Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2015-8865: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5, mishandles continuation-level jumps, which allows context-dependent attackers to cause a denial of service (buffer overflow and application crash) or possibly execute arbitrary code via a crafted magic file.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.3
Published: 2016-05-20T10:59Z
Repository: https://github.com/file/file
Language: C
Files changed: src/funcs.c
Commit date: 2015-06-03 18:01:20 +0000
Commit message: PR/454: Fix memory corruption when the continuation level jumps by more than
20 in a single step.

Diff: diff --git a/src/funcs.c b/src/funcs.c
index 7ce431e5f..b7160cc73 100644
--- a/src/funcs.c
+++ b/src/funcs.c
@@ -25,11 +25,11 @@
  * SUCH DAMAGE.
  */
 #include "file.h"
 
 #ifndef	lint
-FILE_RCSID("@(#)$File: funcs.c,v 1.80 2015/01/02 21:29:39 christos Exp $")
+FILE_RCSID("@(#)$File: funcs.c,v 1.81 2015/05/28 19:26:59 christos Exp $")
 #endif	/* lint */
 
 #include "magic.h"
 #include <assert.h>
 #include <stdarg.h>
@@ -414,11 +414,11 @@ protected int
 file_check_mem(struct magic_set *ms, unsigned int level)
 {
 	size_t len;
 
 	if (level >= ms->c.len) {
-		len = (ms->c.len += 20) * sizeof(*ms->c.li);
+		len = (ms->c.len = 20 + level) * sizeof(*ms->c.li);
 		ms->c.li = CAST(struct level_info *, (ms->c.li == NULL) ?
 		    malloc(len) :
 		    realloc(ms->c.li, len));
 		if (ms->c.li == NULL) {
 			file_oomem(ms, len);

Vulnerable code: FILE_RCSID("@(#)$File: funcs.c,v 1.80 2015/01/02 21:29:39 christos Exp $")
		len = (ms->c.len += 20) * sizeof(*ms->c.li);
Fixed code: FILE_RCSID("@(#)$File: funcs.c,v 1.81 2015/05/28 19:26:59 christos Exp $")
		len = (ms->c.len = 20 + level) * sizeof(*ms->c.li);
CVE-2017-1000249: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: An issue in file() was introduced in commit 9611f31313a93aa036389c5f3b15eea53510d4d1 (Oct 2016) lets an attacker overwrite a fixed 20 bytes stack buffer with a specially crafted .notes section in an ELF binary. This was fixed in commit 35c94dc6acc418f1ad7f6241a6680e5327495793 (Aug 2017).
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 5.5
Published: 2017-09-11T19:29Z
Repository: https://github.com/file/file
Language: C
Files changed: src/readelf.c
Commit date: 2017-08-27 07:55:02 +0000
Commit message: Fix always true condition (Thomas Jarosch)

Diff: diff --git a/src/readelf.c b/src/readelf.c
index 814518272..5f425c974 100644
--- a/src/readelf.c
+++ b/src/readelf.c
@@ -25,11 +25,11 @@
  * SUCH DAMAGE.
  */
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: readelf.c,v 1.137 2017/08/13 00:21:47 christos Exp $")
+FILE_RCSID("@(#)$File: readelf.c,v 1.138 2017/08/27 07:55:02 christos Exp $")
 #endif
 
 #ifdef BUILTIN_ELF
 #include <string.h>
 #include <ctype.h>
@@ -509,11 +509,11 @@ private int
 do_bid_note(struct magic_set *ms, unsigned char *nbuf, uint32_t type,
     int swap __attribute__((__unused__)), uint32_t namesz, uint32_t descsz,
     size_t noff, size_t doff, int *flags)
 {
 	if (namesz == 4 && strcmp((char *)&nbuf[noff], "GNU") == 0 &&
-	    type == NT_GNU_BUILD_ID && (descsz >= 4 || descsz <= 20)) {
+	    type == NT_GNU_BUILD_ID && (descsz >= 4 && descsz <= 20)) {
 		uint8_t desc[20];
 		const char *btype;
 		uint32_t i;
 		*flags |= FLAGS_DID_BUILD_ID;
 		switch (descsz) {

Vulnerable code: FILE_RCSID("@(#)$File: readelf.c,v 1.137 2017/08/13 00:21:47 christos Exp $")
	    type == NT_GNU_BUILD_ID && (descsz >= 4 || descsz <= 20)) {
Fixed code: FILE_RCSID("@(#)$File: readelf.c,v 1.138 2017/08/27 07:55:02 christos Exp $")
	    type == NT_GNU_BUILD_ID && (descsz >= 4 && descsz <= 20)) {
CVE-2018-10360: Out-of-bounds Read (CWE-125)
value: The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2018-06-11T10:29Z
Repository: https://github.com/file/file
Language: C
Files changed: src/readelf.c
Commit date: 2018-06-09 16:00:06 +0000
Commit message: Avoid reading past the end of buffer (Rui Reis)

Diff: diff --git a/src/readelf.c b/src/readelf.c
index 79c83f9f5..1f41b4611 100644
--- a/src/readelf.c
+++ b/src/readelf.c
@@ -25,11 +25,11 @@
  * SUCH DAMAGE.
  */
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: readelf.c,v 1.142 2018/05/24 18:08:01 christos Exp $")
+FILE_RCSID("@(#)$File: readelf.c,v 1.143 2018/06/09 16:00:06 christos Exp $")
 #endif
 
 #ifdef BUILTIN_ELF
 #include <string.h>
 #include <ctype.h>
@@ -840,11 +840,12 @@ do_core_note(struct magic_set *ms, unsigned char *nbuf, uint32_t type,
 						i = k;
 				}
 
 				cname = (unsigned char *)
 				    &nbuf[doff + prpsoffsets(i)];
-				for (cp = cname; *cp && isprint(*cp); cp++)
+				for (cp = cname; cp < nbuf + size && *cp
+				    && isprint(*cp); cp++)
 					continue;
 				/*
 				 * Linux apparently appends a space at the end
 				 * of the command line: remove it.
 				 */

Vulnerable code: FILE_RCSID("@(#)$File: readelf.c,v 1.142 2018/05/24 18:08:01 christos Exp $")
				for (cp = cname; *cp && isprint(*cp); cp++)
Fixed code: FILE_RCSID("@(#)$File: readelf.c,v 1.143 2018/06/09 16:00:06 christos Exp $")
				for (cp = cname; cp < nbuf + size && *cp
				    && isprint(*cp); cp++)
CVE-2019-18218: Out-of-bounds Write (CWE-787)
value: cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write).
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2019-10-21T05:15Z
Repository: https://github.com/file/file
Language: C
Files changed: src/cdf.c, src/cdf.h
Commit date: 2019-08-26 14:31:39 +0000
Commit message: Limit the number of elements in a vector (found by oss-fuzz)

Diff: diff --git a/src/cdf.c b/src/cdf.c
index 9d6396742..bb81d6374 100644
--- a/src/cdf.c
+++ b/src/cdf.c
@@ -33,11 +33,11 @@
  */
 
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: cdf.c,v 1.115 2019/08/23 14:29:14 christos Exp $")
+FILE_RCSID("@(#)$File: cdf.c,v 1.116 2019/08/26 14:31:39 christos Exp $")
 #endif
 
 #include <assert.h>
 #ifdef CDF_DEBUG
 #include <err.h>
@@ -1025,12 +1025,13 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 			if (left < sizeof(uint32_t) * 2) {
 				DPRINTF(("missing CDF_VECTOR length\n"));
 				goto out;
 			}
 			nelements = CDF_GETUINT32(q, 1);
-			if (nelements == 0) {
-				DPRINTF(("CDF_VECTOR with nelements == 0\n"));
+			if (nelements > CDF_ELEMENT_LIMIT || nelements == 0) {
+				DPRINTF(("CDF_VECTOR with nelements == %"
+				    SIZE_T_FORMAT "u\n", nelements));
 				goto out;
 			}
 			slen = 2;
 		} else {
 			nelements = 1;
@@ -1068,12 +1069,10 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 				inp = cdf_grow_info(info, maxcount, nelements);
 				if (inp == NULL)
 					goto out;
 				inp += nelem;
 			}
-			DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
-			    nelements));
 			for (j = 0; j < nelements && i < sh.sh_properties;
 			    j++, i++)
 			{
 				uint32_t l;
 
diff --git a/src/cdf.h b/src/cdf.h
index 2f7e554b7..05056668f 100644
--- a/src/cdf.h
+++ b/src/cdf.h
@@ -46,10 +46,11 @@
 #endif
 
 typedef int32_t cdf_secid_t;
 
 #define CDF_LOOP_LIMIT					10000
+#define CDF_ELEMENT_LIMIT				100000
 
 #define CDF_SECID_NULL					0
 #define CDF_SECID_FREE					-1
 #define CDF_SECID_END_OF_CHAIN				-2
 #define CDF_SECID_SECTOR_ALLOCATION_TABLE		-3

Vulnerable code: FILE_RCSID("@(#)$File: cdf.c,v 1.115 2019/08/23 14:29:14 christos Exp $")
			if (nelements == 0) {
				DPRINTF(("CDF_VECTOR with nelements == 0\n"));
			DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
			    nelements));
Fixed code: FILE_RCSID("@(#)$File: cdf.c,v 1.116 2019/08/26 14:31:39 christos Exp $")
			if (nelements > CDF_ELEMENT_LIMIT || nelements == 0) {
				DPRINTF(("CDF_VECTOR with nelements == %"
				    SIZE_T_FORMAT "u\n", nelements));
#define CDF_ELEMENT_LIMIT				100000
CVE-2019-8906: Out-of-bounds Read (CWE-125)
value: do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 4.4
Published: 2019-02-18T17:29Z
Repository: https://github.com/file/file
Language: C
Files changed: src/readelf.c
Commit date: 2019-01-02 19:44:14 +0000
Commit message: Avoid OOB read (found by ASAN reported by F. Alonso)

Diff: diff --git a/src/readelf.c b/src/readelf.c
index 4f4103a1d..8d5789664 100644
--- a/src/readelf.c
+++ b/src/readelf.c
@@ -25,11 +25,11 @@
  * SUCH DAMAGE.
  */
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: readelf.c,v 1.156 2018/10/19 00:33:04 christos Exp $")
+FILE_RCSID("@(#)$File: readelf.c,v 1.157 2019/01/02 19:44:14 christos Exp $")
 #endif
 
 #ifdef BUILTIN_ELF
 #include <string.h>
 #include <ctype.h>
@@ -750,11 +750,11 @@ do_core_note(struct magic_set *ms, unsigned char *nbuf, uint32_t type,
 	case OS_STYLE_NETBSD:
 		if (type == NT_NETBSD_CORE_PROCINFO) {
 			char sbuf[512];
 			struct NetBSD_elfcore_procinfo pi;
 			memset(&pi, 0, sizeof(pi));
-			memcpy(&pi, nbuf + doff, descsz);
+			memcpy(&pi, nbuf + doff, MIN(descsz, sizeof(pi)));
 
 			if (file_printf(ms, ", from '%.31s', pid=%u, uid=%u, "
 			    "gid=%u, nlwps=%u, lwp=%u (signal %u/code %u)",
 			    file_printable(sbuf, sizeof(sbuf),
 			    RCAST(char *, pi.cpi_name)),

Vulnerable code: FILE_RCSID("@(#)$File: readelf.c,v 1.156 2018/10/19 00:33:04 christos Exp $")
			memcpy(&pi, nbuf + doff, descsz);
Fixed code: FILE_RCSID("@(#)$File: readelf.c,v 1.157 2019/01/02 19:44:14 christos Exp $")
			memcpy(&pi, nbuf + doff, MIN(descsz, sizeof(pi)));
CVE-2019-20421: Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
value: In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, with high CPU consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.
CWE description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CVSS v3 base score: 7.5
Published: 2020-01-27T05:15Z
Repository: https://github.com/Exiv2/exiv2
Language: Unknown
Commit date: 2019-10-05 09:58:31 +0200
Commit message: Fix #1011 fix_1011_jp2_readmetadata_loop (#1013)

Fix #1011 fix_1011_jp2_readmetadata_loop
CVE-2016-9435: Improper Input Validation (CWE-20)
value: The HTMLtagproc1 function in file.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via a crafted html file, related to <dd> tags.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 6.5
Published: 2017-01-20T15:59Z
Repository: https://github.com/tats/w3m
Language: C
Files changed: file.c, parsetagx.c
Commit date: 2016-08-20 07:12:41 +0900
Commit message: Fix uninitialised values for <i> and <dd>

Bug-Debian: https://github.com/tats/w3m/issues/16

Diff: diff --git a/file.c b/file.c
index de916bc..b66f8c8 100644
--- a/file.c
+++ b/file.c
@@ -4684,10 +4684,16 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env)
 	obuf->flag |= RB_IGNORE_P;
 	return 1;
     case HTML_DD:
 	CLOSE_A;
 	CLOSE_DT;
+	if (h_env->envc == 0 ||
+	    (h_env->envc_real < h_env->nenv &&
+	     envs[h_env->envc].env != HTML_DL &&
+	     envs[h_env->envc].env != HTML_DL_COMPACT)) {
+	    PUSH_ENV(HTML_DL);
+	}
 	if (envs[h_env->envc].env == HTML_DL_COMPACT) {
 	    if (obuf->pos > envs[h_env->envc].indent)
 		flushline(h_env, obuf, envs[h_env->envc].indent, 0,
 			  h_env->limit);
 	    else
diff --git a/parsetagx.c b/parsetagx.c
index 3435f9f..1cc7048 100644
--- a/parsetagx.c
+++ b/parsetagx.c
@@ -118,10 +118,11 @@ parse_tag(char **s, int internal)
     char tagname[MAX_TAG_LEN], attrname[MAX_TAG_LEN];
     char *p, *q;
     int i, attr_id = 0, nattr;
 
     /* Parse tag name */
+    tagname[0] = '\0';
     q = (*s) + 1;
     p = tagname;
     if (*q == '/') {
 	*(p++) = *(q++);
 	SKIP_BLANKS(q);

Fixed code: 	if (h_env->envc == 0 ||
	    (h_env->envc_real < h_env->nenv &&
	     envs[h_env->envc].env != HTML_DL &&
	     envs[h_env->envc].env != HTML_DL_COMPACT)) {
	    PUSH_ENV(HTML_DL);
	}
    tagname[0] = '\0';
CVE-2016-9436: Improper Input Validation (CWE-20)
value: parsetagx.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via a crafted html file, related to a <i> tag.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 6.5
Published: 2017-01-20T15:59Z
Repository: https://github.com/tats/w3m
Language: C
Files changed: file.c, parsetagx.c
Commit date: 2016-08-20 07:12:41 +0900
Commit message: Fix uninitialised values for <i> and <dd>

Bug-Debian: https://github.com/tats/w3m/issues/16

Diff: diff --git a/file.c b/file.c
index de916bc..b66f8c8 100644
--- a/file.c
+++ b/file.c
@@ -4684,10 +4684,16 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env)
 	obuf->flag |= RB_IGNORE_P;
 	return 1;
     case HTML_DD:
 	CLOSE_A;
 	CLOSE_DT;
+	if (h_env->envc == 0 ||
+	    (h_env->envc_real < h_env->nenv &&
+	     envs[h_env->envc].env != HTML_DL &&
+	     envs[h_env->envc].env != HTML_DL_COMPACT)) {
+	    PUSH_ENV(HTML_DL);
+	}
 	if (envs[h_env->envc].env == HTML_DL_COMPACT) {
 	    if (obuf->pos > envs[h_env->envc].indent)
 		flushline(h_env, obuf, envs[h_env->envc].indent, 0,
 			  h_env->limit);
 	    else
diff --git a/parsetagx.c b/parsetagx.c
index 3435f9f..1cc7048 100644
--- a/parsetagx.c
+++ b/parsetagx.c
@@ -118,10 +118,11 @@ parse_tag(char **s, int internal)
     char tagname[MAX_TAG_LEN], attrname[MAX_TAG_LEN];
     char *p, *q;
     int i, attr_id = 0, nattr;
 
     /* Parse tag name */
+    tagname[0] = '\0';
     q = (*s) + 1;
     p = tagname;
     if (*q == '/') {
 	*(p++) = *(q++);
 	SKIP_BLANKS(q);

Fixed code: 	if (h_env->envc == 0 ||
	    (h_env->envc_real < h_env->nenv &&
	     envs[h_env->envc].env != HTML_DL &&
	     envs[h_env->envc].env != HTML_DL_COMPACT)) {
	    PUSH_ENV(HTML_DL);
	}
    tagname[0] = '\0';
CVE-2016-9442: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause memory corruption in certain conditions via a crafted HTML page.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 6.5
Published: 2016-12-12T02:59Z
Repository: https://github.com/tats/w3m
Language: Unknown
Commit date: 2016-09-02 23:01:37 +0900
Commit message: Merge pull request #27 from kcwu/fix-strgrow

Fix potential heap buffer corruption due to Strgrow
CVE-2018-6196: Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
value: w3m through 0.5.3 is prone to an infinite recursion flaw in HTMLlineproc0 because the feed_table_block_tag function in table.c does not prevent a negative indent value.
CWE description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CVSS v3 base score: 7.5
Published: 2018-01-25T03:29Z
Repository: https://github.com/tats/w3m
Language: C
Files changed: table.c
Commit date: 2018-01-20 21:31:03 +0900
Commit message: Prevent negative indent value in feed_table_block_tag()

Bug-Debian: https://github.com/tats/w3m/issues/88

Diff: diff --git a/table.c b/table.c
index 221db92..4f193e1 100644
--- a/table.c
+++ b/table.c
@@ -2354,14 +2354,18 @@ feed_table_block_tag(struct table *tbl,
     else if (indent == -1) {
 	mode->indent_level--;
 	if (mode->indent_level < MAX_INDENT_LEVEL)
 	    tbl->indent -= INDENT_INCR;
     }
+    if (tbl->indent < 0)
+	tbl->indent = 0;
     offset = tbl->indent;
     if (cmd == HTML_DT) {
 	if (mode->indent_level > 0 && mode->indent_level <= MAX_INDENT_LEVEL)
 	    offset -= INDENT_INCR;
+	if (offset < 0)
+	    offset = 0;
     }
     if (tbl->indent > 0) {
 	check_minimum0(tbl, 0);
 	addcontentssize(tbl, offset);
     }

Fixed code:     if (tbl->indent < 0)
	tbl->indent = 0;
	if (offset < 0)
	    offset = 0;
CVE-2018-6197: NULL Pointer Dereference (CWE-476)
value: w3m through 0.5.3 is prone to a NULL pointer dereference flaw in formUpdateBuffer in form.c.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2018-01-25T03:29Z
Repository: https://github.com/tats/w3m
Language: C
Files changed: form.c
Commit date: 2017-12-27 06:43:52 +0900
Commit message: Prevent invalid columnPos() call in formUpdateBuffer()

Bug-Debian: https://github.com/tats/w3m/issues/89

Diff: diff --git a/form.c b/form.c
index cc5e3d2..bc14d39 100644
--- a/form.c
+++ b/form.c
@@ -480,10 +480,12 @@ formUpdateBuffer(Anchor *a, Buffer *buf, FormItemList *form)
 		break;
 	}
 	rows = form->rows ? form->rows : 1;
 	col = COLPOS(l, a->start.pos);
 	for (c_rows = 0; c_rows < rows; c_rows++, l = l->next) {
+	    if (l == NULL)
+		break;
 	    if (rows > 1) {
 		pos = columnPos(l, col);
 		a = retrieveAnchor(buf->formitem, l->linenumber, pos);
 		if (a == NULL)
 		    break;

Fixed code: 	    if (l == NULL)
		break;
CVE-2023-4255: Out-of-bounds Write (CWE-787)
value: An out-of-bounds write issue has been discovered in the backspace handling of the checkType() function in etc.c within the W3M application. This vulnerability is triggered by supplying a specially crafted HTML file to the w3m binary. Exploitation of this flaw could lead to application crashes, resulting in a denial of service condition.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2023-12-21T16:15Z
Repository: https://github.com/tats/w3m
Language: C
Files changed: etc.c
Commit date: 2023-07-13 09:48:23 +0200
Commit message: Fix OOB access due to multiple backspaces

Commit 419ca82d57 (Fix m17n backspace handling causes out-of-bounds
write in checkType) introduced an incomplete fix.

In function checkType we store the length of the previous multi-char
character in a buffer plens_buffer with pointer plens pointing to the
current position inside the buffer. When encountering a backspace plens
is set to the previous position without a bounds check. This will lead
to plens being out of bounds if we get more backspaces than we have
processed multi-char characters before.

If we are at the beginning of the buffer do not decrement and set plen
(the current length) to 0.

This also fixes GH Issue #270 [BUG] Out of bound read in Strnew_size ,
Str.c:61

If the above explanation does sound weird it's because I didn't fully
grok that function. :-)

Diff: diff --git a/etc.c b/etc.c
index 128717b1..b5661513 100644
--- a/etc.c
+++ b/etc.c
@@ -391,11 +391,14 @@ checkType(Str s, Lineprop **oprop, Linecolor **ocolor)
 			    prop -= plen;
 #ifdef USE_ANSI_COLOR
 			    if (color)
 				color -= plen;
 #endif
-			    plen = *(--plens);
+			    if (plens == plens_buffer)
+				plen = 0;
+			    else
+				plen = *(--plens);
 			    str += 2;
 			}
 		    }
 		    else {
 			str += 2;
@@ -417,11 +420,14 @@ checkType(Str s, Lineprop **oprop, Linecolor **ocolor)
 			    prop -= plen;
 #ifdef USE_ANSI_COLOR
 			    if (color)
 				color -= plen;
 #endif
-			    plen = *(--plens);
+			    if (plens == plens_buffer)
+				plen = 0;
+			    else
+				plen = *(--plens);
 			    str++;
 			}
 #else
 			if (*(str - 1) == *(str + 1)) {
 			    *(prop - 1) |= PE_BOLD;

Vulnerable code: 			    plen = *(--plens);
			    plen = *(--plens);
Fixed code: 			    if (plens == plens_buffer)
				plen = 0;
			    else
				plen = *(--plens);
			    if (plens == plens_buffer)
				plen = 0;
			    else
				plen = *(--plens);
CVE-2024-22051: Integer Overflow or Wraparound (CWE-190)
value: CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more than UINT16_MAX columns.


CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2024-01-04T21:15Z
Repository: https://github.com/gjtorikian/commonmarker
Language: Unknown
Commit date: 2022-03-02 18:51:09 -0500
Commit message: Merge pull request from GHSA-fmx4-26r3-wxpf

Update `cmark-gfm` to `0.29.0.gfm.3`, bump main to version `v0.23.3`
CVE-2017-20186: Improper Resource Shutdown or Release (CWE-404)
value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in nikooo777 ckSurf up to 1.19.2. It has been declared as problematic. This vulnerability affects the function SpecListMenuDead of the file csgo/addons/sourcemod/scripting/ckSurf/misc.sp of the component Spectator List Name Handler. The manipulation of the argument cleanName leads to denial of service. Upgrading to version 1.21.0 is able to address this issue. The name of the patch is fd6318d99083a06363091441a0614bd2f21068e6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-238156. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CWE description: The product does not release or incorrectly releases a resource before it is made available for re-use.
CVSS v3 base score: 7.5
Published: 2023-08-28T13:15Z
Repository: https://github.com/nikooo777/ckSurf
Language: Other
Files changed: csgo/addons/sourcemod/scripting/ckSurf/misc.sp
Commit date: 2017-05-08 02:26:06 +0200
Commit message: fixed exploit with names

https://forums.alliedmods.net/showthread.php?t=297179
Diff: diff --git a/csgo/addons/sourcemod/plugins/ckSurf.smx b/csgo/addons/sourcemod/plugins/ckSurf.smx
index e0bb782..fccb5fd 100644
Binary files a/csgo/addons/sourcemod/plugins/ckSurf.smx and b/csgo/addons/sourcemod/plugins/ckSurf.smx differ
diff --git a/csgo/addons/sourcemod/scripting/ckSurf/misc.sp b/csgo/addons/sourcemod/scripting/ckSurf/misc.sp
index 4e5d479..e8e91f7 100644
--- a/csgo/addons/sourcemod/scripting/ckSurf/misc.sp
+++ b/csgo/addons/sourcemod/scripting/ckSurf/misc.sp
@@ -2463,12 +2463,16 @@ public void SpecListMenuDead(int client) // What Spectators see
 						int ObservedUser2;
 						ObservedUser2 = GetEntPropEnt(x, Prop_Send, "m_hObserverTarget");
 						if (ObservedUser == ObservedUser2)
 						{
 							count++;
+							//strip backslashes from names (causes lags and crashes?)
+							char cleanName[MAX_NAME_LENGTH];
+							Format(cleanName, sizeof(cleanName),"%N",x);
+							ReplaceString(cleanName,sizeof(cleanName),"\\","",false);
 							if (count < 6)
-								Format(sSpecs, 512, "%s%N\n", sSpecs, x);
+								Format(sSpecs, 512, "%s%s\n", sSpecs, cleanName);
 						}
 						if (count == 6)
 							Format(sSpecs, 512, "%s...", sSpecs);
 					}
 				}

Vulnerable code: 								Format(sSpecs, 512, "%s%N\n", sSpecs, x);
Fixed code: 							//strip backslashes from names (causes lags and crashes?)
							char cleanName[MAX_NAME_LENGTH];
							Format(cleanName, sizeof(cleanName),"%N",x);
							ReplaceString(cleanName,sizeof(cleanName),"\\","",false);
								Format(sSpecs, 512, "%s%s\n", sSpecs, cleanName);
CVE-2023-34098: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: Shopware is an open source e-commerce software. Due to an incorrect configuration in the `.htaccess` file, the configuration file of the Javascript could be read in production environments (`themes/package-lock.json`). With this information, the specific Shopware version in a deployment might be determined by an attacker, which could be used for further attacks. Users are advised to update to version 5.7.18. There are no known workarounds for this vulnerability.

CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 5.3
Published: 2023-06-27T17:15Z
Repository: https://github.com/shopware5/shopware
Language: Other
Files changed: .htaccess.dist
Commit date: 2023-05-02 09:02:52 +0200
Commit message: SW-27070 - improve htaccess

Diff: diff --git a/.htaccess.dist b/.htaccess.dist
index 0508839a35..2739fc3113 100644
--- a/.htaccess.dist
+++ b/.htaccess.dist
@@ -37,11 +37,11 @@ RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]
 
     # Restrict access to shop configs files
     RedirectMatch 404 /(web\/cache\/(config_\d+\.json|all.less))$
 
     # Restrict access to theme configurations
-    RedirectMatch 404 /themes/(.*)(.*\.lock|package\.json|\.gitignore|Gruntfile\.js|all\.less|node_modules\/.*)$
+    RedirectMatch 404 /themes/(.*)(.(lock|package)\.json|\.gitignore|Gruntfile\.js|all\.less|node_modules\/.*)$
 </IfModule>
 
 # Staging environment
 #SetEnvIf Host "staging.test.shopware.in" SHOPWARE_ENV=staging
 

Vulnerable code:     RedirectMatch 404 /themes/(.*)(.*\.lock|package\.json|\.gitignore|Gruntfile\.js|all\.less|node_modules\/.*)$
Fixed code:     RedirectMatch 404 /themes/(.*)(.(lock|package)\.json|\.gitignore|Gruntfile\.js|all\.less|node_modules\/.*)$
CVE-2017-16833: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Stored cross-site scripting (XSS) vulnerability in Gemirro before 0.16.0 allows attackers to inject arbitrary web script via a crafted javascript: URL in the "homepage" value of a ".gemspec" file.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-11-15T09:29Z
Repository: https://github.com/PierreRambaud/gemirro
Language: Ruby
Files changed: Gemfile.lock, lib/gemirro/server.rb, views/gem.erb
Commit date: 2017-11-14 13:03:20 +0100
Commit message: Security Fix again, thanks to Yasin Soliman

Diff: diff --git a/Gemfile.lock b/Gemfile.lock
index 97dd6cf..fc73164 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,9 +1,9 @@
 PATH
   remote: .
   specs:
-    gemirro (0.14.0)
+    gemirro (0.15.0)
       builder (~> 3.2)
       confstruct (~> 1.0)
       erubis (~> 2.7)
       httpclient (~> 2.8)
       parallel (~> 1.12)
diff --git a/lib/gemirro/server.rb b/lib/gemirro/server.rb
index 34b68fc..94ce663 100644
--- a/lib/gemirro/server.rb
+++ b/lib/gemirro/server.rb
@@ -1,7 +1,8 @@
 require 'sinatra/base'
 require 'thin'
+require 'uri'
 
 module Gemirro
   ##
   # Launch Sinatra server to easily download gems.
   #
@@ -269,8 +270,18 @@ module Gemirro
       # @return [String]
       #
       def escape(string)
         Rack::Utils.escape_html(string)
       end
+
+      ##
+      # Homepage link
+      #
+      # @param [Gem] spec
+      # @return [String]
+      #
+      def homepage(spec)
+        URI.parse(URI.escape(spec.homepage))
+      end
     end
   end
 end
diff --git a/views/gem.erb b/views/gem.erb
index be977a2..bce197a 100644
--- a/views/gem.erb
+++ b/views/gem.erb
@@ -29,11 +29,11 @@
 
             <h3>Authors</h3>
             <ul class="list-group">
               <% spec.authors.each do |author| %>
                 <li class="list-group-item">
-                  <a href="<%= escape(spec.homepage) %>"><%= escape(author) %></a>
+                  <a href="<%= homepage(spec) %>"><%= escape(author) %></a>
                 </li>
               <% end %>
             </ul>
           <% end %>
         </div>

Vulnerable code:     gemirro (0.14.0)
                  <a href="<%= escape(spec.homepage) %>"><%= escape(author) %></a>
Fixed code:     gemirro (0.15.0)
require 'uri'

      ##
      # Homepage link
      #
      # @param [Gem] spec
      # @return [String]
      #
      def homepage(spec)
        URI.parse(URI.escape(spec.homepage))
      end
                  <a href="<%= homepage(spec) %>"><%= escape(author) %></a>
CVE-2022-36039: Out-of-bounds Write (CWE-787)
value: Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to out-of-bounds write when parsing DEX files. A user opening a malicious DEX file could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. A patch is available on the `dev` branch of the repository.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2022-09-06T19:15Z
Repository: https://github.com/rizinorg/rizin
Language: C
Files changed: librz/bin/format/dex/dex.c
Commit date: 2022-08-24 08:26:37 +0800
Commit message: fix #2969 - oob write (1 byte) in dex.c

Diff: diff --git a/librz/bin/format/dex/dex.c b/librz/bin/format/dex/dex.c
index 570968be01..4745aa7b27 100644
--- a/librz/bin/format/dex/dex.c
+++ b/librz/bin/format/dex/dex.c
@@ -79,10 +79,14 @@ static DexString *dex_string_new(RzBuffer *buf, ut64 offset, st64 *pread) {
 	char *data = NULL;
 	st64 read;
 	DexString *string = NULL;
 
 	read = rz_buf_uleb128(buf, &size);
+	if (UT64_ADD_OVFCHK(size, 1)) {
+		return NULL;
+	}
+
 	data = malloc(size + 1);
 	if (!data || rz_buf_read(buf, (ut8 *)data, size) != size) {
 		free(data);
 		return NULL;
 	}
@@ -903,11 +907,13 @@ static char *dex_resolve_library(const char *library) {
 	if (!library || library[0] != 'L') {
 		return NULL;
 	}
 	char *demangled = strdup(library + 1);
 	rz_str_replace_ch(demangled, '/', '.', 1);
-	demangled[strlen(demangled) - 1] = 0;
+	if (RZ_STR_ISNOTEMPTY(demangled)) {
+		demangled[strlen(demangled) - 1] = 0;
+	}
 	return demangled;
 }
 
 static RzBinSymbol *dex_method_to_symbol(RzBinDex *dex, DexEncodedMethod *encoded_method, DexMethodId *method_id, bool is_imported) {
 	RzBinSymbol *symbol = RZ_NEW0(RzBinSymbol);

Vulnerable code: 	demangled[strlen(demangled) - 1] = 0;
Fixed code: 	if (UT64_ADD_OVFCHK(size, 1)) {
		return NULL;
	}

	if (RZ_STR_ISNOTEMPTY(demangled)) {
		demangled[strlen(demangled) - 1] = 0;
	}
CVE-2022-36042: Out-of-bounds Write (CWE-787)
value: Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting data from dyld cache files. A user opening a malicious dyld cache file could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. Commit number 556ca2f9eef01ec0f4a76d1fbacfcf3a87a44810 contains a patch.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2022-09-06T19:15Z
Repository: https://github.com/rizinorg/rizin
Language: C
Files changed: librz/bin/format/mach0/dyldcache.c
Commit date: 2022-08-17 21:20:37 +0200
Commit message: Fix oob write in dyldcache

When the individual n_slide_infos were too high, the sum would overflow
and too few entries would be allocated.

Diff: diff --git a/librz/bin/format/mach0/dyldcache.c b/librz/bin/format/mach0/dyldcache.c
index 8bb26b0768..029fc66f19 100644
--- a/librz/bin/format/mach0/dyldcache.c
+++ b/librz/bin/format/mach0/dyldcache.c
@@ -993,20 +993,25 @@ static RzDyldRebaseInfos *get_rebase_infos(RzDyldCache *cache) {
 	if (!result) {
 		return NULL;
 	}
 
 	if (!cache->hdr->slideInfoOffset || !cache->hdr->slideInfoSize) {
-		ut32 total_slide_infos = 0;
+		size_t total_slide_infos = 0;
 		ut32 n_slide_infos[MAX_N_HDR];
 
 		ut32 i;
 		for (i = 0; i < cache->n_hdr && i < MAX_N_HDR; i++) {
 			ut64 hdr_offset = cache->hdr_offset[i];
 			if (!rz_buf_read_le32_at(cache->buf, 0x13c + hdr_offset, &n_slide_infos[i])) {
 				goto beach;
 			}
-			total_slide_infos += n_slide_infos[i];
+			ut32 total = total_slide_infos + n_slide_infos[i];
+			if (total < total_slide_infos) {
+				// overflow
+				goto beach;
+			}
+			total_slide_infos = total;
 		}
 
 		if (!total_slide_infos) {
 			goto beach;
 		}

Vulnerable code: 		ut32 total_slide_infos = 0;
			total_slide_infos += n_slide_infos[i];
Fixed code: 		size_t total_slide_infos = 0;
			ut32 total = total_slide_infos + n_slide_infos[i];
			if (total < total_slide_infos) {
				// overflow
				goto beach;
			}
			total_slide_infos = total;
CVE-2022-36044: Out-of-bounds Write (CWE-787)
value: Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting data from Luac files. A user opening a malicious Luac file could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. Commits 07b43bc8aa1ffebd9b68d60624c9610cf7e460c7 and 05bbd147caccc60162d6fba9baaaf24befa281cd contain fixes for the issue.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2022-09-06T20:15Z
Repository: https://github.com/rizinorg/rizin
Language: C
Files changed: librz/bin/bobj.c, librz/bin/format/luac/luac_bin.c
Commit date: 2022-08-21 23:48:07 +0200
Commit message: fix oob read on luac

Diff: diff --git a/librz/bin/bobj.c b/librz/bin/bobj.c
index 8f406ece74..bb7298107a 100644
--- a/librz/bin/bobj.c
+++ b/librz/bin/bobj.c
@@ -242,11 +242,11 @@ static char *swiftField(const char *dn, const char *cn) {
 
 static RzList *classes_from_symbols(RzBinFile *bf) {
 	RzBinSymbol *sym;
 	RzListIter *iter;
 	rz_list_foreach (bf->o->symbols, iter, sym) {
-		if (sym->name[0] != '_') {
+		if (!sym->name || sym->name[0] != '_') {
 			continue;
 		}
 		const char *cn = sym->classname;
 		if (cn) {
 			RzBinClass *c = rz_bin_file_add_class(bf, sym->classname, NULL, 0);
diff --git a/librz/bin/format/luac/luac_bin.c b/librz/bin/format/luac/luac_bin.c
index 424d82f793..34589821f8 100644
--- a/librz/bin/format/luac/luac_bin.c
+++ b/librz/bin/format/luac/luac_bin.c
@@ -301,11 +301,11 @@ void _luac_build_info(LuaProto *proto, LuacBinInfo *info) {
 			local_var_entry->offset,
 			local_var_entry->varname_len);
 	}
 
 	// 2.2 parse debug_upvalues
-	size_t real_upvalue_cnt = rz_list_length(proto->upvalue_entries);
+	size_t real_upvalue_cnt = RZ_MAX(rz_list_length(proto->upvalue_entries), rz_list_length(proto->dbg_upvalue_entries));
 	if (real_upvalue_cnt > 0) {
 		LuaDbgUpvalueEntry *debug_upv_entry;
 		upvalue_names = RZ_NEWS0(char *, real_upvalue_cnt);
 		if (!upvalue_names) {
 			free(proto_name);
@@ -326,10 +326,13 @@ void _luac_build_info(LuaProto *proto, LuacBinInfo *info) {
 
 	// 3.1 construct constant symbols
 	LuaConstEntry *const_entry;
 	rz_list_foreach (proto->const_entries, iter, const_entry) {
 		symbol_name = get_constant_symbol_name(proto_name, const_entry);
+		if (!symbol_name) {
+			continue;
+		}
 		luac_add_symbol(
 			info->symbol_list,
 			symbol_name,
 			const_entry->offset,
 			const_entry->data_len,

Vulnerable code: 		if (sym->name[0] != '_') {
	size_t real_upvalue_cnt = rz_list_length(proto->upvalue_entries);
Fixed code: 		if (!sym->name || sym->name[0] != '_') {
	size_t real_upvalue_cnt = RZ_MAX(rz_list_length(proto->upvalue_entries), rz_list_length(proto->dbg_upvalue_entries));
		if (!symbol_name) {
			continue;
		}
CVE-2023-30226: Excessive Iteration (CWE-834)
value: An issue was discovered in function get_gnu_verneed in rizinorg Rizin prior to 0.5.0 verneed_entry allows attackers to cause a denial of service via crafted elf file.
CWE description: The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
CVSS v3 base score: 5.5
Published: 2023-07-12T02:15Z
Repository: https://github.com/rizinorg/rizin
Language: C
Files changed: librz/bin/format/elf/elf_info.c
Commit date: 2022-11-30 17:34:45 +0800
Commit message: ELF: added vn_next break condition (#3214)

if the dynamic section's verneednum mismatches the true number of entries then the for loop in get_gnu_verneed will continue to iterate on the last entry since vn_next will be 0 on the last entry. If verneednum is set to all 0xff's it will take a very long time to finish this loop naturally drastically hindering binary load time. The solution is simple, to check for when vn_next == 0 and break out of the loop since all entries have been iterated over regardless of what verneednum indicates.
Diff: diff --git a/librz/bin/format/elf/elf_info.c b/librz/bin/format/elf/elf_info.c
index 8d22235a46..b5e002b610 100644
--- a/librz/bin/format/elf/elf_info.c
+++ b/librz/bin/format/elf/elf_info.c
@@ -1290,10 +1290,14 @@ static Sdb *get_gnu_verneed(ELFOBJ *bin) {
 			return NULL;
 		}
 
 		sdb_free(sdb_version);
 
+		if (!verneed_entry.vn_next) {
+			break;
+		}
+
 		verneed_offset += verneed_entry.vn_next;
 	}
 
 	return sdb;
 }

Fixed code: 		if (!verneed_entry.vn_next) {
			break;
		}
CVE-2024-39918: Insufficient Information (NVD-CWE-noinfo)
value: @jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. Input of the `ImageId` in the code is not sanitized and may lead to path traversal. This allows an attacker to store an image in an arbitrary location that the server has permission to access. This issue has been addressed in version 2.1.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-15T20:15Z
Repository: https://github.com/jasonraimondi/url-to-png
Language: TypeScript
Files changed: src/middlewares/extract_query_params.ts
Commit date: 2024-07-12 20:31:20 -0400
Commit message: sanitize params

Diff: diff --git a/src/middlewares/extract_query_params.ts b/src/middlewares/extract_query_params.ts
index d3581bc..e193332 100644
--- a/src/middlewares/extract_query_params.ts
+++ b/src/middlewares/extract_query_params.ts
@@ -70,11 +70,11 @@ export function handleExtractQueryParamsMiddleware(encryptionService?: StringEnc
       validData.width = 1920;
     }
 
     const date = new Date();
     const dateString = date.toLocaleDateString().replace(/\//g, "-");
-    const imageId = dateString + "." + slugify(validData.url) + configToString(params);
+    const imageId = dateString + "." + slugify(validData.url) + slugify(configToString(params));
 
     c.set("input", validData);
     c.set("imageId", imageId);
 
     await next();

Vulnerable code:     const imageId = dateString + "." + slugify(validData.url) + configToString(params);
Fixed code:     const imageId = dateString + "." + slugify(validData.url) + slugify(configToString(params));
CVE-2016-10010: Permissions, Privileges, and Access Controls (CWE-264)
value: sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local users to gain privileges via unspecified vectors, related to serverloop.c.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
CVSS v3 base score: 7
Published: 2017-01-05T02:59Z
Repository: https://github.com/openbsd/src
Language: C
Files changed: usr.bin/ssh/serverloop.c
Commit date: 2016-12-14 00:36:34 +0000
Commit message: disable Unix-domain socket forwarding when privsep is disabled

Diff: diff --git a/usr.bin/ssh/serverloop.c b/usr.bin/ssh/serverloop.c
index 679ad13c044..3c413e5bb10 100644
--- a/usr.bin/ssh/serverloop.c
+++ b/usr.bin/ssh/serverloop.c
@@ -1,6 +1,6 @@
-/* $OpenBSD: serverloop.c,v 1.188 2016/11/30 03:00:05 djm Exp $ */
+/* $OpenBSD: serverloop.c,v 1.189 2016/12/14 00:36:34 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
  * Server main loop for handling the interactive session.
@@ -470,11 +470,12 @@ server_request_direct_streamlocal(void)
 	debug("server_request_direct_streamlocal: originator %s port %d, target %s",
 	    originator, originator_port, target);
 
 	/* XXX fine grained permissions */
 	if ((options.allow_streamlocal_forwarding & FORWARD_LOCAL) != 0 &&
-	    !no_port_forwarding_flag && !options.disable_forwarding) {
+	    !no_port_forwarding_flag && !options.disable_forwarding &&
+	    use_privsep) {
 		c = channel_connect_to_path(target,
 		    "direct-streamlocal@openssh.com", "direct-streamlocal");
 	} else {
 		logit("refused streamlocal port forward: "
 		    "originator %s port %d, target %s",
@@ -746,11 +747,12 @@ server_input_global_request(int type, u_int32_t seq, void *ctxt)
 		debug("server_input_global_request: streamlocal-forward listen path %s",
 		    fwd.listen_path);
 
 		/* check permissions */
 		if ((options.allow_streamlocal_forwarding & FORWARD_REMOTE) == 0
-		    || no_port_forwarding_flag || options.disable_forwarding) {
+		    || no_port_forwarding_flag || options.disable_forwarding ||
+		    !use_privsep) {
 			success = 0;
 			packet_send_debug("Server has disabled port forwarding.");
 		} else {
 			/* Start listening on the socket */
 			success = channel_setup_remote_fwd_listener(

Vulnerable code: /* $OpenBSD: serverloop.c,v 1.188 2016/11/30 03:00:05 djm Exp $ */
	    !no_port_forwarding_flag && !options.disable_forwarding) {
		    || no_port_forwarding_flag || options.disable_forwarding) {
Fixed code: /* $OpenBSD: serverloop.c,v 1.189 2016/12/14 00:36:34 djm Exp $ */
	    !no_port_forwarding_flag && !options.disable_forwarding &&
	    use_privsep) {
		    || no_port_forwarding_flag || options.disable_forwarding ||
		    !use_privsep) {
CVE-2016-10011: Key Management Errors (CWE-320)
value: authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users to obtain sensitive private-key information by leveraging access to a privilege-separated child process.
CWE description: Weaknesses in this category are related to errors in the management of cryptographic keys.
CVSS v3 base score: 5.5
Published: 2017-01-05T02:59Z
Repository: https://github.com/openbsd/src
Language: C
Files changed: usr.bin/ssh/authfile.c
Commit date: 2016-11-25 23:24:45 +0000
Commit message: use sshbuf_allocate() to pre-allocate the buffer used for loading
keys. This avoids implicit realloc inside the buffer code, which
might theoretically leave fragments of the key on the heap. This
doesn't appear to happen in practice for normal sized keys, but
was observed for novelty oversize ones.

Pointed out by Jann Horn of Project Zero; ok markus@

Diff: diff --git a/usr.bin/ssh/authfile.c b/usr.bin/ssh/authfile.c
index 59771cb09f7..ec685544e7b 100644
--- a/usr.bin/ssh/authfile.c
+++ b/usr.bin/ssh/authfile.c
@@ -1,6 +1,6 @@
-/* $OpenBSD: authfile.c,v 1.121 2016/04/09 12:39:30 djm Exp $ */
+/* $OpenBSD: authfile.c,v 1.122 2016/11/25 23:24:45 djm Exp $ */
 /*
  * Copyright (c) 2000, 2013 Markus Friedl.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -96,17 +96,29 @@ int
 sshkey_load_file(int fd, struct sshbuf *blob)
 {
 	u_char buf[1024];
 	size_t len;
 	struct stat st;
-	int r;
+	int r, dontmax = 0;
 
 	if (fstat(fd, &st) < 0)
 		return SSH_ERR_SYSTEM_ERROR;
 	if ((st.st_mode & (S_IFSOCK|S_IFCHR|S_IFIFO)) == 0 &&
 	    st.st_size > MAX_KEY_FILE_SIZE)
 		return SSH_ERR_INVALID_FORMAT;
+	/*
+	 * Pre-allocate the buffer used for the key contents and clamp its
+	 * maximum size. This ensures that key contents are never leaked via
+	 * implicit realloc() in the sshbuf code.
+	 */
+	if ((st.st_mode & S_IFREG) == 0 || st.st_size <= 0) {
+		st.st_size = 64*1024; /* 64k should be enough for anyone :) */
+		dontmax = 1;
+	}
+	if ((r = sshbuf_allocate(blob, st.st_size)) != 0 ||
+	    (dontmax && (r = sshbuf_set_max_size(blob, st.st_size)) != 0))
+		return r;
 	for (;;) {
 		if ((len = atomicio(read, fd, buf, sizeof(buf))) == 0) {
 			if (errno == EPIPE)
 				break;
 			r = SSH_ERR_SYSTEM_ERROR;

Vulnerable code: /* $OpenBSD: authfile.c,v 1.121 2016/04/09 12:39:30 djm Exp $ */
	int r;
Fixed code: /* $OpenBSD: authfile.c,v 1.122 2016/11/25 23:24:45 djm Exp $ */
	int r, dontmax = 0;
	/*
	 * Pre-allocate the buffer used for the key contents and clamp its
	 * maximum size. This ensures that key contents are never leaked via
	 * implicit realloc() in the sshbuf code.
	 */
	if ((st.st_mode & S_IFREG) == 0 || st.st_size <= 0) {
		st.st_size = 64*1024; /* 64k should be enough for anyone :) */
		dontmax = 1;
	}
	if ((r = sshbuf_allocate(blob, st.st_size)) != 0 ||
	    (dontmax && (r = sshbuf_set_max_size(blob, st.st_size)) != 0))
		return r;
CVE-2017-15906: Incorrect Permission Assignment for Critical Resource (CWE-732)
value: The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.
CWE description: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CVSS v3 base score: 5.3
Published: 2017-10-26T03:29Z
Repository: https://github.com/openbsd/src
Language: C
Files changed: usr.bin/ssh/sftp-server.c
Commit date: 2017-04-04 00:24:56 +0000
Commit message: disallow creation (of empty files) in read-only mode; reported by
Michal Zalewski, feedback & ok deraadt@

Diff: diff --git a/usr.bin/ssh/sftp-server.c b/usr.bin/ssh/sftp-server.c
index 2510d234a3a2..42249ebd60d0 100644
--- a/usr.bin/ssh/sftp-server.c
+++ b/usr.bin/ssh/sftp-server.c
@@ -1,6 +1,6 @@
-/* $OpenBSD: sftp-server.c,v 1.110 2016/09/12 01:22:38 deraadt Exp $ */
+/* $OpenBSD: sftp-server.c,v 1.111 2017/04/04 00:24:56 djm Exp $ */
 /*
  * Copyright (c) 2000-2004 Markus Friedl.  All rights reserved.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -681,12 +681,12 @@ process_open(u_int32_t id)
 	flags = flags_from_portable(pflags);
 	mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a.perm : 0666;
 	logit("open \"%s\" flags %s mode 0%o",
 	    name, string_from_portable(pflags), mode);
 	if (readonly &&
-	    ((flags & O_ACCMODE) == O_WRONLY ||
-	    (flags & O_ACCMODE) == O_RDWR)) {
+	    ((flags & O_ACCMODE) != O_RDONLY ||
+	    (flags & (O_CREAT|O_TRUNC)) != 0)) {
 		verbose("Refusing open request in read-only mode");
 		status = SSH2_FX_PERMISSION_DENIED;
 	} else {
 		fd = open(name, flags, mode);
 		if (fd < 0) {

Vulnerable code: /* $OpenBSD: sftp-server.c,v 1.110 2016/09/12 01:22:38 deraadt Exp $ */
	    ((flags & O_ACCMODE) == O_WRONLY ||
	    (flags & O_ACCMODE) == O_RDWR)) {
Fixed code: /* $OpenBSD: sftp-server.c,v 1.111 2017/04/04 00:24:56 djm Exp $ */
	    ((flags & O_ACCMODE) != O_RDONLY ||
	    (flags & (O_CREAT|O_TRUNC)) != 0)) {