Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2024-31583: Insufficient Information (NVD-CWE-noinfo)
value: Pytorch before version v2.2.0 was discovered to contain a use-after-free vulnerability in torch/csrc/jit/mobile/interpreter.cpp.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-17T19:15Z
Repository: https://github.com/pytorch/pytorch
Language: C++
Files changed: torch/csrc/jit/mobile/interpreter.cpp
Commit date: 2023-09-29 22:32:38 +0000
Commit message: [fuzzing result][fuzz_torch_jit_lite_interpreter] read-heap-use-after-free (size 8) in std::_Function_base::_M_empty() (#110289)

Summary: This diff fixes a heap UAF found by fuzzing in torch/csrc/jit/mobile/interpreter.cpp

Test Plan:
CI and
```
arc lionhead crash reproduce 1009060456885023
```
doesn't crash anymore.

Reviewed By: malfet

Differential Revision: D49538326

Pull Request resolved: https://github.com/pytorch/pytorch/pull/110289
Approved by: https://github.com/malfet

Diff: diff --git a/torch/csrc/jit/mobile/interpreter.cpp b/torch/csrc/jit/mobile/interpreter.cpp
index 9183c067f65..6324ea9e3f0 100644
--- a/torch/csrc/jit/mobile/interpreter.cpp
+++ b/torch/csrc/jit/mobile/interpreter.cpp
@@ -126,11 +126,14 @@ bool InterpreterState::run(Stack& stack) {
                     c10::ThreadLocalDebugInfo::get(
                         c10::DebugInfoKind::MOBILE_RUNTIME_INFO))) {
               mobile_debug_info->setOpIdx(pc);
             }
           }
-
+          if (inst.X < 0 ||
+              static_cast<size_t>(inst.X) >= code.operators_.size()) {
+            throw JITException("Invalid OP Instruction");
+          }
           RECORD_EDGE_SCOPE_WITH_DEBUG_HANDLE_AND_INPUTS(
               code.op_names_[inst.X].name, debug_handle, stack);
           code.operators_[inst.X](stack);
           frame.step();
         } break;

Fixed code:           if (inst.X < 0 ||
              static_cast<size_t>(inst.X) >= code.operators_.size()) {
            throw JITException("Invalid OP Instruction");
          }
CVE-2024-31584: Insufficient Information (NVD-CWE-noinfo)
value: Pytorch before v2.2.0 has an Out-of-bounds Read vulnerability via the component torch/csrc/jit/mobile/flatbuffer_loader.cpp.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-19T21:15Z
Repository: https://github.com/pytorch/pytorch
Language: C++
Files changed: torch/csrc/jit/mobile/flatbuffer_loader.cpp
Commit date: 2023-11-17 17:29:07 +0000
Commit message: Fix for PyTorch mobile flatbuffer loader out of bounds reads (#110162)

Summary:
The mobile_ivalue_size field in the mobile_bytecode flatbuffer schema can be larger than the ivalues vector. This introduces potential for memory corruption when parsing the mobile_bytecode Module.

This diff fixes the issue by ensuring that  mobile_ivalue_size is less than the size of the ivalues vector.

Test Plan: contbuild & OSS CI

Differential Revision: D49687548

Pull Request resolved: https://github.com/pytorch/pytorch/pull/110162
Approved by: https://github.com/malfet

Diff: diff --git a/torch/csrc/jit/mobile/flatbuffer_loader.cpp b/torch/csrc/jit/mobile/flatbuffer_loader.cpp
index d8380d2548b..09b5e9acffc 100644
--- a/torch/csrc/jit/mobile/flatbuffer_loader.cpp
+++ b/torch/csrc/jit/mobile/flatbuffer_loader.cpp
@@ -300,11 +300,11 @@ mobile::Module FlatbufferLoader::parseModule(
   all_types_.resize(module->object_types()->size());
   storages_.resize(module->storage_data_size());
   storage_loaded_.resize(module->storage_data_size(), false);
 
   mobile_ivalue_size_ = module_->mobile_ivalue_size();
-  if (mobile_ivalue_size_ == 0) {
+  if (mobile_ivalue_size_ == 0 || mobile_ivalue_size_ > ivalues->size()) {
     mobile_ivalue_size_ = ivalues->size();
   }
 
   for (uint32_t i = 0; i < mobile_ivalue_size_; i++) {
     const auto* ival = ivalues->Get(i);

Vulnerable code:   if (mobile_ivalue_size_ == 0) {
Fixed code:   if (mobile_ivalue_size_ == 0 || mobile_ivalue_size_ > ivalues->size()) {
CVE-2015-1347: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in client.inc.php in osTicket before 1.9.5.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2015-01-23T15:59Z
Repository: https://github.com/osTicket/osTicket-1.8
Language: PHP
Files changed: client.inc.php
Commit date: 2015-01-12 09:31:52 -0600
Commit message: xss: Fix possible vuln setting client lang pref

Diff: diff --git a/client.inc.php b/client.inc.php
index bb8e8bad..64877cc4 100644
--- a/client.inc.php
+++ b/client.inc.php
@@ -46,11 +46,12 @@ $msg='';
 $nav=null;
 //Make sure the user is valid..before doing anything else.
 $thisclient = UserAuthenticationBackend::getUser();
 
 if (isset($_GET['lang']) && $_GET['lang']) {
-    $_SESSION['client:lang'] = $_GET['lang'];
+    if (Internationalization::getLanguageInfo($_GET['lang']))
+        $_SESSION['client:lang'] = $_GET['lang'];
 }
 
 // Bootstrap gettext translations as early as possible, but after attempting
 // to sign on the agent
 TextDomain::configureForUser($thisclient);

Vulnerable code:     $_SESSION['client:lang'] = $_GET['lang'];
Fixed code:     if (Internationalization::getLanguageInfo($_GET['lang']))
        $_SESSION['client:lang'] = $_GET['lang'];
CVE-2021-32838: Uncontrolled Resource Consumption (CWE-400)
value: Flask-RESTX (pypi package flask-restx) is a community driven fork of Flask-RESTPlus. Flask-RESTX before version 0.5.1 is vulnerable to ReDoS (Regular Expression Denial of Service) in email_regex. This is fixed in version 0.5.1.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 7.5
Published: 2021-09-20T18:15Z
Repository: https://github.com/python-restx/flask-restx
Language: Python
Files changed: flask_restx/inputs.py
Commit date: 2021-09-01 21:53:02 +0200
Commit message: optimize email regex (credits: @kevinbackhouse, fix: #372)

Diff: diff --git a/flask_restx/inputs.py b/flask_restx/inputs.py
index b05532f..9c76d8a 100644
--- a/flask_restx/inputs.py
+++ b/flask_restx/inputs.py
@@ -46,11 +46,11 @@ netloc_regex = re.compile(
     re.IGNORECASE,
 )
 
 
 email_regex = re.compile(
-    r"^" "(?P<local>[^@]*[^@.])" r"@" r"(?P<server>[^@]+(?:\.[^@]+)*)" r"$",
+    r"^" "(?P<local>[^@]*[^@.])" r"@" r"(?P<server>[^@\.]+(?:\.[^@\.]+)*)" r"$",
     re.IGNORECASE,
 )
 
 time_regex = re.compile(r"\d{2}:\d{2}")
 

Vulnerable code:     r"^" "(?P<local>[^@]*[^@.])" r"@" r"(?P<server>[^@]+(?:\.[^@]+)*)" r"$",
Fixed code:     r"^" "(?P<local>[^@]*[^@.])" r"@" r"(?P<server>[^@\.]+(?:\.[^@\.]+)*)" r"$",
CVE-2021-29063: Allocation of Resources Without Limits or Throttling (CWE-770)
value: A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 through v1.2.1 when the mpmathify function is called.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 7.5
Published: 2021-06-21T20:15Z
Repository: https://github.com/fredrik-johansson/mpmath
Language: Unknown
Commit date: 2021-02-10 17:31:40 +0100
Commit message: Merge pull request #570 from vks/fix-redos

Fix ReDOS vulnerability
CVE-2022-23637: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: K-Box is a web-based application to manage documents, images, videos and geodata. Prior to version 0.33.1, a stored Cross-Site-Scripting (XSS) vulnerability is present in the markdown editor used by the document abstract and markdown file preview. A specifically crafted anchor link can, if clicked, execute untrusted javascript actions, like retrieving user cookies. Version 0.33.1 includes a patch that allows discarding unsafe links.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-02-14T21:15Z
Repository: https://github.com/k-box/k-box
Language: PHP
Files changed: config/markdown.php
Commit date: 2022-02-12 11:34:12 +0100
Commit message: Update markdown configuration

Diff: diff --git a/config/markdown.php b/config/markdown.php
index 96f78679..f22a04a1 100644
--- a/config/markdown.php
+++ b/config/markdown.php
@@ -142,11 +142,11 @@ return [
     |
     | Default: true
     |
     */
 
-    'allow_unsafe_links' => true,
+    'allow_unsafe_links' => false,
 
     /*
      * Configuration related to ExternalLinkExtension
      */
     'external_link' => [

Vulnerable code:     'allow_unsafe_links' => true,
Fixed code:     'allow_unsafe_links' => false,
CVE-2013-7345: Insufficient Information (NVD-CWE-noinfo)
value: The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted ASCII file that triggers a large amount of backtracking, as demonstrated via a file with many newline characters.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2014-03-24T16:31Z
Repository: https://github.com/file/file
Language: Other
Files changed: magic/Magdir/commands
Commit date: 2013-03-25 14:06:55 +0000
Commit message: limit to 100 repetitions to avoid excessive backtracking Carsten Wolff

Diff: diff --git a/magic/Magdir/commands b/magic/Magdir/commands
index 67c3eee..4a7d8dd 100644
--- a/magic/Magdir/commands
+++ b/magic/Magdir/commands
@@ -1,8 +1,8 @@
 
 #------------------------------------------------------------------------------
-# $File: commands,v 1.44 2013/02/05 15:20:47 christos Exp $
+# $File: commands,v 1.45 2013/02/06 14:18:52 christos Exp $
 # commands:  file(1) magic for various shells and interpreters
 #
 #0	string/w	:			shell archive or script for antique kernel text
 0	string/wt	#!\ /bin/sh		POSIX shell script text executable
 !:mime	text/x-shellscript
@@ -47,11 +47,11 @@
 #
 0	string/wt	#!\ /bin/awk		awk script text executable
 !:mime	text/x-awk
 0	string/wt	#!\ /usr/bin/awk	awk script text executable
 !:mime	text/x-awk
-0	regex		=^\\s*BEGIN\\s*[{]	awk script text
+0	regex		=^\\s{0,100}BEGIN\\s{0,100}[{]	awk script text
 
 # AT&T Bell Labs' Plan 9 shell
 0	string/wt	#!\ /bin/rc	Plan 9 rc shell script text executable
 
 # bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)

Vulnerable code: # $File: commands,v 1.44 2013/02/05 15:20:47 christos Exp $
0	regex		=^\\s*BEGIN\\s*[{]	awk script text
Fixed code: # $File: commands,v 1.45 2013/02/06 14:18:52 christos Exp $
0	regex		=^\\s{0,100}BEGIN\\s{0,100}[{]	awk script text
CVE-2014-0237: Resource Management Errors (CWE-399)
value: The cdf_unpack_summary_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (performance degradation) by triggering many file_printf calls.
CWE description: Weaknesses in this category are related to improper management of system resources.
Published: 2014-06-01T04:29Z
Repository: https://github.com/file/file
Language: C
Files changed: src/cdf.c
Commit date: 2014-05-06 18:20:39 +0000
Commit message: Remove loop that kept reading the same offset (Jan Kaluza)

Diff: diff --git a/src/cdf.c b/src/cdf.c
index f7c46aed..c591a14a 100644
--- a/src/cdf.c
+++ b/src/cdf.c
@@ -33,11 +33,11 @@
  */
 
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: cdf.c,v 1.55 2014/02/27 23:26:17 christos Exp $")
+FILE_RCSID("@(#)$File: cdf.c,v 1.56 2014/05/05 16:11:21 christos Exp $")
 #endif
 
 #include <assert.h>
 #ifdef CDF_DEBUG
 #include <err.h>
@@ -930,11 +930,11 @@ out:
 
 int
 cdf_unpack_summary_info(const cdf_stream_t *sst, const cdf_header_t *h,
     cdf_summary_info_header_t *ssi, cdf_property_info_t **info, size_t *count)
 {
-	size_t i, maxcount;
+	size_t maxcount;
 	const cdf_summary_info_header_t *si =
 	    CAST(const cdf_summary_info_header_t *, sst->sst_tab);
 	const cdf_section_declaration_t *sd =
 	    CAST(const cdf_section_declaration_t *, (const void *)
 	    ((const char *)sst->sst_tab + CDF_SECTION_DECLARATION_OFFSET));
@@ -945,25 +945,17 @@ cdf_unpack_summary_info(const cdf_stream_t *sst, const cdf_header_t *h,
 	ssi->si_byte_order = CDF_TOLE2(si->si_byte_order);
 	ssi->si_os_version = CDF_TOLE2(si->si_os_version);
 	ssi->si_os = CDF_TOLE2(si->si_os);
 	ssi->si_class = si->si_class;
 	cdf_swap_class(&ssi->si_class);
-	ssi->si_count = CDF_TOLE2(si->si_count);
+	ssi->si_count = CDF_TOLE4(si->si_count);
 	*count = 0;
 	maxcount = 0;
 	*info = NULL;
-	for (i = 0; i < CDF_TOLE4(si->si_count); i++) {
-		if (i >= CDF_LOOP_LIMIT) {
-			DPRINTF(("Unpack summary info loop limit"));
-			errno = EFTYPE;
-			return -1;
-		}
-		if (cdf_read_property_info(sst, h, CDF_TOLE4(sd->sd_offset),
-		    info, count, &maxcount) == -1) {
-			return -1;
-		}
-	}
+	if (cdf_read_property_info(sst, h, CDF_TOLE4(sd->sd_offset), info,
+	    count, &maxcount) == -1)
+		return -1;
 	return 0;
 }
 
 
 

Vulnerable code: FILE_RCSID("@(#)$File: cdf.c,v 1.55 2014/02/27 23:26:17 christos Exp $")
	size_t i, maxcount;
	ssi->si_count = CDF_TOLE2(si->si_count);
	for (i = 0; i < CDF_TOLE4(si->si_count); i++) {
		if (i >= CDF_LOOP_LIMIT) {
			DPRINTF(("Unpack summary info loop limit"));
			errno = EFTYPE;
			return -1;
		}
		if (cdf_read_property_info(sst, h, CDF_TOLE4(sd->sd_offset),
		    info, count, &maxcount) == -1) {
			return -1;
		}
	}
Fixed code: FILE_RCSID("@(#)$File: cdf.c,v 1.56 2014/05/05 16:11:21 christos Exp $")
	size_t maxcount;
	ssi->si_count = CDF_TOLE4(si->si_count);
	if (cdf_read_property_info(sst, h, CDF_TOLE4(sd->sd_offset), info,
	    count, &maxcount) == -1)
		return -1;
CVE-2014-0238: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via a vector that (1) has zero length or (2) is too long.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2014-06-01T04:29Z
Repository: https://github.com/file/file
Language: C
Files changed: src/cdf.c
Commit date: 2014-05-21 13:04:38 +0000
Commit message: CVE-2014-0207: Prevent 0 element vectors and vectors longer than the number
of properties from accessing random memory.

Diff: diff --git a/src/cdf.c b/src/cdf.c
index 48a00ec4..375406c3 100644
--- a/src/cdf.c
+++ b/src/cdf.c
@@ -33,11 +33,11 @@
  */
 
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: cdf.c,v 1.58 2014/05/13 16:41:06 christos Exp $")
+FILE_RCSID("@(#)$File: cdf.c,v 1.59 2014/05/14 23:22:48 christos Exp $")
 #endif
 
 #include <assert.h>
 #ifdef CDF_DEBUG
 #include <err.h>
@@ -825,10 +825,14 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 		inp[i].pi_type = CDF_GETUINT32(q, 0);
 		DPRINTF(("%" SIZE_T_FORMAT "u) id=%x type=%x offs=0x%tx,0x%x\n",
 		    i, inp[i].pi_id, inp[i].pi_type, q - p, offs));
 		if (inp[i].pi_type & CDF_VECTOR) {
 			nelements = CDF_GETUINT32(q, 1);
+			if (nelements == 0) {
+				DPRINTF(("CDF_VECTOR with nelements == 0\n"));
+				goto out;
+			}
 			o = 2;
 		} else {
 			nelements = 1;
 			o = 1;
 		}
@@ -899,11 +903,13 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 				*info = inp;
 				inp = *info + nelem;
 			}
 			DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
 			    nelements));
-			for (j = 0; j < nelements; j++, i++) {
+			for (j = 0; j < nelements && i < sh.sh_properties;
+			    j++, i++)
+			{
 				uint32_t l = CDF_GETUINT32(q, o);
 				inp[i].pi_str.s_len = l;
 				inp[i].pi_str.s_buf = (const char *)
 				    (const void *)(&q[o4 + sizeof(l)]);
 				DPRINTF(("l = %d, r = %" SIZE_T_FORMAT

Vulnerable code: FILE_RCSID("@(#)$File: cdf.c,v 1.58 2014/05/13 16:41:06 christos Exp $")
			for (j = 0; j < nelements; j++, i++) {
Fixed code: FILE_RCSID("@(#)$File: cdf.c,v 1.59 2014/05/14 23:22:48 christos Exp $")
			if (nelements == 0) {
				DPRINTF(("CDF_VECTOR with nelements == 0\n"));
				goto out;
			}
			for (j = 0; j < nelements && i < sh.sh_properties;
			    j++, i++)
			{
CVE-2014-3478: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2014-07-09T11:07Z
Repository: https://github.com/file/file
Language: C
Files changed: src/softmagic.c
Commit date: 2014-06-04 17:36:34 +0000
Commit message: Correctly compute the truncated pascal string size (Francisco Alonso and
Jan Kaluza at RedHat)

Diff: diff --git a/src/softmagic.c b/src/softmagic.c
index 9ba500b73..6d6941921 100644
--- a/src/softmagic.c
+++ b/src/softmagic.c
@@ -30,11 +30,11 @@
  */
 
 #include "file.h"
 
 #ifndef	lint
-FILE_RCSID("@(#)$File: softmagic.c,v 1.189 2014/05/30 16:47:44 christos Exp $")
+FILE_RCSID("@(#)$File: softmagic.c,v 1.190 2014/06/03 19:01:34 christos Exp $")
 #endif	/* lint */
 
 #include "magic.h"
 #include <assert.h>
 #include <string.h>
@@ -938,14 +938,22 @@ mconvert(struct magic_set *ms, struct magic *m, int flip)
 		/* Null terminate and eat *trailing* return */
 		p->s[sizeof(p->s) - 1] = '\0';
 		return 1;
 	}
 	case FILE_PSTRING: {
-		char *ptr1 = p->s, *ptr2 = ptr1 + file_pstring_length_size(m);
+		size_t sz = file_pstring_length_size(m);
+		char *ptr1 = p->s, *ptr2 = ptr1 + sz;
 		size_t len = file_pstring_get_length(m, ptr1);
-		if (len >= sizeof(p->s))
-			len = sizeof(p->s) - 1;
+		if (len >= sizeof(p->s)) {
+			/*
+			 * The size of the pascal string length (sz)
+			 * is 1, 2, or 4. We need at least 1 byte for NUL
+			 * termination, but we've already truncated the
+			 * string by p->s, so we need to deduct sz.
+			 */ 
+			len = sizeof(p->s) - sz;
+		}
 		while (len--)
 			*ptr1++ = *ptr2++;
 		*ptr1 = '\0';
 		return 1;
 	}

Vulnerable code: FILE_RCSID("@(#)$File: softmagic.c,v 1.189 2014/05/30 16:47:44 christos Exp $")
		char *ptr1 = p->s, *ptr2 = ptr1 + file_pstring_length_size(m);
		if (len >= sizeof(p->s))
			len = sizeof(p->s) - 1;
Fixed code: FILE_RCSID("@(#)$File: softmagic.c,v 1.190 2014/06/03 19:01:34 christos Exp $")
		size_t sz = file_pstring_length_size(m);
		char *ptr1 = p->s, *ptr2 = ptr1 + sz;
		if (len >= sizeof(p->s)) {
			/*
			 * The size of the pascal string length (sz)
			 * is 1, 2, or 4. We need at least 1 byte for NUL
			 * termination, but we've already truncated the
			 * string by p->s, so we need to deduct sz.
			 */ 
			len = sizeof(p->s) - sz;
		}
CVE-2014-3479: Insufficient Information (NVD-CWE-noinfo)
value: The cdf_check_stream_offset function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, relies on incorrect sector-size data, which allows remote attackers to cause a denial of service (application crash) via a crafted stream offset in a CDF file.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2014-07-09T11:07Z
Repository: https://github.com/file/file
Language: C
Files changed: src/cdf.c
Commit date: 2014-06-04 17:26:07 +0000
Commit message: Use the proper sector size when checking stream offsets (Francisco Alonso and
Jan Kaluza at RedHat)

Diff: diff --git a/src/cdf.c b/src/cdf.c
index 6652581c2..0bfb31a22 100644
--- a/src/cdf.c
+++ b/src/cdf.c
@@ -33,11 +33,11 @@
  */
 
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: cdf.c,v 1.60 2014/05/21 13:04:38 christos Exp $")
+FILE_RCSID("@(#)$File: cdf.c,v 1.61 2014/06/04 17:23:19 christos Exp $")
 #endif
 
 #include <assert.h>
 #ifdef CDF_DEBUG
 #include <err.h>
@@ -265,17 +265,19 @@ static int
 cdf_check_stream_offset(const cdf_stream_t *sst, const cdf_header_t *h,
     const void *p, size_t tail, int line)
 {
 	const char *b = (const char *)sst->sst_tab;
 	const char *e = ((const char *)p) + tail;
+	size_t ss = sst->sst_dirlen < h->h_min_size_standard_stream ?
+	    CDF_SHORT_SEC_SIZE(h) : CDF_SEC_SIZE(h);
 	(void)&line;
-	if (e >= b && (size_t)(e - b) <= CDF_SEC_SIZE(h) * sst->sst_len)
+	if (e >= b && (size_t)(e - b) <= ss * sst->sst_len)
 		return 0;
 	DPRINTF(("%d: offset begin %p < end %p || %" SIZE_T_FORMAT "u"
 	    " > %" SIZE_T_FORMAT "u [%" SIZE_T_FORMAT "u %"
 	    SIZE_T_FORMAT "u]\n", line, b, e, (size_t)(e - b),
-	    CDF_SEC_SIZE(h) * sst->sst_len, CDF_SEC_SIZE(h), sst->sst_len));
+	    ss * sst->sst_len, ss, sst->sst_len));
 	errno = EFTYPE;
 	return -1;
 }
 
 static ssize_t

Vulnerable code: FILE_RCSID("@(#)$File: cdf.c,v 1.60 2014/05/21 13:04:38 christos Exp $")
	if (e >= b && (size_t)(e - b) <= CDF_SEC_SIZE(h) * sst->sst_len)
	    CDF_SEC_SIZE(h) * sst->sst_len, CDF_SEC_SIZE(h), sst->sst_len));
Fixed code: FILE_RCSID("@(#)$File: cdf.c,v 1.61 2014/06/04 17:23:19 christos Exp $")
	size_t ss = sst->sst_dirlen < h->h_min_size_standard_stream ?
	    CDF_SHORT_SEC_SIZE(h) : CDF_SEC_SIZE(h);
	if (e >= b && (size_t)(e - b) <= ss * sst->sst_len)
	    ss * sst->sst_len, ss, sst->sst_len));
CVE-2014-3480: Insufficient Information (NVD-CWE-noinfo)
value: The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2014-07-09T11:07Z
Repository: https://github.com/file/file
Language: C
Files changed: src/cdf.c
Commit date: 2014-06-04 17:23:19 +0000
Commit message: Fix incorrect bounds check for sector count. (Francisco Alonso and Jan Kaluza
at RedHat)

Diff: diff --git a/src/cdf.c b/src/cdf.c
index 375406c37..6652581c2 100644
--- a/src/cdf.c
+++ b/src/cdf.c
@@ -33,11 +33,11 @@
  */
 
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: cdf.c,v 1.59 2014/05/14 23:22:48 christos Exp $")
+FILE_RCSID("@(#)$File: cdf.c,v 1.60 2014/05/21 13:04:38 christos Exp $")
 #endif
 
 #include <assert.h>
 #ifdef CDF_DEBUG
 #include <err.h>
@@ -453,22 +453,23 @@ out1:
 
 size_t
 cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
 {
 	size_t i, j;
-	cdf_secid_t maxsector = (cdf_secid_t)(sat->sat_len * size);
+	cdf_secid_t maxsector = (cdf_secid_t)((sat->sat_len * size)
+	    / sizeof(maxsector));
 
 	DPRINTF(("Chain:"));
 	for (j = i = 0; sid >= 0; i++, j++) {
 		DPRINTF((" %d", sid));
 		if (j >= CDF_LOOP_LIMIT) {
 			DPRINTF(("Counting chain loop limit"));
 			errno = EFTYPE;
 			return (size_t)-1;
 		}
-		if (sid > maxsector) {
-			DPRINTF(("Sector %d > %d\n", sid, maxsector));
+		if (sid >= maxsector) {
+			DPRINTF(("Sector %d >= %d\n", sid, maxsector));
 			errno = EFTYPE;
 			return (size_t)-1;
 		}
 		sid = CDF_TOLE4((uint32_t)sat->sat_tab[sid]);
 	}

Vulnerable code: FILE_RCSID("@(#)$File: cdf.c,v 1.59 2014/05/14 23:22:48 christos Exp $")
	cdf_secid_t maxsector = (cdf_secid_t)(sat->sat_len * size);
		if (sid > maxsector) {
			DPRINTF(("Sector %d > %d\n", sid, maxsector));
Fixed code: FILE_RCSID("@(#)$File: cdf.c,v 1.60 2014/05/21 13:04:38 christos Exp $")
	cdf_secid_t maxsector = (cdf_secid_t)((sat->sat_len * size)
	    / sizeof(maxsector));
		if (sid >= maxsector) {
			DPRINTF(("Sector %d >= %d\n", sid, maxsector));
CVE-2014-3487: Improper Input Validation (CWE-20)
value: The cdf_read_property_info function in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate a stream offset, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2014-07-09T11:07Z
Repository: https://github.com/file/file
Language: C
Files changed: src/cdf.c
Commit date: 2014-06-09 13:04:37 +0000
Commit message: Add missing check offset test (Francisco Alonso, Jan Kaluza at RedHat)

Diff: diff --git a/src/cdf.c b/src/cdf.c
index 0bfb31a22..c258e82f3 100644
--- a/src/cdf.c
+++ b/src/cdf.c
@@ -33,11 +33,11 @@
  */
 
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: cdf.c,v 1.61 2014/06/04 17:23:19 christos Exp $")
+FILE_RCSID("@(#)$File: cdf.c,v 1.62 2014/06/04 17:26:07 christos Exp $")
 #endif
 
 #include <assert.h>
 #ifdef CDF_DEBUG
 #include <err.h>
@@ -814,11 +814,15 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 	e = CAST(const uint8_t *, (const void *)
 	    (((const char *)(const void *)shp) + sh.sh_len));
 	if (cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1)
 		goto out;
 	for (i = 0; i < sh.sh_properties; i++) {
-		size_t ofs = CDF_GETUINT32(p, (i << 1) + 1);
+		size_t tail = (i << 1) + 1;
+		if (cdf_check_stream_offset(sst, h, p, tail * sizeof(uint32_t),
+		    __LINE__) == -1)
+			goto out;
+		size_t ofs = CDF_GETUINT32(p, tail);
 		q = (const uint8_t *)(const void *)
 		    ((const char *)(const void *)p + ofs
 		    - 2 * sizeof(uint32_t));
 		if (q > e) {
 			DPRINTF(("Ran of the end %p > %p\n", q, e));

Vulnerable code: FILE_RCSID("@(#)$File: cdf.c,v 1.61 2014/06/04 17:23:19 christos Exp $")
		size_t ofs = CDF_GETUINT32(p, (i << 1) + 1);
Fixed code: FILE_RCSID("@(#)$File: cdf.c,v 1.62 2014/06/04 17:26:07 christos Exp $")
		size_t tail = (i << 1) + 1;
		if (cdf_check_stream_offset(sst, h, p, tail * sizeof(uint32_t),
		    __LINE__) == -1)
			goto out;
		size_t ofs = CDF_GETUINT32(p, tail);
CVE-2014-3538: Resource Management Errors (CWE-399)
value: file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345.
CWE description: Weaknesses in this category are related to improper management of system resources.
Published: 2014-07-03T14:55Z
Repository: https://github.com/file/file
Language: Other
Files changed: doc/magic.man
Commit date: 2014-05-30 16:51:23 +0000
Commit message: Update regex recommendation.

Diff: diff --git a/doc/magic.man b/doc/magic.man
index 3bfb7d88a..7d7ac7e50 100644
--- a/doc/magic.man
+++ b/doc/magic.man
@@ -1,7 +1,7 @@
-.\" $File: magic.man,v 1.80 2014/03/07 23:11:16 christos Exp $
-.Dd April 22, 2013
+.\" $File: magic.man,v 1.81 2014/03/08 17:28:08 christos Exp $
+.Dd May 30, 2014
 .Dt MAGIC __FSECTION__
 .Os
 .\" install as magic.4 on USG, magic.5 on V7, Berkeley and Linux systems.
 .Sh NAME
 .Nm magic
@@ -226,11 +226,14 @@ A regular expression match in extended POSIX regular expression syntax
 (like egrep).
 Regular expressions can take exponential time to process, and their
 performance is hard to predict, so their use is discouraged.
 When used in production environments, their performance
 should be carefully checked.
-The type specification can be optionally followed by
+The size of the string to search should also be limited by specifying
+.Dv /<length> ,
+to avoid performance issues scanning long files.
+The type specification can also be optionally followed by
 .Dv /[c][s] .
 The
 .Dq c
 flag makes the match case insensitive, while the
 .Dq s

Vulnerable code: .\" $File: magic.man,v 1.80 2014/03/07 23:11:16 christos Exp $
.Dd April 22, 2013
The type specification can be optionally followed by
Fixed code: .\" $File: magic.man,v 1.81 2014/03/08 17:28:08 christos Exp $
.Dd May 30, 2014
The size of the string to search should also be limited by specifying
.Dv /<length> ,
to avoid performance issues scanning long files.
The type specification can also be optionally followed by
CVE-2014-3538: Resource Management Errors (CWE-399)
value: file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345.
CWE description: Weaknesses in this category are related to improper management of system resources.
Published: 2014-07-03T14:55Z
Repository: https://github.com/file/file
Language: Other
Files changed: ChangeLog
Commit date: 2014-05-30 16:52:20 +0000
Commit message: document regex limit.

Diff: diff --git a/ChangeLog b/ChangeLog
index ca8404d1c..976dbc4da 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,10 @@
+2014-05-30  12:51  Christos Zoulas <christos@zoulas.com>
+
+	* Make the range operator limit the length of the
+	  regex search.
+
 2014-05-14  19:23  Christos Zoulas <christos@zoulas.com>
 
 	* PR/347: Windows fixes
 	* PR/352: Hangul word processor recognition
 	* PR/354: Encoding irregularities in text files

Fixed code: 2014-05-30  12:51  Christos Zoulas <christos@zoulas.com>

	* Make the range operator limit the length of the
	  regex search.
CVE-2014-3538: Resource Management Errors (CWE-399)
value: file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345.
CWE description: Weaknesses in this category are related to improper management of system resources.
Published: 2014-07-03T14:55Z
Repository: https://github.com/file/file
Language: C
Files changed: src/softmagic.c
Commit date: 2014-05-30 16:47:44 +0000
Commit message: If requested, limit search length.

Diff: diff --git a/src/softmagic.c b/src/softmagic.c
index 620d6eafa..3e631efe8 100644
--- a/src/softmagic.c
+++ b/src/softmagic.c
@@ -30,11 +30,11 @@
  */
 
 #include "file.h"
 
 #ifndef	lint
-FILE_RCSID("@(#)$File: softmagic.c,v 1.187 2014/05/13 16:42:17 christos Exp $")
+FILE_RCSID("@(#)$File: softmagic.c,v 1.188 2014/05/14 23:15:42 christos Exp $")
 #endif	/* lint */
 
 #include "magic.h"
 #include <assert.h>
 #include <string.h>
@@ -1927,19 +1927,27 @@ magiccheck(struct magic_set *ms, struct magic *m)
 		    ((m->str_flags & STRING_IGNORE_CASE) ? REG_ICASE : 0));
 		if (rc) {
 			file_regerror(&rx, rc, ms);
 			v = (uint64_t)-1;
 		} else {
+#ifndef REG_STARTEND
+			char c;
+#endif
 			regmatch_t pmatch[1];
+			size_t slen = ms->search.s_len;
+			/* Limit by offset if requested */
+			if (m->str_range > 0)
+				slen = MIN(slen, m->str_range);
 #ifndef REG_STARTEND
 #define	REG_STARTEND	0
-			size_t l = ms->search.s_len - 1;
-			char c = ms->search.s[l];
-			((char *)(intptr_t)ms->search.s)[l] = '\0';
+			if (slen != 0)
+				slen--;
+			c = ms->search.s[slen];
+			((char *)(intptr_t)ms->search.s)[slen] = '\0';
 #else
 			pmatch[0].rm_so = 0;
-			pmatch[0].rm_eo = ms->search.s_len;
+			pmatch[0].rm_eo = slen;
 #endif
 			rc = file_regexec(&rx, (const char *)ms->search.s,
 			    1, pmatch, REG_STARTEND);
 #if REG_STARTEND == 0
 			((char *)(intptr_t)ms->search.s)[l] = c;

Vulnerable code: FILE_RCSID("@(#)$File: softmagic.c,v 1.187 2014/05/13 16:42:17 christos Exp $")
			size_t l = ms->search.s_len - 1;
			char c = ms->search.s[l];
			((char *)(intptr_t)ms->search.s)[l] = '\0';
			pmatch[0].rm_eo = ms->search.s_len;
Fixed code: FILE_RCSID("@(#)$File: softmagic.c,v 1.188 2014/05/14 23:15:42 christos Exp $")
#ifndef REG_STARTEND
			char c;
#endif
			size_t slen = ms->search.s_len;
			/* Limit by offset if requested */
			if (m->str_range > 0)
				slen = MIN(slen, m->str_range);
			if (slen != 0)
				slen--;
			c = ms->search.s[slen];
			((char *)(intptr_t)ms->search.s)[slen] = '\0';
			pmatch[0].rm_eo = slen;
CVE-2014-3538: Resource Management Errors (CWE-399)
value: file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345.
CWE description: Weaknesses in this category are related to improper management of system resources.
Published: 2014-07-03T14:55Z
Repository: https://github.com/file/file
Language: Other
Files changed: magic/Magdir/commands
Commit date: 2014-05-30 16:48:44 +0000
Commit message: Limit regex search for BEGIN to the first 4K of the file.

Diff: diff --git a/magic/Magdir/commands b/magic/Magdir/commands
index 26b2869c6..bcd0f438e 100644
--- a/magic/Magdir/commands
+++ b/magic/Magdir/commands
@@ -1,8 +1,8 @@
 
 #------------------------------------------------------------------------------
-# $File: commands,v 1.48 2014/03/04 12:20:42 kim Exp $
+# $File: commands,v 1.49 2014/05/28 19:52:36 christos Exp $
 # commands:  file(1) magic for various shells and interpreters
 #
 #0	string/w	:			shell archive or script for antique kernel text
 0	string/wt	#!\ /bin/sh		POSIX shell script text executable
 !:mime	text/x-shellscript
@@ -54,12 +54,11 @@
 #
 0	string/wt	#!\ /bin/awk		awk script text executable
 !:mime	text/x-awk
 0	string/wt	#!\ /usr/bin/awk	awk script text executable
 !:mime	text/x-awk
-0       search/16384    BEGIN
->0	regex		=^\\s{0,100}BEGIN\\s{0,100}[{]	awk script text
+0	regex/4096	=^\\s{0,100}BEGIN\\s{0,100}[{]	awk script text
 
 # AT&T Bell Labs' Plan 9 shell
 0	string/wt	#!\ /bin/rc	Plan 9 rc shell script text executable
 
 # bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)

Vulnerable code: # $File: commands,v 1.48 2014/03/04 12:20:42 kim Exp $
0       search/16384    BEGIN
>0	regex		=^\\s{0,100}BEGIN\\s{0,100}[{]	awk script text
Fixed code: # $File: commands,v 1.49 2014/05/28 19:52:36 christos Exp $
0	regex/4096	=^\\s{0,100}BEGIN\\s{0,100}[{]	awk script text
CVE-2014-3587: Numeric Errors (CWE-189)
value: Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1571.
CWE description: Weaknesses in this category are related to improper calculation or conversion of numbers.
Published: 2014-08-23T01:55Z
Repository: https://github.com/file/file
Language: C
Files changed: src/cdf.c
Commit date: 2014-08-07 09:38:35 +0000
Commit message: Prevent wrap around (Remi Collet at redhat)

Diff: diff --git a/src/cdf.c b/src/cdf.c
index 5dbf3b13e..3e691f4c6 100644
--- a/src/cdf.c
+++ b/src/cdf.c
@@ -33,11 +33,11 @@
  */
 
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: cdf.c,v 1.63 2014/06/09 13:04:37 christos Exp $")
+FILE_RCSID("@(#)$File: cdf.c,v 1.64 2014/07/24 19:35:39 christos Exp $")
 #endif
 
 #include <assert.h>
 #ifdef CDF_DEBUG
 #include <err.h>
@@ -833,10 +833,14 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 			goto out;
 		size_t ofs = CDF_GETUINT32(p, tail);
 		q = (const uint8_t *)(const void *)
 		    ((const char *)(const void *)p + ofs
 		    - 2 * sizeof(uint32_t));
+		if (q < p) {
+			DPRINTF(("Wrapped around %p < %p\n", q, p));
+			goto out;
+		}
 		if (q > e) {
 			DPRINTF(("Ran of the end %p > %p\n", q, e));
 			goto out;
 		}
 		inp[i].pi_id = CDF_GETUINT32(p, i << 1);

Vulnerable code: FILE_RCSID("@(#)$File: cdf.c,v 1.63 2014/06/09 13:04:37 christos Exp $")
Fixed code: FILE_RCSID("@(#)$File: cdf.c,v 1.64 2014/07/24 19:35:39 christos Exp $")
		if (q < p) {
			DPRINTF(("Wrapped around %p < %p\n", q, p));
			goto out;
		}
CVE-2014-3710: Improper Input Validation (CWE-20)
value: The donote function in readelf.c in file through 5.20, as used in the Fileinfo component in PHP 5.4.34, does not ensure that sufficient note headers are present, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2014-11-05T11:55Z
Repository: https://github.com/file/file
Language: Other
Files changed: ChangeLog, src/readelf.c
Commit date: 2014-10-17 15:49:00 +0000
Commit message: Fix note bounds reading, Francisco Alonso / Red Hat

Diff: diff --git a/ChangeLog b/ChangeLog
index b42e3d789..681e7a950 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,9 @@
+2014-10-17  11:48  Christos Zoulas <christos@zoulas.com>
+
+	* fix bounds in note reading (Francisco Alonso / Red Hat)
+
 2014-10-11  15:02  Christos Zoulas <christos@zoulas.com>
 
 	* fix autoconf glue for setlocale and locale_t; some OS's
 	  have locale_t in xlocale.h
 
diff --git a/src/readelf.c b/src/readelf.c
index 08f81f5b8..9ebdebd61 100644
--- a/src/readelf.c
+++ b/src/readelf.c
@@ -25,11 +25,11 @@
  * SUCH DAMAGE.
  */
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: readelf.c,v 1.102 2014/03/11 21:00:13 christos Exp $")
+FILE_RCSID("@(#)$File: readelf.c,v 1.103 2014/05/02 02:25:10 christos Exp $")
 #endif
 
 #ifdef BUILTIN_ELF
 #include <string.h>
 #include <ctype.h>
@@ -475,10 +475,17 @@ donote(struct magic_set *ms, void *vbuf, size_t offset, size_t size,
 	int os_style = -1;
 #endif
 	uint32_t namesz, descsz;
 	unsigned char *nbuf = CAST(unsigned char *, vbuf);
 
+	if (xnh_sizeof + offset > size) {
+		/*
+		 * We're out of note headers.
+		 */
+		return xnh_sizeof + offset;
+	}
+
 	(void)memcpy(xnh_addr, &nbuf[offset], xnh_sizeof);
 	offset += xnh_sizeof;
 
 	namesz = xnh_namesz;
 	descsz = xnh_descsz;

Vulnerable code: FILE_RCSID("@(#)$File: readelf.c,v 1.102 2014/03/11 21:00:13 christos Exp $")
Fixed code: 2014-10-17  11:48  Christos Zoulas <christos@zoulas.com>

	* fix bounds in note reading (Francisco Alonso / Red Hat)

FILE_RCSID("@(#)$File: readelf.c,v 1.103 2014/05/02 02:25:10 christos Exp $")
	if (xnh_sizeof + offset > size) {
		/*
		 * We're out of note headers.
		 */
		return xnh_sizeof + offset;
	}
CVE-2014-8116: Resource Management Errors (CWE-399)
value: The ELF parser (readelf.c) in file before 5.21 allows remote attackers to cause a denial of service (CPU consumption or crash) via a large number of (1) program or (2) section headers or (3) invalid capabilities.
CWE description: Weaknesses in this category are related to improper management of system resources.
Published: 2014-12-17T19:59Z
Repository: https://github.com/file/file
Language: C
Files changed: src/readelf.c
Commit date: 2014-11-22 23:57:44 +0000
Commit message: Stop reporting bad capabilities after the first few.

Diff: diff --git a/src/readelf.c b/src/readelf.c
index dd4672b44..20fcb7fbe 100644
--- a/src/readelf.c
+++ b/src/readelf.c
@@ -25,11 +25,11 @@
  * SUCH DAMAGE.
  */
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: readelf.c,v 1.104 2014/10/17 15:49:00 christos Exp $")
+FILE_RCSID("@(#)$File: readelf.c,v 1.105 2014/11/22 16:04:29 christos Exp $")
 #endif
 
 #ifdef BUILTIN_ELF
 #include <string.h>
 #include <ctype.h>
@@ -917,10 +917,11 @@ doshn(struct magic_set *ms, int clazz, int swap, int fd, off_t off, int num,
     size_t size, off_t fsize, int *flags, int mach, int strtab)
 {
 	Elf32_Shdr sh32;
 	Elf64_Shdr sh64;
 	int stripped = 1;
+	size_t nbadcap = 0;
 	void *nbuf;
 	off_t noff, coff, name_off;
 	uint64_t cap_hw1 = 0;	/* SunOS 5.x hardware capabilites */
 	uint64_t cap_sf1 = 0;	/* SunOS 5.x software capabilites */
 	char name[50];
@@ -1005,10 +1006,12 @@ doshn(struct magic_set *ms, int clazz, int swap, int fd, off_t off, int num,
 				break;
 			default:
 				goto skip;
 			}
 
+			if (nbadcap > 5)
+				break;
 			if (lseek(fd, xsh_offset, SEEK_SET) == (off_t)-1) {
 				file_badseek(ms);
 				return -1;
 			}
 			coff = 0;
@@ -1070,10 +1073,12 @@ doshn(struct magic_set *ms, int clazz, int swap, int fd, off_t off, int num,
 					    "0x%" INT64_T_FORMAT "x = 0x%"
 					    INT64_T_FORMAT "x",
 					    (unsigned long long)xcap_tag,
 					    (unsigned long long)xcap_val) == -1)
 						return -1;
+					if (nbadcap++ > 2)
+						coff = xsh_size;
 					break;
 				}
 			}
 			/*FALLTHROUGH*/
 		skip:

Vulnerable code: FILE_RCSID("@(#)$File: readelf.c,v 1.104 2014/10/17 15:49:00 christos Exp $")
Fixed code: FILE_RCSID("@(#)$File: readelf.c,v 1.105 2014/11/22 16:04:29 christos Exp $")
	size_t nbadcap = 0;
			if (nbadcap > 5)
				break;
					if (nbadcap++ > 2)
						coff = xsh_size;
CVE-2014-9621: Resource Management Errors (CWE-399)
value: The ELF parser in file 5.16 through 5.21 allows remote attackers to cause a denial of service via a long string.
CWE description: Weaknesses in this category are related to improper management of system resources.
Published: 2015-01-21T18:59Z
Repository: https://github.com/file/file
Language: C
Files changed: src/readelf.c
Commit date: 2014-12-16 23:29:42 +0000
Commit message: Limit string printing to 100 chars, and add flags I forgot in the previous
commit.

Diff: diff --git a/src/readelf.c b/src/readelf.c
index 8e50d7281..cd1f79d5f 100644
--- a/src/readelf.c
+++ b/src/readelf.c
@@ -25,11 +25,11 @@
  * SUCH DAMAGE.
  */
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: readelf.c,v 1.115 2014/12/16 20:53:05 christos Exp $")
+FILE_RCSID("@(#)$File: readelf.c,v 1.116 2014/12/16 23:18:40 christos Exp $")
 #endif
 
 #ifdef BUILTIN_ELF
 #include <string.h>
 #include <ctype.h>
@@ -898,30 +898,35 @@ donote(struct magic_set *ms, void *vbuf, size_t offset, size_t size,
 		    namesz, descsz, noff, doff, flags, size, clazz))
 			return size;
 	}
 
 	if (namesz == 7 && strcmp((char *)&nbuf[noff], "NetBSD") == 0) {
+		if (descsz > 100)
+			descsz = 100;
 		switch (xnh_type) {
 	    	case NT_NETBSD_VERSION:
 			return size;
 		case NT_NETBSD_MARCH:
 			if (*flags & FLAGS_DID_NETBSD_MARCH)
 				return size;
-			if (file_printf(ms, ", compiled for: %.*s", (int)descsz,
-			    (const char *)&nbuf[doff]) == -1)
+			*flags |= FLAGS_DID_NETBSD_MARCH;
+			if (file_printf(ms, ", compiled for: %.*s",
+			    (int)descsz, (const char *)&nbuf[doff]) == -1)
 				return size;
 			break;
 		case NT_NETBSD_CMODEL:
 			if (*flags & FLAGS_DID_NETBSD_CMODEL)
 				return size;
+			*flags |= FLAGS_DID_NETBSD_CMODEL;
 			if (file_printf(ms, ", compiler model: %.*s",
 			    (int)descsz, (const char *)&nbuf[doff]) == -1)
 				return size;
 			break;
 		default:
 			if (*flags & FLAGS_DID_NETBSD_UNKNOWN)
 				return size;
+			*flags |= FLAGS_DID_NETBSD_UNKNOWN;
 			if (file_printf(ms, ", note=%u", xnh_type) == -1)
 				return size;
 			break;
 		}
 		return size;

Vulnerable code: FILE_RCSID("@(#)$File: readelf.c,v 1.115 2014/12/16 20:53:05 christos Exp $")
			if (file_printf(ms, ", compiled for: %.*s", (int)descsz,
			    (const char *)&nbuf[doff]) == -1)
Fixed code: FILE_RCSID("@(#)$File: readelf.c,v 1.116 2014/12/16 23:18:40 christos Exp $")
		if (descsz > 100)
			descsz = 100;
			*flags |= FLAGS_DID_NETBSD_MARCH;
			if (file_printf(ms, ", compiled for: %.*s",
			    (int)descsz, (const char *)&nbuf[doff]) == -1)
			*flags |= FLAGS_DID_NETBSD_CMODEL;
			*flags |= FLAGS_DID_NETBSD_UNKNOWN;
CVE-2014-9652: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted file.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2015-03-30T10:59Z
Repository: https://github.com/file/file
Language: C
Files changed: src/softmagic.c
Commit date: 2014-11-11 17:48:23 +0000
Commit message: PR/398: Correctly truncate pascal strings (fixes out of bounds read of 1, 2,
or 4 bytes).

Diff: diff --git a/src/softmagic.c b/src/softmagic.c
index dbb670a08..2b15f2c39 100644
--- a/src/softmagic.c
+++ b/src/softmagic.c
@@ -30,11 +30,11 @@
  */
 
 #include "file.h"
 
 #ifndef	lint
-FILE_RCSID("@(#)$File: softmagic.c,v 1.195 2014/09/24 19:49:07 christos Exp $")
+FILE_RCSID("@(#)$File: softmagic.c,v 1.196 2014/11/07 15:24:14 christos Exp $")
 #endif	/* lint */
 
 #include "magic.h"
 #include <assert.h>
 #include <string.h>
@@ -962,18 +962,21 @@ mconvert(struct magic_set *ms, struct magic *m, int flip)
 	}
 	case FILE_PSTRING: {
 		size_t sz = file_pstring_length_size(m);
 		char *ptr1 = p->s, *ptr2 = ptr1 + sz;
 		size_t len = file_pstring_get_length(m, ptr1);
-		if (len >= sizeof(p->s)) {
+		sz = sizeof(p->s) - sz; /* maximum length of string */
+		if (len >= sz) {
 			/*
 			 * The size of the pascal string length (sz)
 			 * is 1, 2, or 4. We need at least 1 byte for NUL
 			 * termination, but we've already truncated the
 			 * string by p->s, so we need to deduct sz.
+			 * Because we can use one of the bytes of the length
+			 * after we shifted as NUL termination.
 			 */ 
-			len = sizeof(p->s) - sz;
+			len = sz;
 		}
 		while (len--)
 			*ptr1++ = *ptr2++;
 		*ptr1 = '\0';
 		return 1;

Vulnerable code: FILE_RCSID("@(#)$File: softmagic.c,v 1.195 2014/09/24 19:49:07 christos Exp $")
		if (len >= sizeof(p->s)) {
			len = sizeof(p->s) - sz;
Fixed code: FILE_RCSID("@(#)$File: softmagic.c,v 1.196 2014/11/07 15:24:14 christos Exp $")
		sz = sizeof(p->s) - sz; /* maximum length of string */
		if (len >= sz) {
			 * Because we can use one of the bytes of the length
			 * after we shifted as NUL termination.
			len = sz;