Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2018-12249: NULL Pointer Dereference (CWE-476)
value: An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrb_class_real because "class BasicObject" is not properly supported in class.c.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2018-06-12T14:29Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: src/class.c
Commit date: 2018-06-08 14:13:06 +0900
Commit message: `mrb_class_real()` did not work for `BasicObject`; fix #4037

Diff: diff --git a/src/class.c b/src/class.c
index c761f46af..a9439d7d7 100644
--- a/src/class.c
+++ b/src/class.c
@@ -1761,14 +1761,14 @@ mrb_class_path(mrb_state *mrb, struct RClass *c)
 }
 
 MRB_API struct RClass*
 mrb_class_real(struct RClass* cl)
 {
-  if (cl == 0)
-    return NULL;
+  if (cl == 0) return NULL;
   while ((cl->tt == MRB_TT_SCLASS) || (cl->tt == MRB_TT_ICLASS)) {
     cl = cl->super;
+    if (cl == 0) return NULL;
   }
   return cl;
 }
 
 MRB_API const char*

Vulnerable code:   if (cl == 0)
    return NULL;
Fixed code:   if (cl == 0) return NULL;
    if (cl == 0) return NULL;
CVE-2020-36401: Double Free (CWE-415)
value: mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free).
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 7.8
Published: 2021-07-01T03:15Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: src/gc.c
Commit date: 2020-07-02 10:41:03 +0900
Commit message: Cancel 9cdf439

Should not free the pointer in `realloc` since it can cause
use-after-free problem.

Diff: diff --git a/src/gc.c b/src/gc.c
index 6c83911d53..e1892080f5 100644
--- a/src/gc.c
+++ b/src/gc.c
@@ -223,11 +223,10 @@ mrb_realloc(mrb_state *mrb, void *p, size_t len)
   void *p2;
 
   p2 = mrb_realloc_simple(mrb, p, len);
   if (len == 0) return p2;
   if (p2 == NULL) {
-    mrb_free(mrb, p);
     mrb->gc.out_of_memory = TRUE;
     mrb_raise_nomemory(mrb);
   }
   else {
     mrb->gc.out_of_memory = FALSE;

Vulnerable code:     mrb_free(mrb, p);
CVE-2021-4188: NULL Pointer Dereference (CWE-476)
value: mruby is vulnerable to NULL Pointer Dereference
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2021-12-30T07:15Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: src/array.c
Commit date: 2021-12-29 15:50:28 +0900
Commit message: array.c: fix `mrb_ary_shift_m` initialization bug.

The `ARY_PTR` and `ARY_LEN` may be modified in `mrb_get_args`.

Diff: diff --git a/src/array.c b/src/array.c
index c100591ebe..1a95b75c93 100644
--- a/src/array.c
+++ b/src/array.c
@@ -579,18 +579,20 @@ mrb_ary_shift(mrb_state *mrb, mrb_value self)
 }
 
 static mrb_value
 mrb_ary_shift_m(mrb_state *mrb, mrb_value self)
 {
-  struct RArray *a = mrb_ary_ptr(self);
-  mrb_int len = ARY_LEN(a);
   mrb_int n;
-  mrb_value val;
 
   if (mrb_get_args(mrb, "|i", &n) == 0) {
     return mrb_ary_shift(mrb, self);
-  };
+  }
+
+  struct RArray *a = mrb_ary_ptr(self);
+  mrb_int len = ARY_LEN(a);
+  mrb_value val;
+
   ary_modify_check(mrb, a);
   if (len == 0 || n == 0) return mrb_ary_new(mrb);
   if (n < 0) mrb_raise(mrb, E_ARGUMENT_ERROR, "negative array shift");
   if (n > len) n = len;
   val = mrb_ary_new_from_values(mrb, n, ARY_PTR(a));

Vulnerable code:   struct RArray *a = mrb_ary_ptr(self);
  mrb_int len = ARY_LEN(a);
  mrb_value val;
  };
Fixed code:   }

  struct RArray *a = mrb_ary_ptr(self);
  mrb_int len = ARY_LEN(a);
  mrb_value val;
CVE-2022-0080: Heap-based Buffer Overflow (CWE-122)
value: mruby is vulnerable to Heap-based Buffer Overflow
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 9.8
Published: 2022-01-02T12:15Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: src/proc.c
Commit date: 2022-01-01 21:02:58 +0900
Commit message: proc.c: should not reference `irep` when copying failed.

It may cause broken reference count numbers.

Diff: diff --git a/src/proc.c b/src/proc.c
index e11cb7fec7..01a69fbf12 100644
--- a/src/proc.c
+++ b/src/proc.c
@@ -205,16 +205,16 @@ mrb_proc_copy(mrb_state *mrb, struct RProc *a, struct RProc *b)
 {
   if (a->body.irep) {
     /* already initialized proc */
     return;
   }
+  if (!MRB_PROC_CFUNC_P(b) && b->body.irep) {
+    mrb_irep_incref(mrb, (mrb_irep*)b->body.irep);
+  }
   a->flags = b->flags;
   a->body = b->body;
   a->upper = b->upper;
-  if (!MRB_PROC_CFUNC_P(a) && a->body.irep) {
-    mrb_irep_incref(mrb, (mrb_irep*)a->body.irep);
-  }
   a->e.env = b->e.env;
   /* a->e.target_class = a->e.target_class; */
 }
 
 static mrb_value

Vulnerable code:   if (!MRB_PROC_CFUNC_P(a) && a->body.irep) {
    mrb_irep_incref(mrb, (mrb_irep*)a->body.irep);
  }
Fixed code:   if (!MRB_PROC_CFUNC_P(b) && b->body.irep) {
    mrb_irep_incref(mrb, (mrb_irep*)b->body.irep);
  }
CVE-2022-0240: NULL Pointer Dereference (CWE-476)
value: mruby is vulnerable to NULL Pointer Dereference
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2022-01-17T14:15Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: src/class.c
Commit date: 2022-01-16 22:22:46 +0900
Commit message: class.c: add `obj->c` check before `prepare_singleton_class()`.

Diff: diff --git a/src/class.c b/src/class.c
index ec9c648e5d..8751dcaf05 100644
--- a/src/class.c
+++ b/src/class.c
@@ -355,10 +355,11 @@ setup_class(mrb_state *mrb, struct RClass *outer, struct RClass *c, mrb_sym id)
 static void
 prepare_singleton_class(mrb_state *mrb, struct RBasic *o)
 {
   struct RClass *sc, *c;
 
+  mrb_assert(o->c);
   if (o->c->tt == MRB_TT_SCLASS) return;
   sc = MRB_OBJ_ALLOC(mrb, MRB_TT_SCLASS, mrb->class_class);
   sc->flags |= MRB_FL_CLASS_IS_INHERITED;
   sc->mt = mt_new(mrb);
   sc->iv = 0;
@@ -1680,10 +1681,11 @@ mrb_singleton_class_ptr(mrb_state *mrb, mrb_value v)
     return NULL;
   default:
     break;
   }
   obj = mrb_basic_ptr(v);
+  if (obj->c == NULL) return NULL;
   prepare_singleton_class(mrb, obj);
   return obj->c;
 }
 
 MRB_API mrb_value

Fixed code:   mrb_assert(o->c);
  if (obj->c == NULL) return NULL;
CVE-2022-0326: NULL Pointer Dereference (CWE-476)
value: NULL Pointer Dereference in Homebrew mruby prior to 3.2.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2022-01-21T07:15Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: mrbgems/mruby-compiler/core/codegen.c
Commit date: 2022-01-21 15:42:51 +0900
Commit message: codegen.c: no `OP_HASHADD` required when `val` is false.

Diff: diff --git a/mrbgems/mruby-compiler/core/codegen.c b/mrbgems/mruby-compiler/core/codegen.c
index c36178c8b0..3996824a2f 100644
--- a/mrbgems/mruby-compiler/core/codegen.c
+++ b/mrbgems/mruby-compiler/core/codegen.c
@@ -1642,18 +1642,17 @@ gen_hash(codegen_scope *s, node *tree, int val, int limit)
       update = TRUE;
       len = 0;
     }
   }
   if (update) {
-    if (len > 0) {
+    if (val && len > 0) {
       pop_n(len*2+1);
       genop_2(s, OP_HASHADD, cursp(), len);
       push();
     }
     return -1;                  /* variable length */
   }
-  if (update) return -1;
   return len;
 }
 
 static void
 gen_call(codegen_scope *s, node *tree, mrb_sym name, int sp, int val, int safe)

Vulnerable code:     if (len > 0) {
  if (update) return -1;
Fixed code:     if (val && len > 0) {
CVE-2022-0481: NULL Pointer Dereference (CWE-476)
value: NULL Pointer Dereference in Homebrew mruby prior to 3.2.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2022-02-04T23:15Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: mrbgems/mruby-compiler/core/codegen.c
Commit date: 2022-02-03 10:40:05 +0900
Commit message: codegen.c: fixed a bug in hash code generation with `!val`.

Diff: diff --git a/mrbgems/mruby-compiler/core/codegen.c b/mrbgems/mruby-compiler/core/codegen.c
index 8c906fa21c..a7420a62ba 100644
--- a/mrbgems/mruby-compiler/core/codegen.c
+++ b/mrbgems/mruby-compiler/core/codegen.c
@@ -1601,11 +1601,11 @@ gen_hash(codegen_scope *s, node *tree, int val, int limit)
   int len = 0;
   mrb_bool update = FALSE;
 
   while (tree) {
     if (nint(tree->car->car->car) == NODE_KW_REST_ARGS) {
-      if (len > 0) {
+      if (val && len > 0) {
         pop_n(len*2);
         if (!update) {
           genop_2(s, OP_HASH, cursp(), len);
         }
         else {
@@ -1613,11 +1613,11 @@ gen_hash(codegen_scope *s, node *tree, int val, int limit)
           genop_2(s, OP_HASHADD, cursp(), len);
         }
         push();
       }
       codegen(s, tree->car->cdr, val);
-      if (len > 0 || update) {
+      if (val && (len > 0 || update)) {
         pop(); pop();
         genop_1(s, OP_HASHCAT, cursp());
         push();
       }
       update = TRUE;

Vulnerable code:       if (len > 0) {
      if (len > 0 || update) {
Fixed code:       if (val && len > 0) {
      if (val && (len > 0 || update)) {
CVE-2022-0525: Out-of-bounds Read (CWE-125)
value: Out-of-bounds Read in Homebrew mruby prior to 3.2.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2022-02-09T04:15Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: mrbgems/mruby-compiler/core/codegen.c
Commit date: 2022-02-08 13:11:43 +0900
Commit message: codegen.c: stack position may be wrong on assignments.

When `[]=` access includes keyword arguments.

Diff: diff --git a/mrbgems/mruby-compiler/core/codegen.c b/mrbgems/mruby-compiler/core/codegen.c
index 4a9fb9aeb0..86f88b6e64 100644
--- a/mrbgems/mruby-compiler/core/codegen.c
+++ b/mrbgems/mruby-compiler/core/codegen.c
@@ -1863,19 +1863,25 @@ gen_assignment(codegen_scope *s, node *tree, node *rhs, int sp, int val)
             n = 15;
             push();
           }
         }
         if (tree->cdr->car) {       /* keyword arguments */
+          if (n == 14) {
+            pop_n(n);
+            genop_2(s, OP_ARRAY, cursp(), n);
+            push();
+            n = 15;
+          }
           gen_hash(s, tree->cdr->car->cdr, VAL, 0);
           if (n < 14) {
             n++;
-            push();
           }
           else {
-            pop();
+            pop_n(2);
             genop_2(s, OP_ARYPUSH, cursp(), 1);
           }
+          push();
         }
       }
       if (rhs) {
         codegen(s, rhs, VAL);
         pop();

Vulnerable code:             push();
            pop();
Fixed code:           if (n == 14) {
            pop_n(n);
            genop_2(s, OP_ARRAY, cursp(), n);
            push();
            n = 15;
          }
            pop_n(2);
          push();
CVE-2022-0570: Heap-based Buffer Overflow (CWE-122)
value: Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 9.8
Published: 2022-02-14T12:15Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: mrbgems/mruby-compiler/core/codegen.c
Commit date: 2022-02-12 12:39:35 +0900
Commit message: codegen.c: fix a bug in `gen_values()`.

- Fix limit handling that fails 15 arguments method calls.
- Fix too early argument packing in arrays.

Diff: diff --git a/mrbgems/mruby-compiler/core/codegen.c b/mrbgems/mruby-compiler/core/codegen.c
index c49ea75141..b90eae3e85 100644
--- a/mrbgems/mruby-compiler/core/codegen.c
+++ b/mrbgems/mruby-compiler/core/codegen.c
@@ -1549,11 +1549,11 @@ gen_values(codegen_scope *s, node *t, int val, int limit)
   }
 
   while (t) {
     int is_splat = nint(t->car->car) == NODE_SPLAT;
 
-    if (is_splat || n > limit || cursp() >= slimit) { /* flush stack */
+    if (is_splat || cursp() >= slimit) { /* flush stack */
       pop_n(n);
       if (first) {
         if (n == 0) {
           genop_1(s, OP_LOADNIL, cursp());
         }
@@ -1588,10 +1588,15 @@ gen_values(codegen_scope *s, node *t, int val, int limit)
       pop_n(n);
       genop_2(s, OP_ARYPUSH, cursp(), n);
     }
     return -1;                  /* variable length */
   }
+  else if (n > limit) {
+    pop_n(n);
+    genop_2(s, OP_ARRAY, cursp(), n);
+    return -1;
+  }
   return n;
 }
 
 static int
 gen_hash(codegen_scope *s, node *tree, int val, int limit)

Vulnerable code:     if (is_splat || n > limit || cursp() >= slimit) { /* flush stack */
Fixed code:     if (is_splat || cursp() >= slimit) { /* flush stack */
  else if (n > limit) {
    pop_n(n);
    genop_2(s, OP_ARRAY, cursp(), n);
    return -1;
  }
CVE-2022-0614: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Use of Out-of-range Pointer Offset in Homebrew mruby prior to 3.2.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 5.5
Published: 2022-02-16T10:15Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: src/vm.c
Commit date: 2022-02-15 18:36:38 +0900
Commit message: vm.c: should check type before hash access.

Since the operand of double splat (`**`) may not be a hash, simple
assertion (previous code since d42a64e) was not enough for this case.

Diff: diff --git a/src/vm.c b/src/vm.c
index 6133cbccac..9cb50847f2 100644
--- a/src/vm.c
+++ b/src/vm.c
@@ -2764,11 +2764,11 @@ RETRY_TRY_BLOCK:
       mrb_value hash;
       int i;
       int lim = a+b*2+1;
 
       hash = regs[a];
-      mrb_assert(mrb_hash_p(hash));
+      mrb_ensure_hash_type(mrb, hash);
       for (i=a+1; i<lim; i+=2) {
         mrb_hash_set(mrb, hash, regs[i], regs[i+1]);
       }
       mrb_gc_arena_restore(mrb, ai);
       NEXT;

Vulnerable code:       mrb_assert(mrb_hash_p(hash));
Fixed code:       mrb_ensure_hash_type(mrb, hash);
CVE-2022-0623: Out-of-bounds Read (CWE-125)
value: Out-of-bounds Read in Homebrew mruby prior to 3.2.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2022-02-17T07:15Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: src/vm.c
Commit date: 2022-02-15 18:36:38 +0900
Commit message: vm.c: should check type before hash access.

Since the operand of double splat (`**`) may not be a hash, simple
assertion (previous code since d42a64e) was not enough for this case.

Diff: diff --git a/src/vm.c b/src/vm.c
index 6133cbccac..9cb50847f2 100644
--- a/src/vm.c
+++ b/src/vm.c
@@ -2764,11 +2764,11 @@ RETRY_TRY_BLOCK:
       mrb_value hash;
       int i;
       int lim = a+b*2+1;
 
       hash = regs[a];
-      mrb_assert(mrb_hash_p(hash));
+      mrb_ensure_hash_type(mrb, hash);
       for (i=a+1; i<lim; i+=2) {
         mrb_hash_set(mrb, hash, regs[i], regs[i+1]);
       }
       mrb_gc_arena_restore(mrb, ai);
       NEXT;

Vulnerable code:       mrb_assert(mrb_hash_p(hash));
Fixed code:       mrb_ensure_hash_type(mrb, hash);
CVE-2022-0630: Out-of-bounds Read (CWE-125)
value: Out-of-bounds Read in Homebrew mruby prior to 3.2.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.1
Published: 2022-02-19T14:15Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: src/vm.c
Commit date: 2022-02-15 18:36:38 +0900
Commit message: vm.c: should check type before hash access.

Since the operand of double splat (`**`) may not be a hash, simple
assertion (previous code since d42a64e) was not enough for this case.

Diff: diff --git a/src/vm.c b/src/vm.c
index 6133cbccac..9cb50847f2 100644
--- a/src/vm.c
+++ b/src/vm.c
@@ -2764,11 +2764,11 @@ RETRY_TRY_BLOCK:
       mrb_value hash;
       int i;
       int lim = a+b*2+1;
 
       hash = regs[a];
-      mrb_assert(mrb_hash_p(hash));
+      mrb_ensure_hash_type(mrb, hash);
       for (i=a+1; i<lim; i+=2) {
         mrb_hash_set(mrb, hash, regs[i], regs[i+1]);
       }
       mrb_gc_arena_restore(mrb, ai);
       NEXT;

Vulnerable code:       mrb_assert(mrb_hash_p(hash));
Fixed code:       mrb_ensure_hash_type(mrb, hash);
CVE-2022-0631: Heap-based Buffer Overflow (CWE-122)
value: Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 9.8
Published: 2022-02-18T14:15Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: src/vm.c
Commit date: 2022-02-18 14:38:07 +0900
Commit message: vm.c: packed arguments length may be zero for `send` method.

Diff: diff --git a/src/vm.c b/src/vm.c
index 9cb50847f2..aa5569503e 100644
--- a/src/vm.c
+++ b/src/vm.c
@@ -687,13 +687,15 @@ mrb_f_send(mrb_state *mrb, mrb_value self)
   }
 
   regs = mrb->c->ci->stack+1;
 
   if (n == 0) {
+  argnum_error:
     mrb_argnum_error(mrb, 0, 1, -1);
   }
   else if (n == 15) {
+    if (RARRAY_LEN(regs[0]) == 0) goto argnum_error;
     name = mrb_obj_to_sym(mrb, RARRAY_PTR(regs[0])[0]);
   }
   else {
     name = mrb_obj_to_sym(mrb, regs[0]);
   }

Fixed code:   argnum_error:
    if (RARRAY_LEN(regs[0]) == 0) goto argnum_error;
CVE-2022-0632: NULL Pointer Dereference (CWE-476)
value: NULL Pointer Dereference in Homebrew mruby prior to 3.2.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2022-02-19T14:15Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: mrbgems/mruby-compiler/core/codegen.c
Commit date: 2022-02-19 16:17:33 +0900
Commit message: codegen.c: adjust stack position for `OP_SUPER` instruction.

Diff: diff --git a/mrbgems/mruby-compiler/core/codegen.c b/mrbgems/mruby-compiler/core/codegen.c
index 20b7d5c89e5..729f5756615 100644
--- a/mrbgems/mruby-compiler/core/codegen.c
+++ b/mrbgems/mruby-compiler/core/codegen.c
@@ -2952,23 +2952,24 @@ codegen(codegen_scope *s, node *tree, int val)
         }
         /* block arguments */
         if (tree->cdr->cdr) {
           codegen(s, tree->cdr->cdr, VAL);
         }
-        else if (!s2) {/* super at top-level */
-          push();      /* no need to push block */
-        }
+        else if (s2) gen_blkmove(s, s2->ainfo, lv);
         else {
-          gen_blkmove(s, s2->ainfo, lv);
+          genop_1(s, OP_LOADNIL, cursp());
+          push();
         }
-        st++;
       }
       else {
-        if (!s2) push();
-        else gen_blkmove(s, s2->ainfo, lv);
-        st++;
+        if (s2) gen_blkmove(s, s2->ainfo, lv);
+        else {
+          genop_1(s, OP_LOADNIL, cursp());
+          push();
+        }
       }
+      st++;
       pop_n(st+1);
       genop_2(s, OP_SUPER, cursp(), n);
       if (val) push();
     }
     break;
@@ -3216,10 +3217,11 @@ codegen(codegen_scope *s, node *tree, int val)
 
       if (idx == 0) {
         codegen_error(s, "no anonymous block argument");
       }
       gen_move(s, cursp(), idx, val);
+      if (val) push();
     }
     else {
       codegen(s, tree, val);
     }
     break;

Vulnerable code:         else if (!s2) {/* super at top-level */
          push();      /* no need to push block */
        }
          gen_blkmove(s, s2->ainfo, lv);
        st++;
        if (!s2) push();
        else gen_blkmove(s, s2->ainfo, lv);
        st++;
Fixed code:         else if (s2) gen_blkmove(s, s2->ainfo, lv);
          genop_1(s, OP_LOADNIL, cursp());
          push();
        if (s2) gen_blkmove(s, s2->ainfo, lv);
        else {
          genop_1(s, OP_LOADNIL, cursp());
          push();
        }
      st++;
      if (val) push();
CVE-2022-0717: Out-of-bounds Read (CWE-125)
value: Out-of-bounds Read in GitHub repository mruby/mruby prior to 3.2.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2022-02-23T02:15Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: mrbgems/mruby-compiler/core/codegen.c
Commit date: 2022-02-22 11:06:20 +0900
Commit message: codegen.c: fix a argument generation bug in array assignment.

Diff: diff --git a/mrbgems/mruby-compiler/core/codegen.c b/mrbgems/mruby-compiler/core/codegen.c
index 729f5756615..37b1307e658 100644
--- a/mrbgems/mruby-compiler/core/codegen.c
+++ b/mrbgems/mruby-compiler/core/codegen.c
@@ -1902,12 +1902,16 @@ gen_assignment(codegen_scope *s, node *tree, node *rhs, int sp, int val)
         gen_move(s, cursp(), sp, 0);
       }
       if (val) {
         gen_move(s, top, cursp(), 1);
       }
-      if (n < 14) {
+      if (n < 15) {
         n++;
+        if (n == 15) {
+          pop_n(14);
+          genop_2(s, OP_ARRAY, cursp(), 15);
+        }
       }
       else {
         pop();
         genop_2(s, OP_ARYPUSH, cursp(), 1);
       }

Vulnerable code:       if (n < 14) {
Fixed code:       if (n < 15) {
        if (n == 15) {
          pop_n(14);
          genop_2(s, OP_ARRAY, cursp(), 15);
        }
CVE-2022-0890: NULL Pointer Dereference (CWE-476)
value: NULL Pointer Dereference in GitHub repository mruby/mruby prior to 3.2.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2022-03-10T01:15Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: mrbgems/mruby-fiber/src/fiber.c
Commit date: 2022-03-09 15:21:15 +0900
Commit message: fiber.c: should pack 15+ arguments in an array.

Diff: diff --git a/mrbgems/mruby-fiber/src/fiber.c b/mrbgems/mruby-fiber/src/fiber.c
index 0d85bedadc6..322ed36ea88 100644
--- a/mrbgems/mruby-fiber/src/fiber.c
+++ b/mrbgems/mruby-fiber/src/fiber.c
@@ -206,19 +206,26 @@ fiber_switch(mrb_state *mrb, mrb_value self, mrb_int len, const mrb_value *a, mr
     mrb_value *b, *e;
 
     if (!c->ci->proc) {
       mrb_raise(mrb, E_FIBER_ERROR, "double resume (current)");
     }
-    mrb_stack_extend(mrb, len+2); /* for receiver and (optional) block */
-    b = c->stbase+1;
-    e = b + len;
-    while (b<e) {
-      *b++ = *a++;
-    }
     if (vmexec) {
       c->ci--;                    /* pop dummy callinfo */
     }
+    if (len >= 15) {
+      mrb_stack_extend(mrb, 3);   /* for receiver, args and (optional) block */
+      c->stbase[1] = mrb_ary_new_from_values(mrb, len, a);
+      len = 15;
+    }
+    else {
+      mrb_stack_extend(mrb, len+2); /* for receiver and (optional) block */
+      b = c->stbase+1;
+      e = b + len;
+      while (b<e) {
+        *b++ = *a++;
+      }
+    }
     c->cibase->n = len;
     value = c->stbase[0] = MRB_PROC_ENV(c->cibase->proc)->stack[0];
   }
   else {
     value = fiber_result(mrb, a, len);

Vulnerable code:     mrb_stack_extend(mrb, len+2); /* for receiver and (optional) block */
    b = c->stbase+1;
    e = b + len;
    while (b<e) {
      *b++ = *a++;
    }
Fixed code:     if (len >= 15) {
      mrb_stack_extend(mrb, 3);   /* for receiver, args and (optional) block */
      c->stbase[1] = mrb_ary_new_from_values(mrb, len, a);
      len = 15;
    }
    else {
      mrb_stack_extend(mrb, len+2); /* for receiver and (optional) block */
      b = c->stbase+1;
      e = b + len;
      while (b<e) {
        *b++ = *a++;
      }
    }
CVE-2022-1106: Use After Free (CWE-416)
value: use after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 9.1
Published: 2022-03-27T14:15Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: src/vm.c
Commit date: 2022-03-26 21:06:02 +0900
Commit message: vm.c: vm.c: stack may be reallocated in functions calls; aaa28a5

`mrb_range_new()` also calls VM recursively.

Diff: diff --git a/src/vm.c b/src/vm.c
index fd17e90cc41..77edbb38fcd 100644
--- a/src/vm.c
+++ b/src/vm.c
@@ -2817,17 +2817,19 @@ RETRY_TRY_BLOCK:
       c = OP_L_METHOD;
       goto L_MAKE_LAMBDA;
     }
 
     CASE(OP_RANGE_INC, B) {
-      regs[a] = mrb_range_new(mrb, regs[a], regs[a+1], FALSE);
+      mrb_value v = mrb_range_new(mrb, regs[a], regs[a+1], FALSE);
+      regs[a] = v;
       mrb_gc_arena_restore(mrb, ai);
       NEXT;
     }
 
     CASE(OP_RANGE_EXC, B) {
-      regs[a] = mrb_range_new(mrb, regs[a], regs[a+1], TRUE);
+      mrb_value v = mrb_range_new(mrb, regs[a], regs[a+1], TRUE);
+      regs[a] = v;
       mrb_gc_arena_restore(mrb, ai);
       NEXT;
     }
 
     CASE(OP_OCLASS, B) {

Vulnerable code:       regs[a] = mrb_range_new(mrb, regs[a], regs[a+1], FALSE);
      regs[a] = mrb_range_new(mrb, regs[a], regs[a+1], TRUE);
Fixed code:       mrb_value v = mrb_range_new(mrb, regs[a], regs[a+1], FALSE);
      regs[a] = v;
      mrb_value v = mrb_range_new(mrb, regs[a], regs[a+1], TRUE);
      regs[a] = v;
CVE-2022-1201: NULL Pointer Dereference (CWE-476)
value: NULL Pointer Dereference in mrb_vm_exec with super in GitHub repository mruby/mruby prior to 3.2. This vulnerability is capable of making the mruby interpreter crash, thus affecting the availability of the system.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 6.5
Published: 2022-04-02T08:15Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: src/vm.c
Commit date: 2022-04-01 16:40:06 +0900
Commit message: vm.c: target class may be NULL.

Diff: diff --git a/src/vm.c b/src/vm.c
index 77edbb38fcd..3bb9510ec19 100644
--- a/src/vm.c
+++ b/src/vm.c
@@ -1747,11 +1747,11 @@ RETRY_TRY_BLOCK:
       if (target_class->flags & MRB_FL_CLASS_IS_PREPENDED) {
         target_class = mrb_vm_ci_target_class(ci);
       }
       else if (target_class->tt == MRB_TT_MODULE) {
         target_class = mrb_vm_ci_target_class(ci);
-        if (target_class->tt != MRB_TT_ICLASS) {
+        if (!target_class || target_class->tt != MRB_TT_ICLASS) {
           goto super_typeerror;
         }
       }
       recv = regs[0];
       if (!mrb_obj_is_kind_of(mrb, recv, target_class)) {

Vulnerable code:         if (target_class->tt != MRB_TT_ICLASS) {
Fixed code:         if (!target_class || target_class->tt != MRB_TT_ICLASS) {
CVE-2022-1212: Use After Free (CWE-416)
value: Use-After-Free in str_escape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 9.8
Published: 2022-04-05T04:15Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: src/vm.c
Commit date: 2022-04-04 12:26:52 +0900
Commit message: vm.c: create break object before clearing GC arena.

Otherwise it possibly cause use-after-free.

Diff: diff --git a/src/vm.c b/src/vm.c
index 3796f417381..6d61386b31d 100644
--- a/src/vm.c
+++ b/src/vm.c
@@ -2266,13 +2266,13 @@ RETRY_TRY_BLOCK:
             c->prev = NULL;
             ci = mrb->c->ci;
           }
           if (ci->cci > CINFO_NONE) {
             ci = cipop(mrb);
+            mrb->exc = (struct RObject*)break_new(mrb, RBREAK_TAG_BREAK, proc, v);
             mrb_gc_arena_restore(mrb, ai);
             mrb->c->vmexec = FALSE;
-            mrb->exc = (struct RObject*)break_new(mrb, RBREAK_TAG_BREAK, proc, v);
             mrb->jmp = prev_jmp;
             MRB_THROW(prev_jmp);
           }
           if (FALSE) {
             struct RBreak *brk;

Vulnerable code:             mrb->exc = (struct RObject*)break_new(mrb, RBREAK_TAG_BREAK, proc, v);
Fixed code:             mrb->exc = (struct RObject*)break_new(mrb, RBREAK_TAG_BREAK, proc, v);
CVE-2022-1276: Out-of-bounds Read (CWE-125)
value: Out-of-bounds Read in mrb_get_args in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2022-04-10T10:15Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: mrbgems/mruby-compiler/core/codegen.c
Commit date: 2022-04-09 17:16:12 +0900
Commit message: codegen.c: need to pack argument when `n==13` too.

Because we have extra 2 arguments coming (kw and rhs).

Diff: diff --git a/mrbgems/mruby-compiler/core/codegen.c b/mrbgems/mruby-compiler/core/codegen.c
index 8f7b5b0133a..e222094be3d 100644
--- a/mrbgems/mruby-compiler/core/codegen.c
+++ b/mrbgems/mruby-compiler/core/codegen.c
@@ -1903,11 +1903,11 @@ gen_assignment(codegen_scope *s, node *tree, node *rhs, int sp, int val)
             n = 15;
             push();
           }
         }
         if (tree->cdr->car) {       /* keyword arguments */
-          if (n == 14) {
+          if (n == 13 || n == 14) {
             pop_n(n);
             genop_2(s, OP_ARRAY, cursp(), n);
             push();
             n = 15;
           }

Vulnerable code:           if (n == 14) {
Fixed code:           if (n == 13 || n == 14) {
CVE-2022-1286: Out-of-bounds Write (CWE-787)
value: heap-buffer-overflow in mrb_vm_exec in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2022-04-10T11:15Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: src/class.c
Commit date: 2022-04-09 17:16:12 +0900
Commit message: class.c: clear method cache after `remove_method`.

Diff: diff --git a/src/class.c b/src/class.c
index 37fc4e68a44..68a0ff08431 100644
--- a/src/class.c
+++ b/src/class.c
@@ -2359,11 +2359,14 @@ mrb_remove_method(mrb_state *mrb, struct RClass *c, mrb_sym mid)
   mt_tbl *h;
 
   MRB_CLASS_ORIGIN(c);
   h = c->mt;
 
-  if (h && mt_del(mrb, h, mid)) return;
+  if (h && mt_del(mrb, h, mid)) {
+    mrb_mc_clear_by_class(mrb, c);
+    return;
+  }
   mrb_name_error(mrb, mid, "method '%n' not defined in %C", mid, c);
 }
 
 static mrb_value
 mrb_mod_undef(mrb_state *mrb, mrb_value mod)

Vulnerable code:   if (h && mt_del(mrb, h, mid)) return;
Fixed code:   if (h && mt_del(mrb, h, mid)) {
    mrb_mc_clear_by_class(mrb, c);
    return;
  }
CVE-2022-1427: Out-of-bounds Read (CWE-125)
value: Out-of-bounds Read in mrb_obj_is_kind_of in in GitHub repository mruby/mruby prior to 3.2. # Impact: Possible arbitrary code execution if being exploited.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2022-04-23T00:15Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: src/vm.c
Commit date: 2022-04-22 08:32:18 +0900
Commit message: vm.c: check if target_class is NULL (when prepended).

Diff: diff --git a/src/vm.c b/src/vm.c
index 5013c877d43..aa043b06ae9 100644
--- a/src/vm.c
+++ b/src/vm.c
@@ -1748,14 +1748,11 @@ RETRY_TRY_BLOCK:
       if (mid == 0 || !target_class) {
         mrb_value exc = mrb_exc_new_lit(mrb, E_NOMETHOD_ERROR, "super called outside of method");
         mrb_exc_set(mrb, exc);
         goto L_RAISE;
       }
-      if (target_class->flags & MRB_FL_CLASS_IS_PREPENDED) {
-        target_class = mrb_vm_ci_target_class(ci);
-      }
-      else if (target_class->tt == MRB_TT_MODULE) {
+      if ((target_class->flags & MRB_FL_CLASS_IS_PREPENDED) || target_class->tt == MRB_TT_MODULE) {
         target_class = mrb_vm_ci_target_class(ci);
         if (!target_class || target_class->tt != MRB_TT_ICLASS) {
           goto super_typeerror;
         }
       }

Vulnerable code:       if (target_class->flags & MRB_FL_CLASS_IS_PREPENDED) {
        target_class = mrb_vm_ci_target_class(ci);
      }
      else if (target_class->tt == MRB_TT_MODULE) {
Fixed code:       if ((target_class->flags & MRB_FL_CLASS_IS_PREPENDED) || target_class->tt == MRB_TT_MODULE) {
CVE-2022-1934: Use After Free (CWE-416)
value: Use After Free in GitHub repository mruby/mruby prior to 3.2.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.8
Published: 2022-05-31T03:15Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: src/vm.c
Commit date: 2022-05-30 01:18:15 +0900
Commit message: vm.c (hash_new_from_regs): stack may be reallocated.

Diff: diff --git a/src/vm.c b/src/vm.c
index b04c9d7e58b..09e557dc8e7 100644
--- a/src/vm.c
+++ b/src/vm.c
@@ -1157,31 +1157,33 @@ check_target_class(mrb_state *mrb)
     mrb_exc_set(mrb, exc);
   }
   return target;
 }
 
+#define regs (mrb->c->ci->stack)
+
 static mrb_value
-hash_new_from_values(mrb_state *mrb, mrb_int argc, mrb_value *regs)
+hash_new_from_regs(mrb_state *mrb, mrb_int argc, mrb_int idx)
 {
   mrb_value hash = mrb_hash_new_capa(mrb, argc);
   while (argc--) {
-    mrb_hash_set(mrb, hash, regs[0], regs[1]);
-    regs += 2;
+    mrb_hash_set(mrb, hash, regs[idx+0], regs[idx+1]);
+    idx += 2;
   }
   return hash;
 }
 
-#define ARGUMENT_NORMALIZE(arg_base, arg_info, insn) do { \
+#define ARGUMENT_NORMALIZE(arg_base, arg_info, insn) do {       \
   int n = *(arg_info)&0xf; \
   int nk = (*(arg_info)>>4)&0xf; \
   mrb_int bidx = (arg_base) + mrb_bidx(*(arg_info)); \
   if (nk == CALL_MAXARGS) { \
     mrb_ensure_hash_type(mrb, regs[(arg_base)+(n==CALL_MAXARGS?1:n)+1]); \
   } \
   else if (nk > 0) {  /* pack keyword arguments */ \
     mrb_int kidx = (arg_base)+(n==CALL_MAXARGS?1:n)+1; \
-    mrb_value kdict = hash_new_from_values(mrb, nk, regs+kidx); \
+    mrb_value kdict = hash_new_from_regs(mrb, nk, kidx); \
     regs[kidx] = kdict; \
     nk = CALL_MAXARGS; \
     *(arg_info) = n | (nk<<4); \
   } \
   \
@@ -1240,11 +1242,10 @@ RETRY_TRY_BLOCK:
     goto L_RAISE;
   }
   mrb->jmp = &c_jmp;
   mrb_vm_ci_proc_set(mrb->c->ci, proc);
 
-#define regs (mrb->c->ci->stack)
   INIT_DISPATCH {
     CASE(OP_NOP, Z) {
       /* do nothing */
       NEXT;
     }

Vulnerable code: hash_new_from_values(mrb_state *mrb, mrb_int argc, mrb_value *regs)
    mrb_hash_set(mrb, hash, regs[0], regs[1]);
    regs += 2;
#define ARGUMENT_NORMALIZE(arg_base, arg_info, insn) do { \
    mrb_value kdict = hash_new_from_values(mrb, nk, regs+kidx); \
#define regs (mrb->c->ci->stack)
Fixed code: #define regs (mrb->c->ci->stack)

hash_new_from_regs(mrb_state *mrb, mrb_int argc, mrb_int idx)
    mrb_hash_set(mrb, hash, regs[idx+0], regs[idx+1]);
    idx += 2;
#define ARGUMENT_NORMALIZE(arg_base, arg_info, insn) do {       \
    mrb_value kdict = hash_new_from_regs(mrb, nk, kidx); \
CVE-2018-6354: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: templates/forms/thanks.html in Formspree before 2018-01-23 allows XSS related to the _next parameter.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-01-27T15:29Z
Repository: https://github.com/formspree/formspree
Language: HTML
Files changed: formspree/templates/forms/thanks.html
Commit date: 2018-01-23 20:21:06 -0600
Commit message: Remove XSS opportunity

Diff: diff --git a/formspree/templates/forms/thanks.html b/formspree/templates/forms/thanks.html
index dd9f8db..0a2841a 100644
--- a/formspree/templates/forms/thanks.html
+++ b/formspree/templates/forms/thanks.html
@@ -9,12 +9,9 @@
     </div>
 
     <div class="container">
       <div class="col-1-1">
         <h1>Form submitted successfully</h1>
-        {% if request.args.get('next') %}
-          <a href="{{ request.args.get('next') }}" class="button" style="margin-top: 1em;">Return to original site</a>
-        {% endif %}
       </div>
     </div>
   </div>
 {% endblock base %}

Vulnerable code:         {% if request.args.get('next') %}
          <a href="{{ request.args.get('next') }}" class="button" style="margin-top: 1em;">Return to original site</a>
        {% endif %}
CVE-2023-2109: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-04-17T01:15Z
Repository: https://github.com/chatwoot/chatwoot
Language: JavaScript
Files changed: app/javascript/sdk/bubbleHelpers.js
Commit date: 2023-02-10 17:20:15 +0530
Commit message: fix: use innerText instead of innerHTML (#6431)

* refactor: use inner text instead of inner html

* refactor: use innerText instead of innerHTML
Diff: diff --git a/app/javascript/sdk/bubbleHelpers.js b/app/javascript/sdk/bubbleHelpers.js
index f2da5e74f5..54401a82ca 100644
--- a/app/javascript/sdk/bubbleHelpers.js
+++ b/app/javascript/sdk/bubbleHelpers.js
@@ -14,11 +14,11 @@ export const closeBubble = document.createElement('button');
 export const notificationBubble = document.createElement('span');
 
 export const setBubbleText = bubbleText => {
   if (isExpandedView(window.$chatwoot.type)) {
     const textNode = document.getElementById('woot-widget--expanded__text');
-    textNode.innerHTML = bubbleText;
+    textNode.innerText = bubbleText;
   }
 };
 
 export const createBubbleIcon = ({ className, path, target }) => {
   let bubbleClassName = `${className} woot-elements--${window.$chatwoot.position}`;
@@ -44,11 +44,11 @@ export const createBubbleIcon = ({ className, path, target }) => {
   target.appendChild(bubbleIcon);
 
   if (isExpandedView(window.$chatwoot.type)) {
     const textNode = document.createElement('div');
     textNode.id = 'woot-widget--expanded__text';
-    textNode.innerHTML = '';
+    textNode.innerText = '';
     target.appendChild(textNode);
     bubbleClassName += ' woot-widget--expanded';
   }
 
   target.className = bubbleClassName;

Vulnerable code:     textNode.innerHTML = bubbleText;
    textNode.innerHTML = '';
Fixed code:     textNode.innerText = bubbleText;
    textNode.innerText = '';
CVE-2023-2251: Uncaught Exception (CWE-248)
value: Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5.
CWE description: An exception is thrown from a function, but it is not caught.
CVSS v3 base score: 7.5
Published: 2023-04-24T15:15Z
Repository: https://github.com/eemeli/yaml
Language: JavaScript
Files changed: src/errors.ts, tests/doc/errors.js
Commit date: 2023-04-24 15:50:03 +0300
Commit message: fix: Corner case failure in error pretty-printer

Diff: diff --git a/src/errors.ts b/src/errors.ts
index a1db8a9..019851f 100644
--- a/src/errors.ts
+++ b/src/errors.ts
@@ -89,11 +89,11 @@ export const prettifyError =
 
     if (/[^ ]/.test(lineStr)) {
       let count = 1
       const end = error.linePos[1]
       if (end && end.line === line && end.col > col) {
-        count = Math.min(end.col - col, 80 - ci)
+        count = Math.max(1, Math.min(end.col - col, 80 - ci))
       }
       const pointer = ' '.repeat(ci) + '^'.repeat(count)
       error.message += `:\n\n${lineStr}\n${pointer}\n`
     }
   }
diff --git a/tests/doc/errors.js b/tests/doc/errors.js
index 00fe35a..71310b1 100644
--- a/tests/doc/errors.js
+++ b/tests/doc/errors.js
@@ -339,10 +339,16 @@ describe('pretty errors', () => {
   test('pretty warnings', () => {
     const src = '%FOO\n---bar\n'
     const doc = YAML.parseDocument(src, { prettyErrors: true })
     expect(doc.warnings).toMatchObject([{ name: 'YAMLWarning' }])
   })
+
+  test('repeated CR', () => {
+    const src = '[' + '\r'.repeat(80)
+    const doc = YAML.parseDocument(src, { prettyErrors: true })
+    expect(doc.errors[0]).not.toHaveProperty('source')
+  })
 })
 
 describe('tags on invalid nodes', () => {
   test('!!map on scalar', () => {
     const doc = YAML.parseDocument('!!map foo')

Vulnerable code:         count = Math.min(end.col - col, 80 - ci)
Fixed code:         count = Math.max(1, Math.min(end.col - col, 80 - ci))

  test('repeated CR', () => {
    const src = '[' + '\r'.repeat(80)
    const doc = YAML.parseDocument(src, { prettyErrors: true })
    expect(doc.errors[0]).not.toHaveProperty('source')
  })
CVE-2014-4978: Improper Link Resolution Before File Access ('Link Following') (CWE-59)
value: The rs_filter_graph function in librawstudio/rs-filter.c in rawstudio might allow local users to truncate arbitrary files via a symlink attack on (1) /tmp/rs-filter-graph.png or (2) /tmp/rs-filter-graph.
CWE description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVSS v3 base score: 5.5
Published: 2017-12-29T22:29Z
Repository: https://github.com/rawstudio/rawstudio
Language: C
Files changed: librawstudio/rs-filter.c
Commit date: 2014-12-03 08:01:28 +0100
Commit message: Fixes insecure use of temporary file (CVE-2014-4978).

Diff: diff --git a/librawstudio/rs-filter.c b/librawstudio/rs-filter.c
index 4913c13d..352b23c5 100644
--- a/librawstudio/rs-filter.c
+++ b/librawstudio/rs-filter.c
@@ -770,19 +770,34 @@ rs_filter_graph_helper(GString *str, RSFilter *filter)
  */
 void
 rs_filter_graph(RSFilter *filter)
 {
 	g_return_if_fail(RS_IS_FILTER(filter));
+	gchar *dot_filename;
+	gchar *png_filename;
+	gchar *command_line;
 	GString *str = g_string_new("digraph G {\n");
 
 	rs_filter_graph_helper(str, filter);
 
 	g_string_append_printf(str, "}\n");
-	g_file_set_contents("/tmp/rs-filter-graph", str->str, str->len, NULL);
 
-	if (0 != system("dot -Tpng >/tmp/rs-filter-graph.png </tmp/rs-filter-graph"))
+	/* Here we would like to use g_mkdtemp(), but due to a bug in upstream, that's impossible */
+	dot_filename = g_strdup_printf("/tmp/rs-filter-graph.%u", g_random_int());
+	png_filename = g_strdup_printf("%s.%u.png", dot_filename, g_random_int());
+
+	g_file_set_contents(dot_filename, str->str, str->len, NULL);
+
+	command_line = g_strdup_printf("dot -Tpng >%s <%s", png_filename, dot_filename);
+	if (0 != system(command_line))
 		g_warning("Calling dot failed");
-	if (0 != system("gnome-open /tmp/rs-filter-graph.png"))
+	g_free(command_line);
+
+	command_line = g_strdup_printf("gnome-open %s", png_filename);
+	if (0 != system(command_line))
 		g_warning("Calling gnome-open failed.");
+	g_free(command_line);
 
+	g_free(dot_filename);
+	g_free(png_filename);
 	g_string_free(str, TRUE);
 }

Vulnerable code: 	g_file_set_contents("/tmp/rs-filter-graph", str->str, str->len, NULL);
	if (0 != system("dot -Tpng >/tmp/rs-filter-graph.png </tmp/rs-filter-graph"))
	if (0 != system("gnome-open /tmp/rs-filter-graph.png"))
Fixed code: 	gchar *dot_filename;
	gchar *png_filename;
	gchar *command_line;
	/* Here we would like to use g_mkdtemp(), but due to a bug in upstream, that's impossible */
	dot_filename = g_strdup_printf("/tmp/rs-filter-graph.%u", g_random_int());
	png_filename = g_strdup_printf("%s.%u.png", dot_filename, g_random_int());

	g_file_set_contents(dot_filename, str->str, str->len, NULL);

	command_line = g_strdup_printf("dot -Tpng >%s <%s", png_filename, dot_filename);
	if (0 != system(command_line))
	g_free(command_line);

	command_line = g_strdup_printf("gnome-open %s", png_filename);
	if (0 != system(command_line))
	g_free(command_line);
	g_free(dot_filename);
	g_free(png_filename);
CVE-2015-3885: Numeric Errors (CWE-189)
value: Integer overflow in the ljpeg_start function in dcraw 7.00 and earlier allows remote attackers to cause a denial of service (crash) via a crafted image, which triggers a buffer overflow, related to the len variable.
CWE description: Weaknesses in this category are related to improper calculation or conversion of numbers.
Published: 2015-05-19T18:59Z
Repository: https://github.com/rawstudio/rawstudio
Language: C++
Files changed: plugins/load-dcraw/dcraw.cc
Commit date: 2015-05-11 14:59:52 +0200
Commit message: Avoid overflow in ljpeg_start().
Diff: diff --git a/plugins/load-dcraw/dcraw.cc b/plugins/load-dcraw/dcraw.cc
index 8ad088cd..b1c4b10a 100644
--- a/plugins/load-dcraw/dcraw.cc
+++ b/plugins/load-dcraw/dcraw.cc
@@ -888,11 +888,12 @@ struct jhead {
   ushort *huff[6], *free[4], *row;
 };
 
 int CLASS ljpeg_start (struct jhead *jh, int info_only)
 {
-  int c, tag, len;
+  int c, tag;
+  ushort len;
   uchar data[0x10000];
   const uchar *dp;
 
   memset (jh, 0, sizeof *jh);
   jh->restart = INT_MAX;

Vulnerable code:   int c, tag, len;
Fixed code:   int c, tag;
  ushort len;
CVE-2024-31580: Insufficient Information (NVD-CWE-noinfo)
value: PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-17T19:15Z
Repository: https://github.com/pytorch/pytorch
Language: C++
Files changed: torch/csrc/jit/runtime/vararg_functions.cpp
Commit date: 2023-10-03 18:48:12 +0000
Commit message: [fuzzing result][fuzz_torch_jit_lite_interpreter] read-heap-buffer-overflow-far-from-bounds (size 4) in c10::IValue::IValue() (#110441)

Summary: This diff fixes a heap underflow found by fuzzing in torch/csrc/jit/runtime/vararg_functions.cpp

Test Plan:
CI and
```
arc lionhead crash reproduce 1753074381791061
```
doesn't crash anymore.

Differential Revision: D49537535

Pull Request resolved: https://github.com/pytorch/pytorch/pull/110441
Approved by: https://github.com/Skylion007

Diff: diff --git a/torch/csrc/jit/runtime/vararg_functions.cpp b/torch/csrc/jit/runtime/vararg_functions.cpp
index 69e2c0fc179..bb28b61fe7e 100644
--- a/torch/csrc/jit/runtime/vararg_functions.cpp
+++ b/torch/csrc/jit/runtime/vararg_functions.cpp
@@ -265,10 +265,13 @@ void listUnpack(Stack& stack, size_t num_outputs) {
       list.size());
   stack.insert(stack.end(), list.begin(), list.end());
 }
 
 void tupleConstruct(Stack& stack, size_t num_inputs) {
+  if (num_inputs > stack.size()) {
+    TORCH_CHECK(false, "Invalid number of inputs: ", num_inputs);
+  }
   switch (num_inputs) {
     case 0:
       stack.emplace_back(c10::ivalue::Tuple::create());
       break;
     case 1:

Fixed code:   if (num_inputs > stack.size()) {
    TORCH_CHECK(false, "Invalid number of inputs: ", num_inputs);
  }