@ def get_new_command(command):
 
 
 def side_effect(old_cmd, command):
     with zipfile.ZipFile(_zip_file(old_cmd), 'r') as archive:
         for file in archive.namelist():
+            if not os.path.abspath(file).startswith(os.getcwd()):
+                # it's unsafe to overwrite files outside of the current directory
+                continue
+
             try:
                 os.remove(file)
             except OSError:
                 # does not try to remove directories as we cannot know if they
                 # already existed before

Fixed code:             if not os.path.abspath(file).startswith(os.getcwd()):
                # it's unsafe to overwrite files outside of the current directory
                continue

            if not os.path.abspath(file).startswith(os.getcwd()):
                # it's unsafe to overwrite files outside of the current directory
                continue
CVE-2022-0855: Use of Incorrectly-Resolved Name or Reference (CWE-706)
value: Improper Resolution of Path Equivalence in GitHub repository microweber-dev/whmcs_plugin prior to 0.0.4.
CWE description: The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
CVSS v3 base score: 6.1
Published: 2022-03-04T19:15Z
Repository: https://github.com/microweber-dev/whmcs_plugin
Language: JavaScript
Files changed: modules/addons/microweber_addon/order/embed.js
Commit date: 2022-02-28 14:00:55 +0200
Commit message: update

Diff: diff --git a/modules/addons/microweber_addon/order/embed.js b/modules/addons/microweber_addon/order/embed.js
index 53fecb4..12bf37d 100644
--- a/modules/addons/microweber_addon/order/embed.js
+++ b/modules/addons/microweber_addon/order/embed.js
@@ -62,10 +62,19 @@ document.addEventListener("DOMContentLoaded", function(event) {
 
     // iframe.onload =       window.scrollTo(0,0);;
     if (typeof windowhash === 'string' && windowhash.indexOf('frameurl=') > -1) {
         var hash = windowhash.split('frameurl=')[1];
         var hash = decodeURI(atob(hash))
+        var domain_check = (new URL(hash));
+        domain_check = domain_check.hostname;
+
+        if(window.location.hostname != domain_check){
+            alert('You are trying to load a domain search from a different domain. Please use the same domain.');
+            return;
+        }
+
+
         //     iframe.src = hash;
     } else {
 
         //alert(path);
         iframe.src = path + '/index.php?m=microweber_addon&function=order_iframe&' + $params;

Fixed code:         var domain_check = (new URL(hash));
        domain_check = domain_check.hostname;

        if(window.location.hostname != domain_check){
            alert('You are trying to load a domain search from a different domain. Please use the same domain.');
            return;
        }