Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-4751: Heap-based Buffer Overflow (CWE-122)
value: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1331.
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 7.8
Published: 2023-09-03T19:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/buffer.c, src/testdir/test_visual.vim, src/version.c
Commit date: 2023-02-20 14:35:20 +0000
Commit message: patch 9.0.1331: illegal memory access when using :ball in Visual mode

Problem:    Illegal memory access when using :ball in Visual mode.
Solution:   Stop Visual mode when using :ball. (Pavel Mayorov, closes #11923)

Diff: diff --git a/src/buffer.c b/src/buffer.c
index cb7bdf445dee..ff35729fb929 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -5400,10 +5400,14 @@ ex_buffer_all(exarg_T *eap)
     if (eap->cmdidx == CMD_unhide || eap->cmdidx == CMD_sunhide)
 	all = FALSE;
     else
 	all = TRUE;
 
+    // Stop Visual mode, the cursor and "VIsual" may very well be invalid after
+    // switching to another buffer.
+    reset_VIsual_and_resel();
+
     setpcmark();
 
 #ifdef FEAT_GUI
     need_mouse_correct = TRUE;
 #endif
diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
index 295e16f93d9d..f152e7b79ba8 100644
--- a/src/testdir/test_visual.vim
+++ b/src/testdir/test_visual.vim
@@ -1532,6 +1532,27 @@ func Test_switch_buffer_ends_visual_mode()
   set virtualedit=
   bwipe!
   exe 'bwipe!' buf2
 endfunc
 
+" Check fix for the heap-based buffer overflow bug found in the function
+" utfc_ptr2len and reported at
+" https://huntr.dev/bounties/ae933869-a1ec-402a-bbea-d51764c6618e
+func Test_heap_buffer_overflow()
+  enew
+  set updatecount=0
+
+  norm R0
+  split other
+  norm R000
+  exe "norm \<C-V>l"
+  ball
+  call assert_equal(getpos("."), getpos("v"))
+  call assert_equal('n', mode())
+  norm zW
+
+  %bwipe!
+  set updatecount&
+endfunc
+
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index 63fd78792326..4c1282327573 100644
--- a/src/version.c
+++ b/src/version.c
@@ -693,10 +693,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1331,
 /**/
     1330,
 /**/
     1329,
 /**/

Fixed code:     // Stop Visual mode, the cursor and "VIsual" may very well be invalid after
    // switching to another buffer.
    reset_VIsual_and_resel();

" Check fix for the heap-based buffer overflow bug found in the function
" utfc_ptr2len and reported at
" https://huntr.dev/bounties/ae933869-a1ec-402a-bbea-d51764c6618e
func Test_heap_buffer_overflow()
  enew
  set updatecount=0

  norm R0
  split other
  norm R000
  exe "norm \<C-V>l"
  ball
  call assert_equal(getpos("."), getpos("v"))
  call assert_equal('n', mode())
  norm zW

  %bwipe!
  set updatecount&
endfunc


/**/
    1331,
CVE-2023-48234: Integer Overflow or Wraparound (CWE-190)
value: Vim is an open source command line text editor. When getting the count for a normal mode z command, it may overflow for large counts given. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `58f9befca1` which has been included in release version 9.0.2109. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 4.3
Published: 2023-11-16T23:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/normal.c, src/testdir/test_normal.vim, src/version.c
Commit date: 2023-11-16 22:04:37 +0100
Commit message: patch 9.0.2109: [security]: overflow in nv_z_get_count

Problem:  [security]: overflow in nv_z_get_count
Solution: break out, if count is too large

When getting the count for a normal z command, it may overflow for large
counts given. So verify, that we can safely store the result in a long.

Signed-off-by: Christian Brabandt <cb@256bit.org>

Diff: diff --git a/src/normal.c b/src/normal.c
index a06d61e6fce7..16b4b4506932 100644
--- a/src/normal.c
+++ b/src/normal.c
@@ -2560,11 +2560,18 @@ nv_z_get_count(cmdarg_T *cap, int *nchar_arg)
 	(void)add_to_showcmd(nchar);
 
 	if (nchar == K_DEL || nchar == K_KDEL)
 	    n /= 10;
 	else if (VIM_ISDIGIT(nchar))
+	{
+	    if (n > LONG_MAX / 10)
+	    {
+		clearopbeep(cap->oap);
+		break;
+	    }
 	    n = n * 10 + (nchar - '0');
+	}
 	else if (nchar == CAR)
 	{
 #ifdef FEAT_GUI
 	    need_mouse_correct = TRUE;
 #endif
diff --git a/src/testdir/test_normal.vim b/src/testdir/test_normal.vim
index c7d37f066f20..6b889f46b3dd 100644
--- a/src/testdir/test_normal.vim
+++ b/src/testdir/test_normal.vim
@@ -4157,6 +4157,11 @@ func Test_normal33_g_cmd_nonblank()
   exe "normal 0g\<kEnd>"
   call assert_equal(11, col('.'))
   bw!
 endfunc
 
+func Test_normal34_zet_large()
+  " shouldn't cause overflow
+  norm! z9765405999999999999
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index 16db8f231289..2f82473f59be 100644
--- a/src/version.c
+++ b/src/version.c
@@ -702,10 +702,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    2109,
 /**/
     2108,
 /**/
     2107,
 /**/

Fixed code: 	{
	    if (n > LONG_MAX / 10)
	    {
		clearopbeep(cap->oap);
		break;
	    }
	}
func Test_normal34_zet_large()
  " shouldn't cause overflow
  norm! z9765405999999999999
endfunc

/**/
    2109,
CVE-2023-48235: Integer Overflow or Wraparound (CWE-190)
value: Vim is an open source command line text editor. When parsing relative ex addresses one may unintentionally cause an
overflow. Ironically this happens in the existing overflow check, because the line number becomes negative and LONG_MAX - lnum will cause the overflow. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `060623e` which has been included in release version 9.0.2110. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 4.3
Published: 2023-11-16T23:15Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/ex_docmd.c, src/testdir/test_excmd.vim, src/version.c
Commit date: 2023-11-16 22:04:38 +0100
Commit message: patch 9.0.2110: [security]: overflow in ex address parsing

Problem:  [security]: overflow in ex address parsing
Solution: Verify that lnum is positive, before substracting from
          LONG_MAX

[security]: overflow in ex address parsing

When parsing relative ex addresses one may unintentionally cause an
overflow (because LONG_MAX - lnum will overflow for negative addresses).

So verify that lnum is actually positive before doing the overflow
check.

Signed-off-by: Christian Brabandt <cb@256bit.org>

Diff: diff --git a/src/ex_docmd.c b/src/ex_docmd.c
index 06837ac92c55..01d411a632cc 100644
--- a/src/ex_docmd.c
+++ b/src/ex_docmd.c
@@ -4642,11 +4642,11 @@ get_address(
 #endif
 		if (i == '-')
 		    lnum -= n;
 		else
 		{
-		    if (n >= LONG_MAX - lnum)
+		    if (lnum >= 0 && n >= LONG_MAX - lnum)
 		    {
 			emsg(_(e_line_number_out_of_range));
 			goto error;
 		    }
 		    lnum += n;
diff --git a/src/testdir/test_excmd.vim b/src/testdir/test_excmd.vim
index 3637351f636c..47fc26726d5e 100644
--- a/src/testdir/test_excmd.vim
+++ b/src/testdir/test_excmd.vim
@@ -722,7 +722,11 @@ func Test_write_after_rename()
   write
 
   bwipe!
 endfunc
 
+" catch address lines overflow
+func Test_ex_address_range_overflow()
+  call assert_fails(':--+foobar', 'E492:')
+endfunc
 
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index 2f82473f59be..86fa528c8af2 100644
--- a/src/version.c
+++ b/src/version.c
@@ -702,10 +702,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    2110,
 /**/
     2109,
 /**/
     2108,
 /**/

Vulnerable code: 		    if (n >= LONG_MAX - lnum)
Fixed code: 		    if (lnum >= 0 && n >= LONG_MAX - lnum)
" catch address lines overflow
func Test_ex_address_range_overflow()
  call assert_fails(':--+foobar', 'E492:')
endfunc
/**/
    2110,
CVE-2016-15016: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in mrtnmtth joomla_mod_einsatz_stats up to 0.2. It has been classified as critical. This affects the function getStatsByType of the file helper.php. The manipulation of the argument year leads to sql injection. Upgrading to version 0.3 is able to address this issue. The identifier of the patch is 27c1b443cff45c81d9d7d926a74c76f8b6ffc6cb. It is recommended to upgrade the affected component. The identifier VDB-217653 was assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-08T18:15Z
Repository: https://github.com/mrtnmtth/joomla_mod_einsatz_stats
Language: PHP
Files changed: helper.php
Commit date: 2016-01-30 14:59:28 +0100
Commit message: prevent SQL-injection

Diff: diff --git a/helper.php b/helper.php
index d738af8..b456c99 100755
--- a/helper.php
+++ b/helper.php
@@ -18,21 +18,21 @@ class modEinsatzStatsHelper {
 	public static function getStatsByType($year) {
 		$latest = substr(self::executeQuery(self::$qLatestTimestamp), 0, 4);
 		if (($year > $latest) or !(ctype_digit($year)))
 			$year = $latest;
 
+		$db = JFactory::getDbo();
 		$query =
 			'SELECT arten.title AS label,
 				count(data1) AS value,
 				arten.marker AS color
 			FROM #__eiko_einsatzberichte AS berichte
 			INNER JOIN #__eiko_einsatzarten AS arten
 			ON berichte.data1=arten.id
-			WHERE berichte.state=1 AND berichte.date1 LIKE \''.$year.'%\'
+			WHERE berichte.state=1 AND berichte.date1 LIKE '.$db->quote($year.'%').'
 			GROUP BY data1
 			ORDER BY arten.ordering;';
-			//TODO mucho importante: Prevent SQL injection
 		$result = self::executeQuery($query, 1);
 		foreach ($result as $i) {
 			$i->highlight = $i->color;
 			//chart.js needs values as integers
 			$i->value = intval($i->value);
@@ -41,11 +41,12 @@ class modEinsatzStatsHelper {
 	}
 
 	public static function getAjax() {
 		// get data from Ajax request
 		$input = JFactory::getApplication()->input;
-		$data = $input->get('data');
+		// only allow unsigned integers
+		$data = $input->get('data', date('Y'), 'UINT');
 
 		return json_encode(self::getStatsByType($data));
 	}
 
 	// All the SQL queries

Vulnerable code: 			WHERE berichte.state=1 AND berichte.date1 LIKE \''.$year.'%\'
			//TODO mucho importante: Prevent SQL injection
		$data = $input->get('data');
Fixed code: 		$db = JFactory::getDbo();
			WHERE berichte.state=1 AND berichte.date1 LIKE '.$db->quote($year.'%').'
		// only allow unsigned integers
		$data = $input->get('data', date('Y'), 'UINT');
CVE-2022-4514: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, was found in Opencaching Deutschland oc-server3. Affected is an unknown function of the file htdocs/lang/de/ocstyle/varset.inc.php. The manipulation of the argument varvalue leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 4bdd6a0e7b7760cea03b91812cbb80d7b16e3b5f. It is recommended to apply a patch to fix this issue. VDB-215886 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-15T20:15Z
Repository: https://github.com/OpencachingDeutschland/oc-server3
Language: Unknown
Commit date: 2022-12-12 14:33:38 +0100
Commit message: Merge pull request #902 from sdennler/fix/open-bug-bounty-issues-2

Fix XSS from open bug bounty from slack message 01
CVE-2022-4585: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic has been found in Opencaching Deutschland oc-server3. This affects an unknown part of the file htdocs/templates2/ocstyle/start.tpl of the component Cookie Handler. The manipulation of the argument usercountryCode leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is c720f2777a452186c67ef30db3679dd409556544. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216171.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-17T13:15Z
Repository: https://github.com/OpencachingDeutschland/oc-server3
Language: PHP
Files changed: htdocs/lib2/common.inc.php, htdocs/templates2/ocstyle/start.tpl
Commit date: 2022-09-04 21:14:51 +0200
Commit message: Fix XSS on home page (OBB-602216)
Do not store totaly invalid countries in cookie in the first place

Diff: diff --git a/htdocs/lib2/common.inc.php b/htdocs/lib2/common.inc.php
index 373efd7e..7dd7078c 100644
--- a/htdocs/lib2/common.inc.php
+++ b/htdocs/lib2/common.inc.php
@@ -268,11 +268,11 @@ function set_language(): void
 
 function set_usercountry(): void
 {
     global $cookie;
 
-    if (isset($_REQUEST['usercountry'])) {
+    if (preg_match('/^[a-z]{2}$/i', $_REQUEST['usercountry'] ?? '')) {
         $cookie->set('usercountry', $_REQUEST['usercountry']);
     }
 }
 
 function set_timezone(): void
diff --git a/htdocs/templates2/ocstyle/start.tpl b/htdocs/templates2/ocstyle/start.tpl
index 7a0a6f04..4be56478 100644
--- a/htdocs/templates2/ocstyle/start.tpl
+++ b/htdocs/templates2/ocstyle/start.tpl
@@ -125,11 +125,11 @@
     {elseif $section == 'newcaches'}
         <div class="content2-container bg-blue02">
             <p class="content-title-noshade-size3">
                 <img src="resource2/{$opt.template.style}/images/misc/22x22-traditional.png" style="margin-right: 10px;"
                      width="22" height="22" alt=""/>
-                <a href="newcaches.php?country={$usercountryCode}"
+                <a href="newcaches.php?country={$usercountryCode|escape}"
                    style="color:rgb(88,144,168); text-decoration: none;">{t 1=$usercountry|escape}Newest caches in %1{/t}</a>
                 &nbsp; <span class="content-title-link">[<a href="newcaches.php">{t}more{/t}...</a>]</span>
             </p>
         </div>
         <p style="line-height: 1.6em;">

Vulnerable code:     if (isset($_REQUEST['usercountry'])) {
                <a href="newcaches.php?country={$usercountryCode}"
Fixed code:     if (preg_match('/^[a-z]{2}$/i', $_REQUEST['usercountry'] ?? '')) {
                <a href="newcaches.php?country={$usercountryCode|escape}"
CVE-2022-4586: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic was found in Opencaching Deutschland oc-server3. This vulnerability affects unknown code of the file htdocs/templates2/ocstyle/cachelists.tpl of the component Cachelist Handler. The manipulation of the argument name_filter/by_filter leads to cross site scripting. The attack can be initiated remotely. The name of the patch is a9f79c7da78cd24a7ef1d298e6bc86006972ea73. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216172.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-17T13:15Z
Repository: https://github.com/OpencachingDeutschland/oc-server3
Language: Other
Files changed: htdocs/templates2/ocstyle/cachelists.tpl
Commit date: 2022-09-04 20:17:17 +0200
Commit message: Fix XSS in cachelists (OBB-217897)

Diff: diff --git a/htdocs/templates2/ocstyle/cachelists.tpl b/htdocs/templates2/ocstyle/cachelists.tpl
index 87754083..24d20ff9 100644
--- a/htdocs/templates2/ocstyle/cachelists.tpl
+++ b/htdocs/templates2/ocstyle/cachelists.tpl
@@ -26,15 +26,15 @@
         <div class="floatbox">
             <form method="get" action="cachelists.php">
                 <table class="table" >
                     <tr>
                         <td>{t}List name:{/t}</td>
-                        <td><input id="name_filter" name="name" value="{$name_filter}" class="input170" /></td>
+                        <td><input id="name_filter" name="name" value="{$name_filter|escape}" class="input170" /></td>
                     </tr>
                     <tr>
                         <td>{t}By:{/t}</td>
-                        <td><input id="by_filter" name="by" value="{$by_filter}" class="input170" /></td>
+                        <td><input id="by_filter" name="by" value="{$by_filter|escape}" class="input170" /></td>
                     </tr>
                     <tr><td class="separator"></td></tr>
                     <tr>
                         <td colspan="2" style="text-align:right">
                             <input type="submit" name="filter" value="{t}Search{/t}" class="formbutton" onclick="submitbutton('filter')" />&nbsp;

Vulnerable code:                         <td><input id="name_filter" name="name" value="{$name_filter}" class="input170" /></td>
                        <td><input id="by_filter" name="by" value="{$by_filter}" class="input170" /></td>
Fixed code:                         <td><input id="name_filter" name="name" value="{$name_filter|escape}" class="input170" /></td>
                        <td><input id="by_filter" name="by" value="{$by_filter|escape}" class="input170" /></td>
CVE-2022-4587: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, has been found in Opencaching Deutschland oc-server3. This issue affects some unknown processing of the file htdocs/templates2/ocstyle/login.tpl of the component Login Page. The manipulation of the argument username leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 3296ebd61e7fe49e93b5755d5d7766d6e94a7667. It is recommended to apply a patch to fix this issue. The identifier VDB-216173 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-12-17T13:15Z
Repository: https://github.com/OpencachingDeutschland/oc-server3
Language: Other
Files changed: htdocs/templates2/ocstyle/login.tpl
Commit date: 2022-09-04 19:29:35 +0200
Commit message: Fix XSS on login page (OBB-1146814)

Diff: diff --git a/htdocs/templates2/ocstyle/login.tpl b/htdocs/templates2/ocstyle/login.tpl
index 2f67b378..9a2ee38d 100644
--- a/htdocs/templates2/ocstyle/login.tpl
+++ b/htdocs/templates2/ocstyle/login.tpl
@@ -1,9 +1,10 @@
 {***************************************************************************
 * You can find the license in the docs directory
 ***************************************************************************}
 {* OCSTYLE *}
+<h1>login.tpl</h1>
 <div class="content2-pagetitle">
     <img src="resource2/{$opt.template.style}/images/misc/32x32-profile.png" style="margin-right: 10px;" width="32" height="32" alt="" />
     {t}Login{/t}
 </div>
 
@@ -39,11 +40,11 @@
     </div>
 
     <table class="table">
         <tr>
             <td>{t}Username:{/t}</td>
-            <td><input name="email" maxlength="80" type="text" value="{$username}" class="input200" /></td>
+            <td><input name="email" maxlength="80" type="text" value="{$username|escape}" class="input200" /></td>
         </tr>
         <tr>
             <td>{t}Password:{/t}</td>
             <td><input name="password" maxlength="60" type="password" value="" class="input200" /></td>
         </tr>

Vulnerable code:             <td><input name="email" maxlength="80" type="text" value="{$username}" class="input200" /></td>
Fixed code: <h1>login.tpl</h1>
            <td><input name="email" maxlength="80" type="text" value="{$username|escape}" class="input200" /></td>
CVE-2018-7711: Improper Verification of Cryptographic Signature (CWE-347)
value: HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the signature validation utilities, allowing an attacker to get invalid signatures accepted as valid by forcing an error during validation. This occurs because of a dependency on PHP functionality that interprets a -1 error code as a true boolean value.
CWE description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CVSS v3 base score: 8.1
Published: 2018-03-05T22:29Z
Repository: https://github.com/simplesamlphp/saml2
Language: PHP
Files changed: src/SAML2/HTTPRedirect.php
Commit date: 2018-03-02 15:30:38 +0100
Commit message: Be strict when checking return values.

Diff: diff --git a/src/SAML2/HTTPRedirect.php b/src/SAML2/HTTPRedirect.php
index 733c6d0f..ec40a15a 100644
--- a/src/SAML2/HTTPRedirect.php
+++ b/src/SAML2/HTTPRedirect.php
@@ -224,10 +224,10 @@ class HTTPRedirect extends Binding
         }
         if ($key->type !== $sigAlg) {
             $key = Utils::castKey($key, $sigAlg);
         }
 
-        if (!$key->verifySignature($query, $signature)) {
+        if ($key->verifySignature($query, $signature) !== 1) {
             throw new \Exception('Unable to validate signature on query string.');
         }
     }
 }

Vulnerable code:         if (!$key->verifySignature($query, $signature)) {
Fixed code:         if ($key->verifySignature($query, $signature) !== 1) {
CVE-2021-46019: NULL Pointer Dereference (CWE-476)
value: An untrusted pointer dereference in rec_db_destroy() at rec-db.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application crash.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2022-01-14T20:15Z
Repository: https://github.com/gnu-mirror-unofficial/recutils
Language: Other
Files changed: ChangeLog, src/rec-parser.c
Commit date: 2022-04-16 17:11:56 +0200
Commit message: parser: avoid character 0xff being interpreted as (int) -1

This fixes the following CVEs:
- CVE-2021-46019
- CVE-2021-46022
- CVE-2021-46022

2022-04-16  Jose E. Marchesi  <jemarch@gnu.org>

	CVE-2021-46019
	CVE-2021-46022
	CVE-2021-46022
	* src/rec-parser.c (rec_parse_comment): Avoid 0xff being
	interpreted as (int) -1.

Diff: diff --git a/ChangeLog b/ChangeLog
index 35f0552..11279b3 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,13 @@
+2022-04-16  Jose E. Marchesi  <jemarch@gnu.org>
+
+	CVE-2021-46019
+	CVE-2021-46022
+	CVE-2021-46022
+	* src/rec-parser.c (rec_parse_comment): Avoid 0xff being
+	interpreted as (int) -1.
+
 2022-04-16  Jose E. Marchesi  <jemarch@gnu.org>
 
 	* configure.ac: Remove algol68 bindings support.
 	* Makefile.am: Remove algol68 from subdirs.
 	* algol68: Delete.
diff --git a/src/rec-parser.c b/src/rec-parser.c
index f59bde8..f260410 100644
--- a/src/rec-parser.c
+++ b/src/rec-parser.c
@@ -430,11 +430,11 @@ rec_parse_comment (rec_parser_t parser, rec_comment_t *comment)
                 }
               else
                 c = '\n';
             }
 
-          if (rec_buf_putc (c, buf) == EOF)
+          if (rec_buf_putc (ci, buf) == EOF)
             {
               /* Out of memory */
               parser->error = REC_PARSER_ENOMEM;
               return false;
             }

Vulnerable code:           if (rec_buf_putc (c, buf) == EOF)
Fixed code: 2022-04-16  Jose E. Marchesi  <jemarch@gnu.org>

	CVE-2021-46019
	CVE-2021-46022
	CVE-2021-46022
	* src/rec-parser.c (rec_parse_comment): Avoid 0xff being
	interpreted as (int) -1.

          if (rec_buf_putc (ci, buf) == EOF)
CVE-2021-46022: Use After Free (CWE-416)
value: An Use-After-Free vulnerability in rec_mset_elem_destroy() at rec-mset.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application crash.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 5.5
Published: 2022-01-14T20:15Z
Repository: https://github.com/gnu-mirror-unofficial/recutils
Language: Other
Files changed: ChangeLog, src/rec-parser.c
Commit date: 2022-04-16 17:11:56 +0200
Commit message: parser: avoid character 0xff being interpreted as (int) -1

This fixes the following CVEs:
- CVE-2021-46019
- CVE-2021-46022
- CVE-2021-46022

2022-04-16  Jose E. Marchesi  <jemarch@gnu.org>

	CVE-2021-46019
	CVE-2021-46022
	CVE-2021-46022
	* src/rec-parser.c (rec_parse_comment): Avoid 0xff being
	interpreted as (int) -1.

Diff: diff --git a/ChangeLog b/ChangeLog
index 35f0552..11279b3 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,13 @@
+2022-04-16  Jose E. Marchesi  <jemarch@gnu.org>
+
+	CVE-2021-46019
+	CVE-2021-46022
+	CVE-2021-46022
+	* src/rec-parser.c (rec_parse_comment): Avoid 0xff being
+	interpreted as (int) -1.
+
 2022-04-16  Jose E. Marchesi  <jemarch@gnu.org>
 
 	* configure.ac: Remove algol68 bindings support.
 	* Makefile.am: Remove algol68 from subdirs.
 	* algol68: Delete.
diff --git a/src/rec-parser.c b/src/rec-parser.c
index f59bde8..f260410 100644
--- a/src/rec-parser.c
+++ b/src/rec-parser.c
@@ -430,11 +430,11 @@ rec_parse_comment (rec_parser_t parser, rec_comment_t *comment)
                 }
               else
                 c = '\n';
             }
 
-          if (rec_buf_putc (c, buf) == EOF)
+          if (rec_buf_putc (ci, buf) == EOF)
             {
               /* Out of memory */
               parser->error = REC_PARSER_ENOMEM;
               return false;
             }

Vulnerable code:           if (rec_buf_putc (c, buf) == EOF)
Fixed code: 2022-04-16  Jose E. Marchesi  <jemarch@gnu.org>

	CVE-2021-46019
	CVE-2021-46022
	CVE-2021-46022
	* src/rec-parser.c (rec_parse_comment): Avoid 0xff being
	interpreted as (int) -1.

          if (rec_buf_putc (ci, buf) == EOF)
CVE-2015-8013: Cryptographic Issues (CWE-310)
value: s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrically encrypted PGP message.
CWE description: Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
CVSS v3 base score: 7.5
Published: 2017-07-25T18:29Z
Repository: https://github.com/openpgpjs/openpgpjs
Language: JavaScript
Files changed: src/type/s2k.js
Commit date: 2015-10-03 15:57:03 +0200
Commit message: Throw exception on unsupported S2K type.

Diff: diff --git a/src/type/s2k.js b/src/type/s2k.js
index 683d1e1..e4d0fab 100644
--- a/src/type/s2k.js
+++ b/src/type/s2k.js
@@ -123,10 +123,14 @@ S2K.prototype.write = function () {
       break;
     case 'iterated':
       bytes += this.salt;
       bytes += String.fromCharCode(this.c);
       break;
+    case 'gnu':
+      throw new Error("GNU s2k type not supported.");
+    default:
+      throw new Error("Unknown s2k type.");
   }
 
   return bytes;
 };
 
@@ -163,10 +167,16 @@ S2K.prototype.produce_key = function (passphrase, numBytes) {
 
         if (isp.length > count)
           isp = isp.substr(0, count);
 
         return crypto.hash.digest(algorithm, prefix + isp);
+
+      case 'gnu':
+        throw new Error("GNU s2k type not supported.");
+
+      default:
+        throw new Error("Unknown s2k type.");
     }
   }
 
   var result = '',
     prefix = '';

Fixed code:     case 'gnu':
      throw new Error("GNU s2k type not supported.");
    default:
      throw new Error("Unknown s2k type.");

      case 'gnu':
        throw new Error("GNU s2k type not supported.");

      default:
        throw new Error("Unknown s2k type.");
CVE-2023-41037: Improper Verification of Cryptographic Signature (CWE-347)
value: OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In affected versions OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools. These messages typically contain a "Hash: ..." header declaring the hash algorithm used to compute the signature digest. OpenPGP.js up to v5.9.0 ignored any data preceding the "Hash: ..." texts when verifying the signature. As a result, malicious parties could add arbitrary text to a third-party Cleartext Signed Message, to lead the victim to believe that the arbitrary text was signed. A user or application is vulnerable to said attack vector if it verifies the CleartextMessage by only checking the returned `verified` property, discarding the associated `data` information, and instead _visually trusting_ the contents of the original message. Since `verificationResult.data` would always contain the actual signed data, users and apps that check this information are not vulnerable. Similarly, given a CleartextMessage object, retrieving the data using `getText()` or the `text` field returns only the contents that are considered when verifying the signature. Finally, re-armoring a CleartextMessage object (using `armor()` will also result in a "sanitised" version, with the extraneous text being removed. This issue has been addressed in version 5.10.1 (current stable version) which will reject messages when calling `openpgp.readCleartextMessage()` and in version 4.10.11 (legacy version) which will will reject messages when calling `openpgp.cleartext.readArmored()`. Users are advised to upgrade. Users unable to upgrade should check the contents of `verificationResult.data` to see what data was actually signed, rather than visually trusting the contents of the armored message.
CWE description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CVSS v3 base score: 4.3
Published: 2023-08-29T17:15Z
Repository: https://github.com/openpgpjs/openpgpjs
Language: Unknown
Commit date: 2023-08-29 16:49:28 +0200
Commit message: Merge pull request from GHSA-ch3c-v47x-4pgp

Reject cleartext messages with extraneous data preceeding hash header
CVE-2023-26149: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Versions of the package quill-mention before 4.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization, via the renderList function. **Note:**If the mentions list is sourced from unsafe (user-sourced) data, this might allow an injection attack when a Quill user hits @.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-09-28T05:15Z
Repository: https://github.com/quill-mention/quill-mention
Language: Unknown
Commit date: 2023-09-11 09:18:36 -0400
Commit message: Merge pull request #341 from SimplyBinary/fix-inner-html

Fix innerHTML XSS vulnerability
CVE-2024-27287: Insufficient Information (NVD-CWE-noinfo)
value: ESPHome is a system to control your ESP8266/ESP32 for Home Automation systems. Starting in version 2023.12.9 and prior to version 2024.2.2, editing the configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation and Home Assistant add-on) serves unsanitized data with `Content-Type: text/html; charset=UTF-8`, allowing a remote authenticated user to inject arbitrary web script and exfiltrate session cookies via Cross-Site scripting. It is possible for a malicious authenticated user to inject arbitrary Javascript in configuration files using a POST request to the /edit endpoint, the configuration parameter allows to specify the file to write. To trigger the XSS vulnerability, the victim must visit the page` /edit?configuration=[xss file]`. Abusing this vulnerability a malicious actor could perform operations on the dashboard on the behalf of a logged user, access sensitive information, create, edit and delete configuration files and flash firmware on managed boards.
In addition to this, cookies are not correctly secured, allowing the exfiltration of session cookie values. Version 2024.2.2 contains a patch for this issue.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-06T19:15Z
Repository: https://github.com/esphome/esphome
Language: Python
Files changed: esphome/dashboard/web_server.py
Commit date: 2024-03-06 09:34:26 +1300
Commit message: Merge pull request from GHSA-9p43-hj5j-96h5


Diff: diff --git a/esphome/dashboard/web_server.py b/esphome/dashboard/web_server.py
index 8bcc8efa0..de3fe6e8a 100644
--- a/esphome/dashboard/web_server.py
+++ b/esphome/dashboard/web_server.py
@@ -818,10 +818,11 @@ class EditRequestHandler(BaseHandler):
         loop = asyncio.get_running_loop()
         content = await loop.run_in_executor(
             None, self._read_file, filename, configuration
         )
         if content is not None:
+            self.set_header("Content-Type", "application/yaml")
             self.write(content)
 
     def _read_file(self, filename: str, configuration: str) -> bytes | None:
         """Read a file and return the content as bytes."""
         try:

Fixed code:             self.set_header("Content-Type", "application/yaml")
CVE-2013-4244: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The LZW decompressor in the gif2tiff tool in libtiff 4.0.3 and earlier allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a crafted GIF image.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2013-09-28T19:55Z
Repository: https://github.com/vadz/libtiff
Language: Other
Files changed: ChangeLog, tools/gif2tiff.c
Commit date: 2013-08-14 13:59:16 +0000
Commit message: fix possible OOB write in gif2tiff.c

Diff: diff --git a/ChangeLog b/ChangeLog
index 6fbd83fe..ebfb3e68 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,9 @@
+2013-08-14  Frank Warmerdam  <warmerdam@pobox.com>
+
+	* tools/gif2tiff.c: fix possible OOB write (#2452, CVE-2013-4244) 
+
 2013-08-13  Frank Warmerdam  <warmerdam@pobox.com>
 
 	* tools/gif2tiff.c: Be more careful about corrupt or
 	hostile input files (#2450, CVE-2013-4231)
 
diff --git a/tools/gif2tiff.c b/tools/gif2tiff.c
index 277ad93d..8405f710 100644
--- a/tools/gif2tiff.c
+++ b/tools/gif2tiff.c
@@ -398,10 +398,14 @@ process(register int code, unsigned char** fill)
 	oldcode = -1;
 	return 1;
     }
 
     if (oldcode == -1) {
+        if (code >= clear) {
+            fprintf(stderr, "bad input: code=%d is larger than clear=%d\n",code, clear);
+            return 0;
+        }
 	*(*fill)++ = suffix[code];
 	firstchar = oldcode = code;
 	return 1;
     }
     if (code > avail) {

Fixed code: 2013-08-14  Frank Warmerdam  <warmerdam@pobox.com>

	* tools/gif2tiff.c: fix possible OOB write (#2452, CVE-2013-4244) 

        if (code >= clear) {
            fprintf(stderr, "bad input: code=%d is larger than clear=%d\n",code, clear);
            return 0;
        }
CVE-2014-8130: Divide By Zero (CWE-369)
value: The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image that is mishandled by the TIFFWriteScanline function in tif_write.c, as demonstrated by tiffdither.
CWE description: The product divides a value by zero.
CVSS v3 base score: 6.5
Published: 2018-03-12T02:29Z
Repository: https://github.com/vadz/libtiff
Language: C
Files changed: ChangeLog, libtiff/tif_unix.c, libtiff/tif_vms.c, libtiff/tif_win32.c
Commit date: 2012-11-18 17:51:52 +0000
Commit message: * libtiff/tif_{unix,vms,win32}.c (_TIFFmalloc): ANSI C does not
require malloc() to return NULL pointer if requested allocation
size is zero.  Assure that _TIFFmalloc does.

Diff: diff --git a/ChangeLog b/ChangeLog
index d2ff45fd..d965a127 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,11 @@
+2012-11-18  Bob Friesenhahn  <bfriesen@simple.dallas.tx.us>
+
+	* libtiff/tif_{unix,vms,win32}.c (_TIFFmalloc): ANSI C does not
+	require malloc() to return NULL pointer if requested allocation
+	size is zero.  Assure that _TIFFmalloc does.
+
 2012-11-01  Frank Warmerdam  <warmerdam@pobox.com>
 
 	* tools/ppm2tiff.c: avoid zero size buffer vulnerability.
 	CVE-2012-4564 - Thanks to Huzaifa Sidhpurwala of the 
 	Red Hat Security Response team for the fix.
diff --git a/libtiff/tif_unix.c b/libtiff/tif_unix.c
index 8db82317..a686b11b 100644
--- a/libtiff/tif_unix.c
+++ b/libtiff/tif_unix.c
@@ -255,10 +255,13 @@ TIFFOpenW(const wchar_t* name, const char* mode)
 #endif
 
 void*
 _TIFFmalloc(tmsize_t s)
 {
+        if (s == 0)
+                return ((void *) NULL);
+
 	return (malloc((size_t) s));
 }
 
 void
 _TIFFfree(void* p)
diff --git a/libtiff/tif_vms.c b/libtiff/tif_vms.c
index bcab8f6d..4f5d3f18 100644
--- a/libtiff/tif_vms.c
+++ b/libtiff/tif_vms.c
@@ -262,10 +262,13 @@ TIFFOpen(const char* name, const char* mode)
 }
 
 tdata_t
 _TIFFmalloc(tsize_t s)
 {
+        if (s == 0)
+                return ((void *) NULL);
+
 	return (malloc((size_t) s));
 }
 
 void
 _TIFFfree(tdata_t p)
diff --git a/libtiff/tif_win32.c b/libtiff/tif_win32.c
index 7e9c9e1c..ba5fe2e7 100644
--- a/libtiff/tif_win32.c
+++ b/libtiff/tif_win32.c
@@ -327,10 +327,13 @@ TIFFOpenW(const wchar_t* name, const char* mode)
 #endif /* ndef _WIN32_WCE */
 
 void*
 _TIFFmalloc(tmsize_t s)
 {
+        if (s == 0)
+                return ((void *) NULL);
+
 	return (malloc((size_t) s));
 }
 
 void
 _TIFFfree(void* p)

Fixed code: 2012-11-18  Bob Friesenhahn  <bfriesen@simple.dallas.tx.us>

	* libtiff/tif_{unix,vms,win32}.c (_TIFFmalloc): ANSI C does not
	require malloc() to return NULL pointer if requested allocation
	size is zero.  Assure that _TIFFmalloc does.

        if (s == 0)
                return ((void *) NULL);

        if (s == 0)
                return ((void *) NULL);

        if (s == 0)
                return ((void *) NULL);
CVE-2016-10092: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Heap-based buffer overflow in the readContigStripsIntoBuffer function in tif_unix.c in LibTIFF 4.0.7, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5 and 4.0.6 allows remote attackers to have unspecified impact via a crafted image.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2017-03-01T15:59Z
Repository: https://github.com/vadz/libtiff
Language: Other
Files changed: ChangeLog, tools/tiffcrop.c
Commit date: 2016-12-03 11:35:56 +0000
Commit message: * tools/tiffcrop.c: fix readContigStripsIntoBuffer() in -i (ignore) mode so
that the output buffer is correctly incremented to avoid write outside bounds.
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2620

Diff: diff --git a/ChangeLog b/ChangeLog
index 5b23665b..d6a416bd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
+2016-12-03 Even Rouault <even.rouault at spatialys.com>
+
+	* tools/tiffcrop.c: fix readContigStripsIntoBuffer() in -i (ignore) mode so
+	that the output buffer is correctly incremented to avoid write outside bounds.
+	Reported by Agostino Sarubbo.
+	Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2620
+
 2016-12-03 Even Rouault <even.rouault at spatialys.com>
 
 	* libtiff/tif_ojpeg.c: make OJPEGDecode() early exit in case of failure in
 	OJPEGPreDecode(). This will avoid a divide by zero, and potential other issues.
 	Reported by Agostino Sarubbo.
diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
index b87a77a8..70a71e17 100644
--- a/tools/tiffcrop.c
+++ b/tools/tiffcrop.c
@@ -3696,11 +3696,11 @@ static int readContigStripsIntoBuffer (TIFF* in, uint8* buf)
                 if (bytes_read < 0 && !ignore) {
                         TIFFError("", "Error reading strip %lu after %lu rows",
                                   (unsigned long) strip, (unsigned long)rows);
                         return 0;
                 }
-                bufp += bytes_read;
+                bufp += stripsize;
         }
 
         return 1;
 } /* end readContigStripsIntoBuffer */
 

Vulnerable code:                 bufp += bytes_read;
Fixed code: 2016-12-03 Even Rouault <even.rouault at spatialys.com>

	* tools/tiffcrop.c: fix readContigStripsIntoBuffer() in -i (ignore) mode so
	that the output buffer is correctly incremented to avoid write outside bounds.
	Reported by Agostino Sarubbo.
	Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2620

                bufp += stripsize;
CVE-2016-10267: Divide By Zero (CWE-369)
value: LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image, related to libtiff/tif_ojpeg.c:816:8.
CWE description: The product divides a value by zero.
CVSS v3 base score: 5.5
Published: 2017-03-24T19:59Z
Repository: https://github.com/vadz/libtiff
Language: Other
Files changed: ChangeLog, libtiff/tif_ojpeg.c
Commit date: 2016-12-03 11:15:18 +0000
Commit message: * libtiff/tif_ojpeg.c: make OJPEGDecode() early exit in case of failure in
OJPEGPreDecode(). This will avoid a divide by zero, and potential other issues.
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2611

Diff: diff --git a/ChangeLog b/ChangeLog
index 9dbc7a0cf..5b23665b1 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
+2016-12-03 Even Rouault <even.rouault at spatialys.com>
+
+	* libtiff/tif_ojpeg.c: make OJPEGDecode() early exit in case of failure in
+	OJPEGPreDecode(). This will avoid a divide by zero, and potential other issues.
+	Reported by Agostino Sarubbo.
+	Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2611
+
 2016-12-03 Even Rouault <even.rouault at spatialys.com>
 
 	* libtiff/tif_dirread.c: modify ChopUpSingleUncompressedStrip() to
 	instanciate compute ntrips as TIFFhowmany_32(td->td_imagelength, rowsperstrip),
 	instead of a logic based on the total size of data. Which is faulty is
diff --git a/libtiff/tif_ojpeg.c b/libtiff/tif_ojpeg.c
index 1ccc3f9b4..f19e8fd07 100644
--- a/libtiff/tif_ojpeg.c
+++ b/libtiff/tif_ojpeg.c
@@ -242,10 +242,11 @@ typedef enum {
 	ososEoi
 } OJPEGStateOutState;
 
 typedef struct {
 	TIFF* tif;
+        int decoder_ok;
 	#ifndef LIBJPEG_ENCAP_EXTERNAL
 	JMP_BUF exit_jmpbuf;
 	#endif
 	TIFFVGetMethod vgetparent;
 	TIFFVSetMethod vsetparent;
@@ -720,10 +721,11 @@ OJPEGPreDecode(TIFF* tif, uint16 s)
 			if (OJPEGPreDecodeSkipScanlines(tif)==0)
 				return(0);
 		}
 		sp->write_curstrile++;
 	}
+	sp->decoder_ok = 1;
 	return(1);
 }
 
 static int
 OJPEGPreDecodeSkipRaw(TIFF* tif)
@@ -782,12 +784,18 @@ OJPEGPreDecodeSkipScanlines(TIFF* tif)
 }
 
 static int
 OJPEGDecode(TIFF* tif, uint8* buf, tmsize_t cc, uint16 s)
 {
+        static const char module[]="OJPEGDecode";
 	OJPEGState* sp=(OJPEGState*)tif->tif_data;
 	(void)s;
+        if( !sp->decoder_ok )
+        {
+            TIFFErrorExt(tif->tif_clientdata,module,"Cannot decode: decoder not correctly initialized");
+            return 0;
+        }
 	if (sp->libjpeg_jpeg_query_style==0)
 	{
 		if (OJPEGDecodeRaw(tif,buf,cc)==0)
 			return(0);
 	}

Fixed code: 2016-12-03 Even Rouault <even.rouault at spatialys.com>

	* libtiff/tif_ojpeg.c: make OJPEGDecode() early exit in case of failure in
	OJPEGPreDecode(). This will avoid a divide by zero, and potential other issues.
	Reported by Agostino Sarubbo.
	Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2611

        int decoder_ok;
	sp->decoder_ok = 1;
        static const char module[]="OJPEGDecode";
        if( !sp->decoder_ok )
        {
            TIFFErrorExt(tif->tif_clientdata,module,"Cannot decode: decoder not correctly initialized");
            return 0;
        }