Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-0610: Improper Authorization (CWE-285)
value: Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.
CWE description: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 4.3
Published: 2023-02-01T12:15Z
Repository: https://github.com/wallabag/wallabag
Language: Unknown
Commit date: 2023-02-01 09:32:22 +0100
Commit message: Merge pull request from GHSA-mrqx-mjc4-vfh3

AnnotationController: fix improper authorization vulnerability
CVE-2023-0734: Improper Authorization (CWE-285)
value: Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4.
CWE description: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 5.3
Published: 2023-03-05T21:15Z
Repository: https://github.com/wallabag/wallabag
Language: Unknown
Commit date: 2023-02-07 21:42:46 +0100
Commit message: Merge pull request #6290 from wallabag/2.5/fix-add-tag-other-entries

Fix adding tag to entries from other people
CVE-2023-0735: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 6.5
Published: 2023-02-07T23:15Z
Repository: https://github.com/wallabag/wallabag
Language: Unknown
Commit date: 2023-02-07 21:52:51 +0100
Commit message: Merge pull request #6289 from wallabag/2.5/fix-csrf-user-deletion

Fix CSRF on user deletion
CVE-2023-0736: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository wallabag/wallabag prior to 2.5.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-02-07T23:15Z
Repository: https://github.com/wallabag/wallabag
Language: Unknown
Commit date: 2023-02-07 21:43:04 +0100
Commit message: Merge pull request #6288 from wallabag/2.5/xss-username-share-page

Fix XSS on username on share page
CVE-2023-4454: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 5.7
Published: 2023-08-21T10:15Z
Repository: https://github.com/wallabag/wallabag
Language: Unknown
Commit date: 2023-08-21 11:08:24 +0200
Commit message: Merge pull request from GHSA-p8gp-899c-jvq9

Replace GET way to POST way to reset data user
CVE-2023-4455: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 6.5
Published: 2023-08-21T10:15Z
Repository: https://github.com/wallabag/wallabag
Language: Unknown
Commit date: 2023-08-21 11:08:47 +0200
Commit message: Merge pull request from GHSA-gjvc-55fw-v6vq

Replace GET way to POST way to delete API client
CVE-2020-28371: Integer Overflow or Wraparound (CWE-190)
value: An issue was discovered in ReadyTalk Avian 1.2.0 before 2020-10-27. The FileOutputStream.write() method in FileOutputStream.java has a boundary check to prevent out-of-bounds memory read/write operations. However, an integer overflow leads to bypassing this check and achieving the out-of-bounds access. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2020-11-09T22:15Z
Repository: https://github.com/ReadyTalk/avian
Language: Java
Files changed: classpath/java/io/FileOutputStream.java
Commit date: 2020-10-27 09:35:05 -0600
Commit message: Fix integer overflow leading to out-of-bounds read/write

Diff: diff --git a/classpath/java/io/FileOutputStream.java b/classpath/java/io/FileOutputStream.java
index 8732004..f5518d7 100644
--- a/classpath/java/io/FileOutputStream.java
+++ b/classpath/java/io/FileOutputStream.java
@@ -50,11 +50,11 @@ public class FileOutputStream extends OutputStream {
   public void write(byte[] b, int offset, int length) throws IOException {
     if (b == null) {
       throw new NullPointerException();
     }
 
-    if (offset < 0 || offset + length > b.length) {
+    if (offset < 0 || length < 0 || length > b.length || offset > b.length - length) {
       throw new ArrayIndexOutOfBoundsException();
     }
 
     write(fd, b, offset, length);
   }

Vulnerable code:     if (offset < 0 || offset + length > b.length) {
Fixed code:     if (offset < 0 || length < 0 || length > b.length || offset > b.length - length) {
CVE-2020-28371: Out-of-bounds Write (CWE-787)
value: An issue was discovered in ReadyTalk Avian 1.2.0 before 2020-10-27. The FileOutputStream.write() method in FileOutputStream.java has a boundary check to prevent out-of-bounds memory read/write operations. However, an integer overflow leads to bypassing this check and achieving the out-of-bounds access. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2020-11-09T22:15Z
Repository: https://github.com/ReadyTalk/avian
Language: Java
Files changed: classpath/java/io/FileOutputStream.java
Commit date: 2020-10-27 09:35:05 -0600
Commit message: Fix integer overflow leading to out-of-bounds read/write

Diff: diff --git a/classpath/java/io/FileOutputStream.java b/classpath/java/io/FileOutputStream.java
index 8732004..f5518d7 100644
--- a/classpath/java/io/FileOutputStream.java
+++ b/classpath/java/io/FileOutputStream.java
@@ -50,11 +50,11 @@ public class FileOutputStream extends OutputStream {
   public void write(byte[] b, int offset, int length) throws IOException {
     if (b == null) {
       throw new NullPointerException();
     }
 
-    if (offset < 0 || offset + length > b.length) {
+    if (offset < 0 || length < 0 || length > b.length || offset > b.length - length) {
       throw new ArrayIndexOutOfBoundsException();
     }
 
     write(fd, b, offset, length);
   }

Vulnerable code:     if (offset < 0 || offset + length > b.length) {
Fixed code:     if (offset < 0 || length < 0 || length > b.length || offset > b.length - length) {
CVE-2020-36400: Out-of-bounds Write (CWE-787)
value: ZeroMQ libzmq 4.3.3 has a heap-based buffer overflow in zmq::tcp_read, a different vulnerability than CVE-2021-20235.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2021-07-01T03:15Z
Repository: https://github.com/zeromq/libzmq
Language: C++
Files changed: src/decoder_allocators.hpp
Commit date: 2020-05-08 18:18:34 +0100
Commit message: Problem: ZMTP v1 static allocator is needlessly resized

Solution: don't do it, resizing the shared allocator makes sense
as it can take the message buff for zero copy, but the static allocator
is fixed

Diff: diff --git a/src/decoder_allocators.hpp b/src/decoder_allocators.hpp
index f6b967be..2620f1b8 100644
--- a/src/decoder_allocators.hpp
+++ b/src/decoder_allocators.hpp
@@ -56,11 +56,12 @@ class c_single_allocator
 
     void deallocate () {}
 
     std::size_t size () const { return _buf_size; }
 
-    void resize (std::size_t new_size_) { _buf_size = new_size_; }
+    //  This buffer is fixed, size must not be changed
+    void resize (std::size_t new_size_) { LIBZMQ_UNUSED (new_size_); }
 
   private:
     std::size_t _buf_size;
     unsigned char *_buf;
 

Vulnerable code:     void resize (std::size_t new_size_) { _buf_size = new_size_; }
Fixed code:     //  This buffer is fixed, size must not be changed
    void resize (std::size_t new_size_) { LIBZMQ_UNUSED (new_size_); }
CVE-2012-6112: Permissions, Privileges, and Access Controls (CWE-264)
value: classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle control characters, which allows remote attackers to trigger arbitrary outbound HTTP requests via a crafted string.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Published: 2013-01-27T22:55Z
Repository: https://github.com/tinymce/tinymce_spellchecker_php
Language: PHP
Files changed: changelog.txt, classes/GoogleSpell.php
Commit date: 2012-11-16 11:08:03 +0100
Commit message: Fixed security issue with google spellchecker

Diff: diff --git a/changelog.txt b/changelog.txt
index ed606cf..afe04fb 100644
--- a/changelog.txt
+++ b/changelog.txt
@@ -1,5 +1,7 @@
+Version 2.0.6.1 (2012-11-16)
+	Fixed security issue with google spellchecker.
 Version 2.0.6 (2011-09-29)
 	Fixed incorrect position of suggestion menu.
 	Fixed handling of mispelled words with no suggestions in PSpellShell engine.
 	Fixed PSpellShell command on Windows.
 	Fixed bug where Javascript error is produced when enchant_dict_suggest() returns unexpected result.
diff --git a/classes/GoogleSpell.php b/classes/GoogleSpell.php
index 1821ca0..2d2f875 100644
--- a/classes/GoogleSpell.php
+++ b/classes/GoogleSpell.php
@@ -49,10 +49,12 @@ class GoogleSpell extends SpellChecker {
 
 		return $osug;
 	}
 
 	function &_getMatches($lang, $str) {
+		$lang = preg_replace('/[^a-z\-]/i', '', $lang); // Sanitize, remove everything but a-z or -
+		$str = preg_replace('/[\x00-\x1F\x7F]/', '', $str); // Sanitize, remove all control characters
 		$server = "www.google.com";
 		$port = 443;
 		$path = "/tbproxy/spell?lang=" . $lang . "&hl=en";
 		$host = "www.google.com";
 		$url = "https://" . $server;

Fixed code: Version 2.0.6.1 (2012-11-16)
	Fixed security issue with google spellchecker.
		$lang = preg_replace('/[^a-z\-]/i', '', $lang); // Sanitize, remove everything but a-z or -
		$str = preg_replace('/[\x00-\x1F\x7F]/', '', $str); // Sanitize, remove all control characters
CVE-2020-11021: Insufficient Information (NVD-CWE-noinfo)
value: Actions Http-Client (NPM @actions/http-client) before version 1.0.8 can disclose Authorization headers to incorrect domain in certain redirect scenarios. The conditions in which this happens are if consumers of the http-client: 1. make an http request with an authorization header 2. that request leads to a redirect (302) and 3. the redirect url redirects to another domain or hostname Then the authorization header will get passed to the other domain. The problem is fixed in version 1.0.8.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2020-04-29T18:15Z
Repository: https://github.com/actions/http-client
Language: Unknown
Commit date: 2020-04-23 17:09:17 -0400
Commit message: Merge pull request #27 from actions/redirect-auth-issue

Redirects should not pass authorization to different domain
CVE-2022-4559: Improper Neutralization (CWE-707)
value: A vulnerability was found in INEX IPX-Manager up to 6.2.0. It has been declared as problematic. This vulnerability affects unknown code of the file resources/views/customer/list.foil.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 6.3.0 is able to address this issue. The name of the patch is bc9b14c6f70cccdb89b559e8bc3a7318bfe9c243. It is recommended to upgrade the affected component. VDB-215962 is the identifier assigned to this vulnerability.
CWE description: The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
CVSS v3 base score: 6.1
Published: 2022-12-16T17:15Z
Repository: https://github.com/inex/IXP-Manager
Language: PHP
Files changed: resources/views/customer/list.foil.php
Commit date: 2022-10-20 11:41:43 +0100
Commit message: [BF] Escape HTML content to prevent XSS [ref: 055-9-4]

Diff: diff --git a/resources/views/customer/list.foil.php b/resources/views/customer/list.foil.php
index 60d2f4d23..c9d63fd19 100644
--- a/resources/views/customer/list.foil.php
+++ b/resources/views/customer/list.foil.php
@@ -51,22 +51,22 @@
             </ul>
         </div>
 
         <div class="btn-group btn-group-sm">
             <button class="btn btn-white btn-xs dropdown-toggle" type="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
-                <?= $t->tag ? 'Tag: ' . $t->tags[ $t->tag ][ 'display_as' ] : "Limit to tag..." ?>
+                <?= $t->tag ? 'Tag: ' . $t->ee( $t->tags[ $t->tag ][ 'display_as' ] ) : "Limit to tag..." ?>
             </button>
 
             <ul class="dropdown-menu dropdown-menu-right">
                 <a class="dropdown-item <?= $t->tag ?: "active" ?>" href="<?= route( 'customer@list', [ 'tag' => 0 ] ) ?>">
                     All Tags
                 </a>
 
                 <div class="dropdown-divider"></div>
                 <?php foreach( $t->tags as $tag ): ?>
                     <a class="dropdown-item <?= $t->tag !== $tag[ 'id' ] ?: "active" ?>"href="<?= route( 'customer@list' , [ 'tag' => $tag[ 'id' ] ] ) ?>">
-                        <?= $tag[ 'display_as' ] ?>
+                        <?= $t->ee( $tag[ 'display_as' ] ) ?>
                     </a>
                 <?php endforeach; ?>
             </ul>
         </div>
 

Vulnerable code:                 <?= $t->tag ? 'Tag: ' . $t->tags[ $t->tag ][ 'display_as' ] : "Limit to tag..." ?>
                        <?= $tag[ 'display_as' ] ?>
Fixed code:                 <?= $t->tag ? 'Tag: ' . $t->ee( $t->tags[ $t->tag ][ 'display_as' ] ) : "Limit to tag..." ?>
                        <?= $t->ee( $tag[ 'display_as' ] ) ?>
CVE-2023-30549: Use After Free (CWE-416)
value: Apptainer is an open source container platform for Linux. There is an ext4 use-after-free flaw that is exploitable through versions of Apptainer < 1.1.0 and installations that include apptainer-suid < 1.1.8 on older operating systems where that CVE has not been patched. That includes Red Hat Enterprise Linux 7, Debian 10 buster (unless the linux-5.10 package is installed), Ubuntu 18.04 bionic and Ubuntu 20.04 focal. Use-after-free flaws in the kernel can be used to attack the kernel for denial of service and potentially for privilege escalation.

Apptainer 1.1.8 includes a patch that by default disables mounting of extfs filesystem types in setuid-root mode, while continuing to allow mounting of extfs filesystems in non-setuid "rootless" mode using fuse2fs.

Some workarounds are possible. Either do not install apptainer-suid (for versions 1.1.0 through 1.1.7) or set `allow setuid = no` in apptainer.conf.  This requires having unprivileged user namespaces enabled and except for apptainer 1.1.x versions will disallow mounting of sif files, extfs files, and squashfs files in addition to other, less significant impacts.  (Encrypted sif files are also not supported unprivileged in apptainer 1.1.x.). Alternatively, use the `limit containers` options in apptainer.conf/singularity.conf to limit sif files to trusted users, groups, and/or paths, and set `allow container extfs = no` to disallow mounting of extfs overlay files.  The latter option by itself does not disallow mounting of extfs overlay partitions inside SIF files, so that's why the former options are also needed.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.8
Published: 2023-04-25T21:15Z
Repository: https://github.com/apptainer/apptainer
Language: Unknown
Commit date: 2023-04-25 10:01:22 -0500
Commit message: Merge pull request from GHSA-j4rf-7357-f4cg

add "allow setuid-mount" options
CVE-2018-16790: Out-of-bounds Read (CWE-125)
value: _bson_iter_next_internal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and other products, has a heap-based buffer over-read via a crafted bson buffer.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.1
Published: 2018-09-10T05:29Z
Repository: https://github.com/mongodb/mongo-c-driver
Language: C
Files changed: src/libbson/src/bson/bson-iter.c, src/libbson/tests/test-bson.c
Commit date: 2018-09-17 13:31:23 -0400
Commit message: Fix for CVE-2018-16790 -- Verify bounds before binary length read.

As reported here: https://jira.mongodb.org/browse/CDRIVER-2819,
a heap overread occurs due a failure to correctly verify data
bounds.

In the original check, len - o returns the data left including the
sizeof(l) we just read. Instead, the comparison should check
against the data left NOT including the binary int32, i.e. just
subtype (byte*) instead of int32 subtype (byte*).

Added in test for corrupted BSON example.

Diff: diff --git a/src/libbson/src/bson/bson-iter.c b/src/libbson/src/bson/bson-iter.c
index 5b6dad1c..820134ea 100644
--- a/src/libbson/src/bson/bson-iter.c
+++ b/src/libbson/src/bson/bson-iter.c
@@ -616,11 +616,11 @@ fill_data_fields:
       iter->d3 = o + 5;
 
       memcpy (&l, iter->raw + iter->d1, sizeof (l));
       l = BSON_UINT32_FROM_LE (l);
 
-      if (l >= (len - o)) {
+      if (l >= (len - o - 4)) {
          iter->err_off = o;
          goto mark_invalid;
       }
 
       subtype = *(iter->raw + iter->d2);
diff --git a/src/libbson/tests/binary/test59.bson b/src/libbson/tests/binary/test59.bson
new file mode 100644
index 00000000..5fd8be07
Binary files /dev/null and b/src/libbson/tests/binary/test59.bson differ
diff --git a/src/libbson/tests/test-bson.c b/src/libbson/tests/test-bson.c
index b6e74c67..6ac94f3a 100644
--- a/src/libbson/tests/test-bson.c
+++ b/src/libbson/tests/test-bson.c
@@ -1247,10 +1247,15 @@ test_bson_validate (void)
    VALIDATE_TEST ("test54.bson",
                   BSON_VALIDATE_NONE,
                   12,
                   BSON_VALIDATE_NONE,
                   "corrupt BSON");
+   VALIDATE_TEST ("test59.bson",
+                  BSON_VALIDATE_NONE,
+                  9,
+                  BSON_VALIDATE_NONE,
+                  "corrupt BSON");
 
    /* DBRef validation */
    b = BCON_NEW ("my_dbref",
                  "{",
                  "$ref",

Vulnerable code:       if (l >= (len - o)) {
Fixed code:       if (l >= (len - o - 4)) {
   VALIDATE_TEST ("test59.bson",
                  BSON_VALIDATE_NONE,
                  9,
                  BSON_VALIDATE_NONE,
                  "corrupt BSON");
CVE-2024-30212: Insufficient Information (NVD-CWE-noinfo)
value: If a SCSI READ(10) command is initiated via USB using the largest LBA 
(0xFFFFFFFF) with it's default block size of 512 and a count of 1,

the first 512 byte of the 0x80000000 memory area is returned to the 
user. If the block count is increased, the full RAM can be exposed.

The same method works to write to this memory area. If RAM contains 
pointers, those can be - depending on the application - overwritten to

return data from any other offset including Progam and Boot Flash.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-28T16:15Z
Repository: https://github.com/Microchip-MPLAB-Harmony/core
Language: Other
Files changed: driver/memory/async/src/drv_memory.c.ftl, driver/memory/sync/src/drv_memory.c.ftl
Commit date: 2024-04-16 16:37:51 +0530
Commit message: [DRV_MEM] Fixed parameter validation for variable overflow issue

MH3-90524

Diff: diff --git a/driver/memory/async/src/drv_memory.c.ftl b/driver/memory/async/src/drv_memory.c.ftl
index 80f0d9b40..2d4211b82 100644
--- a/driver/memory/async/src/drv_memory.c.ftl
+++ b/driver/memory/async/src/drv_memory.c.ftl
@@ -703,11 +703,11 @@ static void DRV_MEMORY_SetupXfer
     {
         SYS_DEBUG_MESSAGE(SYS_ERROR_INFO, "Memory Driver Invalid Buffer.\n");
         return;
     }
 
-    if ((nBlock == 0U) || ((blockStart + nBlock) > dObj->mediaGeometryTable[geometry_type].numBlocks))
+    if ((nBlock == 0U) || (((uint64_t)blockStart + nBlock) > dObj->mediaGeometryTable[geometry_type].numBlocks))
     {
         SYS_DEBUG_MESSAGE(SYS_ERROR_INFO, "Memory Driver Invalid Block parameters.\n");
         return;
     }
 
diff --git a/driver/memory/sync/src/drv_memory.c.ftl b/driver/memory/sync/src/drv_memory.c.ftl
index beae2b2a7..c6339df60 100644
--- a/driver/memory/sync/src/drv_memory.c.ftl
+++ b/driver/memory/sync/src/drv_memory.c.ftl
@@ -709,11 +709,11 @@ static bool DRV_MEMORY_SetupXfer
     {
         SYS_DEBUG_MESSAGE(SYS_ERROR_INFO, "Memory Driver Invalid Buffer.\n");
         return isSuccess;
     }
 
-    if ((nBlock == 0U) || ((blockStart + nBlock) > dObj->mediaGeometryTable[geometry_type].numBlocks))
+    if ((nBlock == 0U) || (((uint64_t)blockStart + nBlock) > dObj->mediaGeometryTable[geometry_type].numBlocks))
     {
         SYS_DEBUG_MESSAGE(SYS_ERROR_INFO, "Memory Driver Invalid Block parameters.\n");
         return isSuccess;
     }
 

Vulnerable code:     if ((nBlock == 0U) || ((blockStart + nBlock) > dObj->mediaGeometryTable[geometry_type].numBlocks))
    if ((nBlock == 0U) || ((blockStart + nBlock) > dObj->mediaGeometryTable[geometry_type].numBlocks))
Fixed code:     if ((nBlock == 0U) || (((uint64_t)blockStart + nBlock) > dObj->mediaGeometryTable[geometry_type].numBlocks))
    if ((nBlock == 0U) || (((uint64_t)blockStart + nBlock) > dObj->mediaGeometryTable[geometry_type].numBlocks))
CVE-2021-30218: NULL Pointer Dereference (CWE-476)
value: samurai 1.2 has a NULL pointer dereference in writefile() in util.c via a crafted build file.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2021-04-29T15:15Z
Repository: https://github.com/michaelforney/samurai
Language: C
Files changed: util.c
Commit date: 2021-04-02 17:28:21 -0700
Commit message: util: Check for NULL string in writefile

This check was there previously, but was removed in f549b757 with
the addition of a check during parse that every rule has rspfile
if and only if it has rspfile_content. However, this fails to
consider the possibility of those variables coming from the edge
or global environment. So, re-add the check.

Fixes #67.

Diff: diff --git a/util.c b/util.c
index ea5c3ce..2a59881 100644
--- a/util.c
+++ b/util.c
@@ -256,11 +256,11 @@ writefile(const char *name, struct string *s)
 	if (!f) {
 		warn("open %s:", name);
 		return -1;
 	}
 	ret = 0;
-	if (fwrite(s->s, 1, s->n, f) != s->n || fflush(f) != 0) {
+	if (s && (fwrite(s->s, 1, s->n, f) != s->n || fflush(f) != 0)) {
 		warn("write %s:", name);
 		ret = -1;
 	}
 	fclose(f);
 

Vulnerable code: 	if (fwrite(s->s, 1, s->n, f) != s->n || fflush(f) != 0) {
Fixed code: 	if (s && (fwrite(s->s, 1, s->n, f) != s->n || fflush(f) != 0)) {
CVE-2021-30219: NULL Pointer Dereference (CWE-476)
value: samurai 1.2 has a NULL pointer dereference in printstatus() function in build.c via a crafted build file.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2021-04-29T15:15Z
Repository: https://github.com/michaelforney/samurai
Language: C
Files changed: parse.c
Commit date: 2021-04-04 03:55:41 -0700
Commit message: parse: Check for non-empty command/rspfile/rspfile_content

This matches ninja behavior and prevents the possibility of a rule
with an empty (NULL) command string.

Fixes #68.

Diff: diff --git a/parse.c b/parse.c
index f79a5ee..b4b98a1 100644
--- a/parse.c
+++ b/parse.c
@@ -40,10 +40,12 @@ parserule(struct scanner *s, struct environment *env)
 	scannewline(s);
 	while (scanindent(s)) {
 		var = scanname(s);
 		parselet(s, &val);
 		ruleaddvar(r, var, val);
+		if (!val)
+			continue;
 		if (strcmp(var, "command") == 0)
 			hascommand = true;
 		else if (strcmp(var, "rspfile") == 0)
 			hasrspfile = true;
 		else if (strcmp(var, "rspfile_content") == 0)

Fixed code: 		if (!val)
			continue;
CVE-2017-16355: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 4.7
Published: 2017-12-14T22:29Z
Repository: https://github.com/phusion/passenger
Language: C
Files changed: src/agent/Core/SpawningKit/Spawner.h
Commit date: 2017-10-13 11:41:18 +0200
Commit message: Disable unused feature.
Diff: diff --git a/src/agent/Core/SpawningKit/Spawner.h b/src/agent/Core/SpawningKit/Spawner.h
index e65034ae91..99dedb852f 100644
--- a/src/agent/Core/SpawningKit/Spawner.h
+++ b/src/agent/Core/SpawningKit/Spawner.h
@@ -719,11 +719,10 @@ protected:
 		TRACE_POINT();
 		SpawnPreparationInfo info;
 		prepareChroot(info, options);
 		info.userSwitching = prepareUserSwitching(options);
 		prepareSwitchingWorkingDirectory(info, options);
-		inferApplicationInfo(info);
 		return info;
 	}
 
 	void prepareChroot(SpawnPreparationInfo &info, const Options &options) {
 		TRACE_POINT();
@@ -773,10 +772,11 @@ protected:
 		}
 
 		assert(info.appRootPathsInsideChroot.back() == info.appRootInsideChroot);
 	}
 
+#ifdef false
 	void inferApplicationInfo(SpawnPreparationInfo &info) const {
 		info.codeRevision = readFromRevisionFile(info);
 		if (info.codeRevision.empty()) {
 			info.codeRevision = inferCodeRevisionFromCapistranoSymlink(info);
 		}
@@ -815,10 +815,11 @@ protected:
 			return extractBaseName(buf);
 		} else {
 			return string();
 		}
 	}
+#endif
 
 	bool shouldLoadShellEnvvars(const Options &options, const SpawnPreparationInfo &preparation) const {
 		if (options.loadShellEnvvars) {
 			string shellName = extractBaseName(preparation.userSwitching.shell);
 			bool retVal = shellName == "bash" || shellName == "zsh" || shellName == "ksh";

Vulnerable code: 		inferApplicationInfo(info);
Fixed code: #ifdef false
#endif
CVE-2018-12615: Incorrect Permission Assignment for Critical Resource (CWE-732)
value: An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2. The set of groups (gidset) is not set correctly, leaving it up to randomness (i.e., uninitialized memory) which supplementary groups are actually being set while lowering privileges.
CWE description: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CVSS v3 base score: 5.3
Published: 2018-06-21T15:29Z
Repository: https://github.com/phusion/passenger
Language: C++
Files changed: src/agent/ExecHelper/ExecHelperMain.cpp
Commit date: 2018-05-29 15:33:50 +0200
Commit message: ExecHelperMain: fix privilege lowering code

Diff: diff --git a/src/agent/ExecHelper/ExecHelperMain.cpp b/src/agent/ExecHelper/ExecHelperMain.cpp
index 1e5ae58e2a..1700a52032 100644
--- a/src/agent/ExecHelper/ExecHelperMain.cpp
+++ b/src/agent/ExecHelper/ExecHelperMain.cpp
@@ -199,10 +199,13 @@ switchGroup(uid_t uid, const struct passwd *userInfo, gid_t gid) {
 			}
 
 			if (ngroups <= NGROUPS_MAX) {
 				setgroupsCalled = true;
 				gidset.reset(new gid_t[ngroups]);
+				for (int i = 0; i < ngroups; i++) {
+					gidset[i] = groups[i];
+				}
 				if (setgroups(ngroups, gidset.get()) == -1) {
 					int e = errno;
 					fprintf(stderr, "ERROR: setgroups(%d, ...) failed: %s (errno=%d)\n",
 						ngroups, strerror(e), e);
 					exit(1);

Fixed code: 				for (int i = 0; i < ngroups; i++) {
					gidset[i] = groups[i];
				}
CVE-2017-6889: Integer Overflow or Wraparound (CWE-190)
value: An integer overflow error within the "foveon_load_camf()" function (dcraw_foveon.c) in LibRaw-demosaic-pack-GPL2 before 0.18.2 can be exploited to cause a heap-based buffer overflow.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2017-05-15T18:29Z
Repository: https://github.com/LibRaw/LibRaw-demosaic-pack-GPL2
Language: C
Files changed: dcraw_foveon.c
Commit date: 2017-03-04 19:55:24 +0300
Commit message: Fixed possible foveon buffer overrun (Secunia SA750000)

Diff: diff --git a/dcraw_foveon.c b/dcraw_foveon.c
index d8b7005..bdde89d 100644
--- a/dcraw_foveon.c
+++ b/dcraw_foveon.c
@@ -317,11 +317,11 @@ void CLASS foveon_huff (ushort *huff)
 }
 
 void CLASS foveon_dp_load_raw()
 {
   unsigned c, roff[4], row, col, diff;
-  ushort huff[512], vpred[2][2], hpred[2];
+  ushort huff[1024], vpred[2][2], hpred[2];
 
   fseek (ifp, 8, SEEK_CUR);
   foveon_huff (huff);
   roff[0] = 48;
   FORC3 roff[c+1] = -(-(roff[c] + get4()) & -16);
@@ -344,16 +344,20 @@ void CLASS foveon_dp_load_raw()
 }
 
 void CLASS foveon_load_camf()
 {
   unsigned type, wide, high, i, j, row, col, diff;
-  ushort huff[258], vpred[2][2] = {{512,512},{512,512}}, hpred[2];
+  ushort huff[1024], vpred[2][2] = {{512,512},{512,512}}, hpred[2];
 
   fseek (ifp, meta_offset, SEEK_SET);
   type = get4();  get4();  get4();
   wide = get4();
   high = get4();
+#ifdef LIBRAW_LIBRARY_BUILD
+  if(wide>32767 || high > 32767 || wide*high > 20000000)
+     throw LIBRAW_EXCEPTION_IO_CORRUPT;
+#endif
   if (type == 2) {
     fread (meta_data, 1, meta_length, ifp);
     for (i=0; i < meta_length; i++) {
       high = (high * 1597 + 51749) % 244944;
       wide = high * (INT64) 301593171 >> 24;

Vulnerable code:   ushort huff[512], vpred[2][2], hpred[2];
  ushort huff[258], vpred[2][2] = {{512,512},{512,512}}, hpred[2];
Fixed code:   ushort huff[1024], vpred[2][2], hpred[2];
  ushort huff[1024], vpred[2][2] = {{512,512},{512,512}}, hpred[2];
#ifdef LIBRAW_LIBRARY_BUILD
  if(wide>32767 || high > 32767 || wide*high > 20000000)
     throw LIBRAW_EXCEPTION_IO_CORRUPT;
#endif
CVE-2017-6890: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: A boundary error within the "foveon_load_camf()" function (dcraw_foveon.c) when initializing a huffman table in LibRaw-demosaic-pack-GPL2 before 0.18.2 can be exploited to cause a stack-based buffer overflow.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2017-05-15T18:29Z
Repository: https://github.com/LibRaw/LibRaw-demosaic-pack-GPL2
Language: C
Files changed: dcraw_foveon.c
Commit date: 2017-03-04 19:55:24 +0300
Commit message: Fixed possible foveon buffer overrun (Secunia SA750000)

Diff: diff --git a/dcraw_foveon.c b/dcraw_foveon.c
index d8b7005..bdde89d 100644
--- a/dcraw_foveon.c
+++ b/dcraw_foveon.c
@@ -317,11 +317,11 @@ void CLASS foveon_huff (ushort *huff)
 }
 
 void CLASS foveon_dp_load_raw()
 {
   unsigned c, roff[4], row, col, diff;
-  ushort huff[512], vpred[2][2], hpred[2];
+  ushort huff[1024], vpred[2][2], hpred[2];
 
   fseek (ifp, 8, SEEK_CUR);
   foveon_huff (huff);
   roff[0] = 48;
   FORC3 roff[c+1] = -(-(roff[c] + get4()) & -16);
@@ -344,16 +344,20 @@ void CLASS foveon_dp_load_raw()
 }
 
 void CLASS foveon_load_camf()
 {
   unsigned type, wide, high, i, j, row, col, diff;
-  ushort huff[258], vpred[2][2] = {{512,512},{512,512}}, hpred[2];
+  ushort huff[1024], vpred[2][2] = {{512,512},{512,512}}, hpred[2];
 
   fseek (ifp, meta_offset, SEEK_SET);
   type = get4();  get4();  get4();
   wide = get4();
   high = get4();
+#ifdef LIBRAW_LIBRARY_BUILD
+  if(wide>32767 || high > 32767 || wide*high > 20000000)
+     throw LIBRAW_EXCEPTION_IO_CORRUPT;
+#endif
   if (type == 2) {
     fread (meta_data, 1, meta_length, ifp);
     for (i=0; i < meta_length; i++) {
       high = (high * 1597 + 51749) % 244944;
       wide = high * (INT64) 301593171 >> 24;

Vulnerable code:   ushort huff[512], vpred[2][2], hpred[2];
  ushort huff[258], vpred[2][2] = {{512,512},{512,512}}, hpred[2];
Fixed code:   ushort huff[1024], vpred[2][2], hpred[2];
  ushort huff[1024], vpred[2][2] = {{512,512},{512,512}}, hpred[2];
#ifdef LIBRAW_LIBRARY_BUILD
  if(wide>32767 || high > 32767 || wide*high > 20000000)
     throw LIBRAW_EXCEPTION_IO_CORRUPT;
#endif
CVE-2015-8842: Permissions, Privileges, and Access Controls (CWE-264)
value: tmpfiles.d/systemd.conf in systemd before 229 uses weak permissions for /var/log/journal/%m/system.journal, which allows local users to obtain sensitive information by reading the file.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
CVSS v3 base score: 3.3
Published: 2016-04-20T16:59Z
Repository: https://github.com/systemd/systemd
Language: Other
Files changed: tmpfiles.d/systemd.conf.m4
Commit date: 2015-11-29 23:38:09 -0500
Commit message: tmpfiles: set acls on system.journal explicitly

https://github.com/systemd/systemd/issues/1397

Diff: diff --git a/tmpfiles.d/systemd.conf.m4 b/tmpfiles.d/systemd.conf.m4
index fcd6ec026..0575408db 100644
--- a/tmpfiles.d/systemd.conf.m4
+++ b/tmpfiles.d/systemd.conf.m4
@@ -31,14 +31,16 @@ a+ /run/log/journal/%m - - - - d:group:adm:r-x,d:group:wheel:r-x
 A+ /run/log/journal/%m - - - - group:adm:r-x,group:wheel:r-x
 '')m4_dnl
 
 z /var/log/journal 2755 root systemd-journal - -
 z /var/log/journal/%m 2755 root systemd-journal - -
+z /var/log/journal/%m/system.journal 0640 root systemd-journal - -
 m4_ifdef(`HAVE_ACL',``
 a+ /var/log/journal    - - - - d:group:adm:r-x,d:group:wheel:r-x
 a+ /var/log/journal    - - - - group:adm:r-x,group:wheel:r-x
 a+ /var/log/journal/%m - - - - d:group:adm:r-x,d:group:wheel:r-x
 a+ /var/log/journal/%m - - - - group:adm:r-x,group:wheel:r-x
+a+ /var/log/journal/%m/system.journal - - - - group:adm:r--,group:wheel:r--
 '')m4_dnl
 
 d /var/lib/systemd 0755 root root -
 d /var/lib/systemd/coredump 0755 root root 3d

Fixed code: z /var/log/journal/%m/system.journal 0640 root systemd-journal - -
a+ /var/log/journal/%m/system.journal - - - - group:adm:r--,group:wheel:r--
CVE-2016-10156: Permissions, Privileges, and Access Controls (CWE-264)
value: A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root. This is fixed in v229.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
CVSS v3 base score: 7.8
Published: 2017-01-23T07:59Z
Repository: https://github.com/systemd/systemd
Language: C
Files changed: src/basic/fs-util.c
Commit date: 2016-01-29 23:41:09 +0200
Commit message: basic: fix touch() creating files with 07777 mode

mode_t is unsigned, so MODE_INVALID < 0 can never be true.

This fixes a possible DoS where any user could fill /run by writing to
a world-writable /run/systemd/show-status.

Diff: diff --git a/src/basic/fs-util.c b/src/basic/fs-util.c
index d31bd6e273..61b651b573 100644
--- a/src/basic/fs-util.c
+++ b/src/basic/fs-util.c
@@ -339,11 +339,12 @@ int touch_file(const char *path, bool parents, usec_t stamp, uid_t uid, gid_t gi
         assert(path);
 
         if (parents)
                 mkdir_parents(path, 0755);
 
-        fd = open(path, O_WRONLY|O_CREAT|O_CLOEXEC|O_NOCTTY, mode > 0 ? mode : 0644);
+        fd = open(path, O_WRONLY|O_CREAT|O_CLOEXEC|O_NOCTTY,
+                        (mode == 0 || mode == MODE_INVALID) ? 0644 : mode);
         if (fd < 0)
                 return -errno;
 
         if (mode != MODE_INVALID) {
                 r = fchmod(fd, mode);

Vulnerable code:         fd = open(path, O_WRONLY|O_CREAT|O_CLOEXEC|O_NOCTTY, mode > 0 ? mode : 0644);
Fixed code:         fd = open(path, O_WRONLY|O_CREAT|O_CLOEXEC|O_NOCTTY,
                        (mode == 0 || mode == MODE_INVALID) ? 0644 : mode);
CVE-2017-9217: NULL Pointer Dereference (CWE-476)
value: systemd-resolved through 233 allows remote attackers to cause a denial of service (daemon crash) via a crafted DNS response with an empty question section.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2017-05-24T05:29Z
Repository: https://github.com/systemd/systemd
Language: C
Files changed: src/resolve/resolved-dns-packet.c
Commit date: 2017-05-24 08:56:48 +0300
Commit message: resolved: bugfix of null pointer p->question dereferencing (#6020)

See https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1621396
Diff: diff --git a/src/resolve/resolved-dns-packet.c b/src/resolve/resolved-dns-packet.c
index 652970284e..240ee448f4 100644
--- a/src/resolve/resolved-dns-packet.c
+++ b/src/resolve/resolved-dns-packet.c
@@ -2267,10 +2267,13 @@ int dns_packet_is_reply_for(DnsPacket *p, const DnsResourceKey *key) {
         /* Let's unpack the packet, if that hasn't happened yet. */
         r = dns_packet_extract(p);
         if (r < 0)
                 return r;
 
+        if (!p->question)
+                return 0;
+
         if (p->question->n_keys != 1)
                 return 0;
 
         return dns_resource_key_equal(p->question->keys[0], key);
 }

Fixed code:         if (!p->question)
                return 0;
CVE-2018-20839: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 9.8
Published: 2019-05-17T04:29Z
Repository: https://github.com/systemd/systemd
Language: Unknown
Commit date: 2019-05-16 16:39:38 +0200
Commit message: Merge pull request #12378 from rbalint/vt-kbd-reset-check

VT kbd reset check
Diff: diff --cc src/basic/terminal-util.h
index f3e785e7ba,b32528f1d0..2a1851c0f1
--- a/src/basic/terminal-util.h
+++ b/src/basic/terminal-util.h
@@@ -154,10 -153,9 +154,11 @@@ int ptsname_namespace(int pty, char **r
  
  int openpt_in_namespace(pid_t pid, int flags);
  int open_terminal_in_namespace(pid_t pid, const char *name, int mode);
  
  int vt_default_utf8(void);
+ int vt_verify_kbmode(int fd);
  int vt_reset_keyboard(int fd);
  int vt_restore(int fd);
  int vt_release(int fd, bool restore_vt);
 +
 +void get_log_colors(int priority, const char **on, const char **off, const char **highlight);
CVE-2019-20386: Missing Release of Memory after Effective Lifetime (CWE-401)
value: An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 2.4
Published: 2020-01-21T06:15Z
Repository: https://github.com/systemd/systemd
Language: C
Files changed: src/login/logind-button.c
Commit date: 2019-05-22 10:44:34 +0200
Commit message: bus_open leak sd_event_source when udevadm trigger。

On my host, when executing the udevadm trigger, I only receive the change event, which causes memleak
Diff: diff --git a/src/login/logind-button.c b/src/login/logind-button.c
index daffbf0668c..1624a31cc30 100644
--- a/src/login/logind-button.c
+++ b/src/login/logind-button.c
@@ -339,11 +339,12 @@ int button_open(Button *b) {
                 r = log_error_errno(errno, "Failed to get input name: %m");
                 goto fail;
         }
 
         (void) button_set_mask(b);
-
+        
+        b->io_event_source = sd_event_source_unref(b->io_event_source);
         r = sd_event_add_io(b->manager->event, &b->io_event_source, b->fd, EPOLLIN, button_dispatch, b);
         if (r < 0) {
                 log_error_errno(r, "Failed to add button event: %m");
                 goto fail;
         }

Fixed code:         
        b->io_event_source = sd_event_source_unref(b->io_event_source);
CVE-2020-1712: Use After Free (CWE-416)
value: A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.8
Published: 2020-03-31T17:15Z
Repository: https://github.com/systemd/systemd
Language: Unknown
Commit date: 2020-02-05 10:16:59 +0100
Commit message: Merge branch 'polkit-ref-count'
CVE-2021-33910: Allocation of Resources Without Limits or Throttling (CWE-770)
value: basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 5.5
Published: 2021-07-20T19:15Z
Repository: https://github.com/systemd/systemd
Language: Unknown
Commit date: 2021-07-20 14:39:23 +0200
Commit message: Merge pull request #20256 from keszybz/one-alloca-too-many

 basic/unit-name: do not use strdupa() on a path
CVE-2022-2526: Use After Free (CWE-416)
value: A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream object, causing the use-after-free when the reference is still used later.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 9.8
Published: 2022-09-09T15:15Z
Repository: https://github.com/systemd/systemd
Language: C
Files changed: src/resolve/resolved-dns-stream.c
Commit date: 2018-12-07 17:22:59 +0100
Commit message: resolved: pin stream while calling callbacks for it

These callbacks might unref the stream, but we still have to access it,
let's hence ref it explicitly.

Maybe fixes: #10725

Diff: diff --git a/src/resolve/resolved-dns-stream.c b/src/resolve/resolved-dns-stream.c
index d35c875e473..deb5abac5be 100644
--- a/src/resolve/resolved-dns-stream.c
+++ b/src/resolve/resolved-dns-stream.c
@@ -44,10 +44,12 @@ static int dns_stream_update_io(DnsStream *s) {
 
         return sd_event_source_set_io_events(s->io_event_source, f);
 }
 
 static int dns_stream_complete(DnsStream *s, int error) {
+        _cleanup_(dns_stream_unrefp) _unused_ DnsStream *ref = dns_stream_ref(s); /* Protect stream while we process it */
+
         assert(s);
 
 #if ENABLE_DNS_OVER_TLS
         if (s->encrypted) {
                 int r;
@@ -271,11 +273,11 @@ static int on_stream_timeout(sd_event_source *es, usec_t usec, void *userdata) {
 
         return dns_stream_complete(s, ETIMEDOUT);
 }
 
 static int on_stream_io(sd_event_source *es, int fd, uint32_t revents, void *userdata) {
-        DnsStream *s = userdata;
+        _cleanup_(dns_stream_unrefp) DnsStream *s = dns_stream_ref(userdata); /* Protect stream while we process it */
         int r;
 
         assert(s);
 
 #if ENABLE_DNS_OVER_TLS

Vulnerable code:         DnsStream *s = userdata;
Fixed code:         _cleanup_(dns_stream_unrefp) _unused_ DnsStream *ref = dns_stream_ref(s); /* Protect stream while we process it */

        _cleanup_(dns_stream_unrefp) DnsStream *s = dns_stream_ref(userdata); /* Protect stream while we process it */