Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2014-2552: Permissions, Privileges, and Access Controls (CWE-264)
value: Brookins Consulting (BC) Collected Information Export extension for eZ Publish 1.1.0 does not properly restrict access, which allows remote attackers to gain access to sensitive data.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
CVSS v3 base score: 9.8
Published: 2018-04-27T16:29Z
Repository: https://github.com/brookinsconsulting/bccie
Language: PHP
Files changed: settings/site.ini.append.php
Commit date: 2014-03-12 19:41:18 -0500
Commit message: Updated: Commented out role policy override settings for greater default security of cie information

Diff: diff --git a/settings/site.ini.append.php b/settings/site.ini.append.php
index 10ef68e..e7d1cec 100755
--- a/settings/site.ini.append.php
+++ b/settings/site.ini.append.php
@@ -4,11 +4,14 @@
 # ExtensionAutoloadPath[]=bccie
 
 [RegionalSettings]
 TranslationExtensions[]=bccie
 
-[RoleSettings]
-PolicyOmitList[]=bccie/overview
-PolicyOmitList[]=bccie/export
-PolicyOmitList[]=bccie/doexport
+#
+# Uncomment the following to enable module views regardless of missing role policy configuration
+#
+# [RoleSettings]
+# PolicyOmitList[]=bccie/overview
+# PolicyOmitList[]=bccie/export
+# PolicyOmitList[]=bccie/doexport
 
 */ ?>
\ No newline at end of file

Vulnerable code: [RoleSettings]
PolicyOmitList[]=bccie/overview
PolicyOmitList[]=bccie/export
PolicyOmitList[]=bccie/doexport
Fixed code: #
# Uncomment the following to enable module views regardless of missing role policy configuration
#
# [RoleSettings]
# PolicyOmitList[]=bccie/overview
# PolicyOmitList[]=bccie/export
# PolicyOmitList[]=bccie/doexport
CVE-2018-25075: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability classified as critical has been found in karsany OBridge up to 1.3. Affected is the function getAllStandaloneProcedureAndFunction of the file obridge-main/src/main/java/org/obridge/dao/ProcedureDao.java. The manipulation leads to sql injection. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.4 is able to address this issue. The name of the patch is 52eca4ad05f3c292aed3178b2f58977686ffa376. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218376.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-15T20:15Z
Repository: https://github.com/karsany/obridge
Language: Java
Files changed: obridge-main/src/main/java/org/obridge/dao/ProcedureDao.java
Commit date: 2018-06-28 19:22:26 +0200
Commit message: sql injection fix.

Diff: diff --git a/obridge-main/src/main/java/org/obridge/dao/ProcedureDao.java b/obridge-main/src/main/java/org/obridge/dao/ProcedureDao.java
index ce60378..10a43b0 100644
--- a/obridge-main/src/main/java/org/obridge/dao/ProcedureDao.java
+++ b/obridge-main/src/main/java/org/obridge/dao/ProcedureDao.java
@@ -195,15 +195,15 @@ public class ProcedureDao {
         oraclePackage.setProcedureList(getAllSimpleFunctionAndProcedure());
         return oraclePackage;
     }
 
     private List<OraclePackage> getAllRealOraclePackage(OBridgeConfiguration c) {
-        String query = "select object_name from user_objects where object_type = 'PACKAGE' and object_name like '" + c.getPackagesLike() + "'";
+        String query = "select object_name from user_objects where object_type = 'PACKAGE' and object_name like ?";
         return jdbcTemplate.query(query, (resultSet, i) -> {
             OraclePackage p = new OraclePackage();
             p.setName(resultSet.getString("object_name"));
             p.setProcedureList(getAllProcedure(resultSet.getString("object_name"), ""));
             return p;
-        });
+        }, c.getPackagesLike());
     }
 
 }

Vulnerable code:         String query = "select object_name from user_objects where object_type = 'PACKAGE' and object_name like '" + c.getPackagesLike() + "'";
        });
Fixed code:         String query = "select object_name from user_objects where object_type = 'PACKAGE' and object_name like ?";
        }, c.getPackagesLike());
CVE-2023-42821: Out-of-bounds Read (CWE-125)
value: The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion `0.0.0-20230922105210-14b16010c2ee`, which corresponds with commit `14b16010c2ee7ff33a940a541d993bd043a88940`, parsing malformed markdown input with parser that uses parser.Mmark extension could result in out-of-bounds read vulnerability. To exploit the vulnerability, parser needs to have `parser.Mmark` extension set. The panic occurs inside the `citation.go` file on the line 69 when the parser tries to access the element past its length. This can result in a denial of service. Commit `14b16010c2ee7ff33a940a541d993bd043a88940`/pseudoversion `0.0.0-20230922105210-14b16010c2ee` contains a patch for this issue.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2023-09-22T17:15Z
Repository: https://github.com/gomarkdown/markdown
Language: Go
Files changed: parser/block.go, parser/citation.go
Commit date: 2023-09-22 06:52:10 -0400
Commit message: fix out-of-bounds read

Diff: diff --git a/parser/block.go b/parser/block.go
index 028ae75..4b7326e 100644
--- a/parser/block.go
+++ b/parser/block.go
@@ -189,10 +189,15 @@ func (p *Parser) Block(data []byte) {
 		// block of preformatted HTML:
 		//
 		// <div>
 		//     ...
 		// </div>
+
+		if len(data) == 0 {
+			continue
+		}
+
 		if data[0] == '<' {
 			if i := p.html(data, true); i > 0 {
 				data = data[i:]
 				continue
 			}
@@ -391,11 +396,11 @@ func (p *Parser) AddBlock(n ast.Node) ast.Node {
 	}
 	return p.addChild(n)
 }
 
 func (p *Parser) isPrefixHeading(data []byte) bool {
-	if data[0] != '#' {
+	if len(data) > 0 && data[0] != '#' {
 		return false
 	}
 
 	if p.extensions&SpaceHeadings != 0 {
 		level := skipCharN(data, 0, '#', 6)
diff --git a/parser/citation.go b/parser/citation.go
index 8ea1fbe..217d4de 100644
--- a/parser/citation.go
+++ b/parser/citation.go
@@ -63,10 +63,15 @@ func citation(p *Parser, data []byte, offset int) (int, ast.Node) {
 			citation = part
 			suffix = suff
 		}
 
 		citeType := ast.CitationTypeInformative
+
+		if len(citation) < 2 {
+			continue
+		}
+
 		j = 1
 		switch citation[j] {
 		case '!':
 			citeType = ast.CitationTypeNormative
 			j++

Vulnerable code: 	if data[0] != '#' {
Fixed code: 
		if len(data) == 0 {
			continue
		}

	if len(data) > 0 && data[0] != '#' {

		if len(citation) < 2 {
			continue
		}
CVE-2016-10554: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. Before version 1.7.0-alpha3, sequelize defaulted SQLite to use MySQL backslash escaping, even though SQLite uses Postgres escaping.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2018-05-31T20:29Z
Repository: https://github.com/sequelize/sequelize
Language: JavaScript
Files changed: lib/sql-string.js
Commit date: 2013-06-14 23:29:14 -0400
Commit message: Fix string escaping for sqlite

SQLite was defaulting to the MySQL backslash-escaped style, but it uses
postgres-style escaping. This is a SQL-injection vulnerability, and
shouldn't be taken lightly (although SQLite is mostly for testing).

Diff: diff --git a/lib/sql-string.js b/lib/sql-string.js
index 96be2c7..160dfa4 100644
--- a/lib/sql-string.js
+++ b/lib/sql-string.js
@@ -35,12 +35,13 @@ SqlString.escape = function(val, stringifyObjects, timeZone, dialect) {
     } else {
       return SqlString.objectToValues(val, timeZone);
     }
   }
 
-  if (dialect == "postgres") {
+  if (dialect === "postgres" || dialect === "sqlite") {
     // http://www.postgresql.org/docs/8.2/static/sql-syntax-lexical.html#SQL-SYNTAX-STRINGS
+    // http://stackoverflow.com/q/603572/130598
     val = val.replace(/'/g, "''");
   } else {
     val = val.replace(/[\0\n\r\b\t\\\'\"\x1a]/g, function(s) {
       switch(s) {
         case "\0": return "\\0";

Vulnerable code:   if (dialect == "postgres") {
Fixed code:   if (dialect === "postgres" || dialect === "sqlite") {
    // http://stackoverflow.com/q/603572/130598
CVE-2013-7299: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: framework/common/messageheaderparser.cpp in Tntnet before 2.2.1 allows remote attackers to obtain sensitive information via a header that ends in \n instead of \r\n, which prevents a null terminator from being added and causes Tntnet to include headers from other requests.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Published: 2014-01-26T20:55Z
Repository: https://github.com/maekitalo/tntnet
Language: C++
Files changed: framework/common/messageheaderparser.cpp
Commit date: 2013-12-11 14:59:32 +0100
Commit message: fix possible information leak

Diff: diff --git a/framework/common/messageheaderparser.cpp b/framework/common/messageheaderparser.cpp
index 0c74c70..7bb5d6c 100644
--- a/framework/common/messageheaderparser.cpp
+++ b/framework/common/messageheaderparser.cpp
@@ -202,10 +202,11 @@ namespace tnt
         case FAIL: failedFlag = true;
                    log_warn("invalid character " << chartoprint(ch) << " in fieldbody");
                    break;
       }
 
+      *headerdataPtr = '\0';
       return true;
     }
     else if (std::isspace(ch))
     {
       // continuation line
@@ -257,11 +258,14 @@ namespace tnt
   }
 
   void Messageheader::Parser::checkHeaderspace(unsigned chars) const
   {
     if (headerdataPtr + chars >= header.rawdata + sizeof(header.rawdata))
+    {
+      header.rawdata[sizeof(header.rawdata) - 1] = '\0';
       throw HttpError(HTTP_REQUEST_ENTITY_TOO_LARGE, "header too large");
+    }
   }
 
   void Messageheader::Parser::reset()
   {
     failedFlag = false;

Fixed code:       *headerdataPtr = '\0';
    {
      header.rawdata[sizeof(header.rawdata) - 1] = '\0';
    }
CVE-2019-10795: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: undefsafe before 2.0.3 is vulnerable to Prototype Pollution. The 'a' function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 6.3
Published: 2020-02-18T16:15Z
Repository: https://github.com/remy/undefsafe
Language: JavaScript
Files changed: lib/undefsafe.js, test/misc.test.js
Commit date: 2020-02-17 18:47:54 +0000
Commit message: fix: prevent changes in prototype chain

Diff: diff --git a/lib/undefsafe.js b/lib/undefsafe.js
index 60663b0..7446878 100644
--- a/lib/undefsafe.js
+++ b/lib/undefsafe.js
@@ -97,10 +97,14 @@ function undefsafe(obj, path, value, __res) {
       }
 
       return res;
     }
 
+    if (Object.getOwnPropertyNames(obj).indexOf(key) == -1) {
+      return undefined;
+    }
+
     obj = obj[key];
     if (obj === undefined || obj === null) {
       break;
     }
   }
diff --git a/test/misc.test.js b/test/misc.test.js
new file mode 100644
index 0000000..b871f76
--- /dev/null
+++ b/test/misc.test.js
@@ -0,0 +1,11 @@
+var test = require('tap').test;
+var undefsafe = require('../lib/undefsafe');
+
+test('cannot modify prototype chain', function(t) {
+  const pre = {}.__proto__.toString;
+  var payload = '__proto__.toString';
+  undefsafe({ a: 'b' }, payload, 'JHU');
+  t.notEqual({}.toString, 'JHU');
+  ({}.__proto__.toString = pre); // restore
+  t.end();
+});

Fixed code:     if (Object.getOwnPropertyNames(obj).indexOf(key) == -1) {
      return undefined;
    }

var test = require('tap').test;
var undefsafe = require('../lib/undefsafe');

test('cannot modify prototype chain', function(t) {
  const pre = {}.__proto__.toString;
  var payload = '__proto__.toString';
  undefsafe({ a: 'b' }, payload, 'JHU');
  t.notEqual({}.toString, 'JHU');
  ({}.__proto__.toString = pre); // restore
  t.end();
});
CVE-2023-27478: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: libmemcached-awesome is an open source C/C++ client library and tools for the memcached server. `libmemcached` could return data for a previously requested key, if that previous request timed out due to a low `POLL_TIMEOUT`. This issue has been addressed in version 1.1.4. Users are advised to upgrade. There are several ways to workaround or lower the probability of this bug affecting a given deployment. 1: use a reasonably high `POLL_TIMEOUT` setting, like the default. 2: use separate libmemcached connections for unrelated data. 3: do not re-use libmemcached connections in an unknown state.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 6.5
Published: 2023-03-07T18:15Z
Repository: https://github.com/awesomized/libmemcached
Language: C++
Files changed: src/libmemcached/purge.cc, src/libmemcached/response.cc, test/tests/memcached/noblock.cpp
Commit date: 2023-03-01 17:14:48 +0100
Commit message: revert most of d7a0084bf99d618d1dc26a54fd413db7ae8b8e63

See php-memcached-dev/php-memcached#531

Diff: diff --git a/src/libmemcached/purge.cc b/src/libmemcached/purge.cc
index a8da0f38..ff032105 100644
--- a/src/libmemcached/purge.cc
+++ b/src/libmemcached/purge.cc
@@ -106,13 +106,10 @@ bool memcached_purge(memcached_instance_st *ptr) {
           or rc == MEMCACHED_READ_FAILURE)
       {
         WATCHPOINT_ERROR(rc);
         is_successful = false;
       }
-      if (rc == MEMCACHED_TIMEOUT) {
-        break;
-      }
 
       if (ptr->root->callbacks) {
         memcached_callback_st cb = *ptr->root->callbacks;
         if (memcached_success(rc)) {
           for (uint32_t y = 0; y < cb.number_of_callback; y++) {
diff --git a/src/libmemcached/response.cc b/src/libmemcached/response.cc
index 7e4610b5..d3945133 100644
--- a/src/libmemcached/response.cc
+++ b/src/libmemcached/response.cc
@@ -759,11 +759,11 @@ static memcached_return_t _read_one_response(memcached_instance_st *instance, ch
     } while (rc == MEMCACHED_FETCH_NOTFINISHED);
   } else {
     rc = textual_read_one_response(instance, buffer, buffer_length, result);
   }
 
-  if (memcached_fatal(rc) && rc != MEMCACHED_TIMEOUT) {
+  if (memcached_fatal(rc)) {
     memcached_io_reset(instance);
   }
 
   return rc;
 }
diff --git a/test/tests/memcached/noblock.cpp b/test/tests/memcached/noblock.cpp
index f2de04ad..307c4e3a 100644
--- a/test/tests/memcached/noblock.cpp
+++ b/test/tests/memcached/noblock.cpp
@@ -21,13 +21,10 @@ TEST_CASE("memcached_noblock") {
     case MEMCACHED_BUFFERED:
     case MEMCACHED_SERVER_TEMPORARILY_DISABLED:
       break;
     case MEMCACHED_TIMEOUT:
     case MEMCACHED_WRITE_FAILURE:
-      if(!timeout) {
-        --i;
-      }
       ++hit;
       REQUIRE(true);
       break;
     default:
       REQUIRE(false);

Vulnerable code:       if (rc == MEMCACHED_TIMEOUT) {
        break;
      }
  if (memcached_fatal(rc) && rc != MEMCACHED_TIMEOUT) {
      if(!timeout) {
        --i;
      }
Fixed code:   if (memcached_fatal(rc)) {
CVE-2021-31414: Insufficient Information (NVD-CWE-noinfo)
value: The unofficial vscode-rpm-spec extension before 0.3.2 for Visual Studio Code allows remote code execution via a crafted workspace configuration.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2021-04-16T04:15Z
Repository: https://github.com/LaurentTreguier/vscode-rpm-spec
Language: JSON
Files changed: package.json
Commit date: 2021-04-15 20:00:14 +0200
Commit message: Add scopes to configuration points

Diff: diff --git a/package.json b/package.json
index 29e8136..02dae4a 100644
--- a/package.json
+++ b/package.json
@@ -50,16 +50,18 @@
             "title": "RPM spec configuration",
             "properties": {
                 "rpmspec.lint": {
                     "type": "boolean",
                     "default": true,
-                    "description": "Lint RPM spec files with rpmlint"
+                    "description": "Lint RPM spec files with rpmlint",
+                    "scope": "machine"
                 },
                 "rpmspec.rpmlintPath": {
                     "type": "string",
                     "default": "rpmlint",
-                    "description": "Path to 'rpmlint' command"
+                    "description": "Path to 'rpmlint' command",
+                    "scope": "machine"
                 }
             }
         }
     },
     "scripts": {

Vulnerable code:                     "description": "Lint RPM spec files with rpmlint"
                    "description": "Path to 'rpmlint' command"
Fixed code:                     "description": "Lint RPM spec files with rpmlint",
                    "scope": "machine"
                    "description": "Path to 'rpmlint' command",
                    "scope": "machine"
CVE-2021-44896: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: DMP Roadmap before 3.0.4 allows XSS.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-01-01T23:15Z
Repository: https://github.com/DMPRoadmap/roadmap
Language: Unknown
Commit date: 2021-09-27 09:55:56 -0700
Commit message: Merge branch 'development' into remove_vulnerability_XSS_hack
CVE-2017-0904: Improper Handling of Exceptional Conditions (CWE-755)
value: The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private network addresses to prevent server-side request forgery.
CWE description: The product does not handle or incorrectly handles an exceptional condition.
CVSS v3 base score: 8.1
Published: 2017-11-13T17:29Z
Repository: https://github.com/jtdowney/private_address_check
Language: Ruby
Files changed: lib/private_address_check.rb, test/private_address_check_test.rb
Commit date: 2017-11-05 14:53:34 -0600
Commit message: Fix bypass bug with malformed addresses

The Ruby Resolv library can return an empty array from getaddresses for
some atypical IP address encodings. This was brought to my attention by
@EdOverflow.

Diff: diff --git a/lib/private_address_check.rb b/lib/private_address_check.rb
index b1d2995..3b82a43 100644
--- a/lib/private_address_check.rb
+++ b/lib/private_address_check.rb
@@ -29,10 +29,12 @@ module PrivateAddressCheck
     end
   end
 
   def resolves_to_private_address?(hostname)
     ips = Resolv.getaddresses(hostname)
+    return true if ips.empty?
+
     ips.any? do |ip| 
       private_address?(ip)
     end
   end
 end
diff --git a/test/private_address_check_test.rb b/test/private_address_check_test.rb
index 6560751..2afdf79 100644
--- a/test/private_address_check_test.rb
+++ b/test/private_address_check_test.rb
@@ -33,6 +33,10 @@ class PrivateAddressCheckTest < Minitest::Test
   end
 
   def test_private_hostname_for_private_addresses
     assert PrivateAddressCheck.resolves_to_private_address?("localhost")
   end
+
+  def test_private_address_for_malformed_addresses
+    assert PrivateAddressCheck.resolves_to_private_address?("127.1")
+  end
 end

Fixed code:     return true if ips.empty?


  def test_private_address_for_malformed_addresses
    assert PrivateAddressCheck.resolves_to_private_address?("127.1")
  end
CVE-2014-3587: Numeric Errors (CWE-189)
value: Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1571.
CWE description: Weaknesses in this category are related to improper calculation or conversion of numbers.
Published: 2014-08-23T01:55Z
Repository: https://github.com/php/php-src
Language: Other
Files changed: NEWS, ext/fileinfo/libmagic/cdf.c
Commit date: 2014-08-14 17:44:19 -0700
Commit message: Fix bug #67716 - Segfault in cdf.c

Diff: diff --git a/NEWS b/NEWS
index 473f96a35e7..9805a719d34 100644
--- a/NEWS
+++ b/NEWS
@@ -6,10 +6,11 @@ PHP                                                                        NEWS
   . Fixed missing type checks in com_event_sink (Yussuf Khalil, Stas).
 
 - Fileinfo:
   . Fixed bug #67705 (extensive backtracking in rule regular expression).
     (CVE-2014-3538) (Remi)
+  . Fixed bug #67716 (Segfault in cdf.c). (CVE-2014-3587) (Remi)
 
 - GD:
   . Fixed bug #66901 (php-gd 'c_color' NULL pointer dereference).
     (CVE-2014-2497) (Remi)
 
diff --git a/ext/fileinfo/libmagic/cdf.c b/ext/fileinfo/libmagic/cdf.c
index 429f3b952f6..2c0a2d9dfcd 100644
--- a/ext/fileinfo/libmagic/cdf.c
+++ b/ext/fileinfo/libmagic/cdf.c
@@ -818,11 +818,11 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 			goto out;
 		ofs = CDF_GETUINT32(p, tail);
 		q = (const uint8_t *)(const void *)
 		    ((const char *)(const void *)p + ofs
 		    - 2 * sizeof(uint32_t));
-		if (q > e) {
+		if (q < p || q > e) {
 			DPRINTF(("Ran of the end %p > %p\n", q, e));
 			goto out;
 		}
 		inp[i].pi_id = CDF_GETUINT32(p, i << 1);
 		inp[i].pi_type = CDF_GETUINT32(q, 0);

Vulnerable code: 		if (q > e) {
Fixed code:   . Fixed bug #67716 (Segfault in cdf.c). (CVE-2014-3587) (Remi)
		if (q < p || q > e) {
CVE-2014-4049: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Heap-based buffer overflow in the php_parserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier allows remote servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS TXT record, related to the dns_get_record function.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2014-06-18T19:55Z
Repository: https://github.com/php/php-src
Language: Unknown
Commit date: 2014-06-11 13:53:59 -0700
Commit message: Merge branch 'PHP-5.6'

* PHP-5.6:
  Fix potential segfault in dns_get_record()
CVE-2015-8617: Use of Externally-Controlled Format String (CWE-134)
value: Format string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format string specifiers in a string that is misused as a class name, leading to incorrect error handling.
CWE description: The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
CVSS v3 base score: 9.8
Published: 2016-01-19T05:59Z
Repository: https://github.com/php/php-src
Language: C
Files changed: Zend/zend_execute_API.c
Commit date: 2015-12-12 18:45:11 -0800
Commit message: Use format string

Diff: diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 9979aac2560..fdffed34b27 100644
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -216,11 +216,11 @@ static void zend_throw_or_error(int fetch_type, zend_class_entry *exception_ce,
 
 	va_start(va, format);
 	zend_vspprintf(&message, 0, format, va);
 
 	if (fetch_type & ZEND_FETCH_CLASS_EXCEPTION) {
-		zend_throw_error(exception_ce, message);
+		zend_throw_error(exception_ce, "%s", message);
 	} else {
 		zend_error(E_ERROR, "%s", message);
 	}
 
 	efree(message);

Vulnerable code: 		zend_throw_error(exception_ce, message);
Fixed code: 		zend_throw_error(exception_ce, "%s", message);
CVE-2016-10158: Numeric Errors (CWE-189)
value: The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (application crash) via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1.
CWE description: Weaknesses in this category are related to improper calculation or conversion of numbers.
CVSS v3 base score: 7.5
Published: 2017-01-24T21:59Z
Repository: https://github.com/php/php-src
Language: C
Files changed: ext/exif/exif.c, ext/exif/tests/bug73737.phpt
Commit date: 2016-12-31 19:31:49 -0800
Commit message: Fix bug #73737 FPE when parsing a tag format

Diff: diff --git a/ext/exif/exif.c b/ext/exif/exif.c
index 8b0e34c10dc..83daee6f54f 100644
--- a/ext/exif/exif.c
+++ b/ext/exif/exif.c
@@ -1301,11 +1301,11 @@ static size_t exif_convert_any_to_int(void *value, int format, int motorola_inte
 		case TAG_FMT_SRATIONAL:
 			s_den = php_ifd_get32s(4+(char *)value, motorola_intel);
 			if (s_den == 0) {
 				return 0;
 			} else {
-				return php_ifd_get32s(value, motorola_intel) / s_den;
+				return (size_t)((double)php_ifd_get32s(value, motorola_intel) / s_den);
 			}
 
 		case TAG_FMT_SSHORT:    return php_ifd_get16u(value, motorola_intel);
 		case TAG_FMT_SLONG:     return php_ifd_get32s(value, motorola_intel);
 
diff --git a/ext/exif/tests/bug73737.phpt b/ext/exif/tests/bug73737.phpt
new file mode 100644
index 00000000000..21eaf80585b
--- /dev/null
+++ b/ext/exif/tests/bug73737.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #73737 (Crash when parsing a tag format)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+	$exif = exif_thumbnail(__DIR__ . '/bug73737.tiff');
+	var_dump($exif);
+?>
+--EXPECTF--
+Warning: exif_thumbnail(bug73737.tiff): Error in TIFF: filesize(x0030) less than start of IFD dir(x10102) in %s line %d
+bool(false)
diff --git a/ext/exif/tests/bug73737.tiff b/ext/exif/tests/bug73737.tiff
new file mode 100644
index 00000000000..2cb036fc473
Binary files /dev/null and b/ext/exif/tests/bug73737.tiff differ

Vulnerable code: 				return php_ifd_get32s(value, motorola_intel) / s_den;
Fixed code: 				return (size_t)((double)php_ifd_get32s(value, motorola_intel) / s_den);
--TEST--
Bug #73737 (Crash when parsing a tag format)
--SKIPIF--
<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
--FILE--
<?php
	$exif = exif_thumbnail(__DIR__ . '/bug73737.tiff');
	var_dump($exif);
?>
--EXPECTF--
Warning: exif_thumbnail(bug73737.tiff): Error in TIFF: filesize(x0030) less than start of IFD dir(x10102) in %s line %d
bool(false)
CVE-2016-1904: Numeric Errors (CWE-189)
value: Multiple integer overflows in ext/standard/exec.c in PHP 7.x before 7.0.2 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a long string to the (1) php_escape_shell_cmd or (2) php_escape_shell_arg function, leading to a heap-based buffer overflow.
CWE description: Weaknesses in this category are related to improper calculation or conversion of numbers.
CVSS v3 base score: 7.3
Published: 2016-01-19T05:59Z
Repository: https://github.com/php/php-src
Language: C
Files changed: ext/standard/exec.c
Commit date: 2016-01-06 07:49:21 +0100
Commit message: Patch for Heap Buffer Overflow in EscapeShell

Proposed patch for bug #71270

Diff: diff --git a/ext/standard/exec.c b/ext/standard/exec.c
index c724b795357..c4afce33373 100644
--- a/ext/standard/exec.c
+++ b/ext/standard/exec.c
@@ -251,11 +251,11 @@ PHPAPI zend_string *php_escape_shell_cmd(char *str)
 #ifndef PHP_WIN32
 	char *p = NULL;
 #endif
 
 
-	cmd = zend_string_alloc(2 * l, 0);
+	cmd = zend_string_safe_alloc(2, l, 0, 0);
 
 	for (x = 0, y = 0; x < l; x++) {
 		int mb_len = php_mblen(str + x, (l - x));
 
 		/* skip non-valid multibyte characters */
@@ -343,11 +343,11 @@ PHPAPI zend_string *php_escape_shell_arg(char *str)
 	int x, y = 0, l = (int)strlen(str);
 	zend_string *cmd;
 	size_t estimate = (4 * l) + 3;
 
 
-	cmd = zend_string_alloc(4 * l + 2, 0); /* worst case */
+	cmd = zend_string_safe_alloc(4, l, 2, 0); /* worst case */
 
 #ifdef PHP_WIN32
 	ZSTR_VAL(cmd)[y++] = '"';
 #else
 	ZSTR_VAL(cmd)[y++] = '\'';

Vulnerable code: 	cmd = zend_string_alloc(2 * l, 0);
	cmd = zend_string_alloc(4 * l + 2, 0); /* worst case */
Fixed code: 	cmd = zend_string_safe_alloc(2, l, 0, 0);
	cmd = zend_string_safe_alloc(4, l, 2, 0); /* worst case */
CVE-2016-3132: Double Free (CWE-415)
value: Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 9.8
Published: 2016-08-07T10:59Z
Repository: https://github.com/php/php-src
Language: Other
Files changed: NEWS, ext/spl/spl_dllist.c, ext/spl/tests/bug71735.phpt
Commit date: 2016-03-20 22:29:08 -0700
Commit message: Fix bug #71735: Double-free in SplDoublyLinkedList::offsetSet

Diff: diff --git a/NEWS b/NEWS
index 3fd121c0300..fc6a40b806e 100644
--- a/NEWS
+++ b/NEWS
@@ -28,10 +28,11 @@ PHP                                                                        NEWS
   . Fixed bug #71838 (Deserializing serialized SPLObjectStorage-Object can't
     access properties in PHP). (Nikita)
   . Fixed bug #52339 (SPL autoloader breaks class_exists()). (Nikita)
   . Fixed bug #67582 (Cloned SplObjectStorage with overwritten getHash fails
     offsetExists()). (Nikita)
+  . Fixed bug #71735 (Double-free in SplDoublyLinkedList::offsetSet). (Stas)
 
 - Standard:
   . Fixed bug #71837 (Wrong arrays behaviour). (Laruence)
   . Fixed bug #71840 (Unserialize accepts wrongly data). (Ryat, Laruence)
 
diff --git a/ext/spl/spl_dllist.c b/ext/spl/spl_dllist.c
index aa0c6c38407..1675c7eaf3a 100644
--- a/ext/spl/spl_dllist.c
+++ b/ext/spl/spl_dllist.c
@@ -828,11 +828,10 @@ SPL_METHOD(SplDoublyLinkedList, offsetSet)
 		spl_ptr_llist_element *element;
 
 		index = spl_offset_convert_to_long(zindex);
 
 		if (index < 0 || index >= intern->llist->count) {
-			zval_ptr_dtor(value);
 			zend_throw_exception(spl_ce_OutOfRangeException, "Offset invalid or out of range", 0);
 			return;
 		}
 
 		element = spl_ptr_llist_offset(intern->llist, index, intern->flags & SPL_DLLIST_IT_LIFO);
diff --git a/ext/spl/tests/bug71735.phpt b/ext/spl/tests/bug71735.phpt
new file mode 100644
index 00000000000..92568028c4a
--- /dev/null
+++ b/ext/spl/tests/bug71735.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #71735 (Double-free in SplDoublyLinkedList::offsetSet)
+--FILE--
+<?php
+try {
+$var_1=new SplStack();
+$var_1->offsetSet(100,new DateTime('2000-01-01'));
+} catch(OutOfRangeException $e) {
+	print $e->getMessage()."\n";
+}
+?>
+===DONE===
+--EXPECT--
+Offset invalid or out of range
+===DONE===
\ No newline at end of file

Vulnerable code: 			zval_ptr_dtor(value);
Fixed code:   . Fixed bug #71735 (Double-free in SplDoublyLinkedList::offsetSet). (Stas)
--TEST--
Bug #71735 (Double-free in SplDoublyLinkedList::offsetSet)
--FILE--
<?php
try {
$var_1=new SplStack();
$var_1->offsetSet(100,new DateTime('2000-01-01'));
} catch(OutOfRangeException $e) {
	print $e->getMessage()."\n";
}
?>
===DONE===
--EXPECT--
Offset invalid or out of range
===DONE===
CVE-2016-5096: Integer Overflow or Wraparound (CWE-190)
value: Integer overflow in the fread function in ext/standard/file.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer in the second argument.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 8.6
Published: 2016-08-07T10:59Z
Repository: https://github.com/php/php-src
Language: C
Files changed: ext/standard/file.c, ext/standard/tests/file/bug72114.phpt
Commit date: 2016-05-09 21:55:29 -0700
Commit message: Fix bug #72114 - int/size_t confusion in fread

Diff: diff --git a/ext/standard/file.c b/ext/standard/file.c
index 0abc022ca6b..e39c84f1cd4 100644
--- a/ext/standard/file.c
+++ b/ext/standard/file.c
@@ -1756,10 +1756,16 @@ PHPAPI PHP_FUNCTION(fread)
 	if (len <= 0) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter must be greater than 0");
 		RETURN_FALSE;
 	}
 
+	if (len > INT_MAX) {
+		/* string length is int in 5.x so we can not read more than int */
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter must be no more than %d", INT_MAX);
+		RETURN_FALSE;
+	}
+
 	Z_STRVAL_P(return_value) = emalloc(len + 1);
 	Z_STRLEN_P(return_value) = php_stream_read(stream, Z_STRVAL_P(return_value), len);
 
 	/* needed because recv/read/gzread doesnt put a null at the end*/
 	Z_STRVAL_P(return_value)[Z_STRLEN_P(return_value)] = 0;
diff --git a/ext/standard/tests/file/bug72114.phpt b/ext/standard/tests/file/bug72114.phpt
new file mode 100644
index 00000000000..5e591ee478e
--- /dev/null
+++ b/ext/standard/tests/file/bug72114.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #72114 (Integer underflow / arbitrary null write in fread/gzread)
+--FILE--
+<?php
+ini_set('memory_limit', "2500M");
+$fp = fopen("/dev/zero", "r");
+fread($fp, 2147483648);
+?>
+Done
+--EXPECTF--
+Warning: fread(): Length parameter must be no more than 2147483647 in %s/bug72114.php on line %d
+Done

Fixed code: 	if (len > INT_MAX) {
		/* string length is int in 5.x so we can not read more than int */
		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length parameter must be no more than %d", INT_MAX);
		RETURN_FALSE;
	}

--TEST--
Bug #72114 (Integer underflow / arbitrary null write in fread/gzread)
--FILE--
<?php
ini_set('memory_limit', "2500M");
$fp = fopen("/dev/zero", "r");
fread($fp, 2147483648);
?>
Done
--EXPECTF--
Warning: fread(): Length parameter must be no more than 2147483647 in %s/bug72114.php on line %d
Done
CVE-2016-5772: Double Free (CWE-415)
value: Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddx_deserialize call.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 9.8
Published: 2016-08-07T10:59Z
Repository: https://github.com/php/php-src
Language: C
Files changed: ext/wddx/tests/bug72340.phpt, ext/wddx/wddx.c
Commit date: 2016-06-12 23:18:23 -0700
Commit message: Fix bug #72340: Double Free Courruption in wddx_deserialize

Diff: diff --git a/ext/wddx/tests/bug72340.phpt b/ext/wddx/tests/bug72340.phpt
new file mode 100644
index 00000000000..8d694ca52e7
--- /dev/null
+++ b/ext/wddx/tests/bug72340.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Bug #72340: Double Free Courruption in wddx_deserialize
+--SKIPIF--
+<?php
+if (!extension_loaded("wddx")) print "skip";
+?>
+--FILE--
+<?php
+$xml = <<<EOF
+<?xml version='1.0' ?>
+<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
+<wddxPacket version='1.0'>
+	<array><var name="XXXXXXXX"><boolean value="none">TEST</boolean></var>
+		<var name="YYYYYYYY"><var name="ZZZZZZZZ"><var name="EZEZEZEZ">
+		</var></var></var>
+	</array>
+</wddxPacket>
+EOF;
+$array = wddx_deserialize($xml);
+var_dump($array);
+?>
+--EXPECT--
+array(0) {
+}
diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c
index da3424695b2..311d6aa4a56 100644
--- a/ext/wddx/wddx.c
+++ b/ext/wddx/wddx.c
@@ -1094,18 +1094,22 @@ static void php_wddx_process_data(void *user_data, const XML_Char *s, int len)
 				Z_STRVAL_P(ent->data) = estrndup(s, len);
 				convert_scalar_to_number(ent->data TSRMLS_CC);
 				break;
 
 			case ST_BOOLEAN:
+				if(!ent->data) {
+					break;
+				}
 				if (!strcmp(s, "true")) {
 					Z_LVAL_P(ent->data) = 1;
 				} else if (!strcmp(s, "false")) {
 					Z_LVAL_P(ent->data) = 0;
 				} else {
 					zval_ptr_dtor(&ent->data);
 					if (ent->varname) {
 						efree(ent->varname);
+						ent->varname = NULL;
 					}
 					ent->data = NULL;
 				}
 				break;
 

Fixed code: --TEST--
Bug #72340: Double Free Courruption in wddx_deserialize
--SKIPIF--
<?php
if (!extension_loaded("wddx")) print "skip";
?>
--FILE--
<?php
$xml = <<<EOF
<?xml version='1.0' ?>
<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
<wddxPacket version='1.0'>
	<array><var name="XXXXXXXX"><boolean value="none">TEST</boolean></var>
		<var name="YYYYYYYY"><var name="ZZZZZZZZ"><var name="EZEZEZEZ">
		</var></var></var>
	</array>
</wddxPacket>
EOF;
$array = wddx_deserialize($xml);
var_dump($array);
?>
--EXPECT--
array(0) {
}
				if(!ent->data) {
					break;
				}
						ent->varname = NULL;
CVE-2016-7126: Out-of-bounds Write (CWE-787)
value: The imagetruecolortopalette function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate the number of colors, which allows remote attackers to cause a denial of service (select_colors allocation error and out-of-bounds write) or possibly have unspecified other impact via a large value in the third argument.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2016-09-12T01:59Z
Repository: https://github.com/php/php-src
Language: C
Files changed: ext/gd/gd.c, ext/gd/tests/bug72697.phpt
Commit date: 2016-08-16 14:37:39 +0200
Commit message: Fix bug#72697 - select_colors write out-of-bounds

(cherry picked from commit b6f13a5ef9d6280cf984826a5de012a32c396cd4)

Conflicts:
	ext/gd/gd.c

Diff: diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index c952ee9b5a9..0346a74634b 100644
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -1535,15 +1535,15 @@ PHP_FUNCTION(imagetruecolortopalette)
 
 	if ((im = (gdImagePtr)zend_fetch_resource(Z_RES_P(IM), "Image", le_gd)) == NULL) {
 		RETURN_FALSE;
 	}
 
-	if (ncolors <= 0) {
-		php_error_docref(NULL, E_WARNING, "Number of colors has to be greater than zero");
+	if (ncolors <= 0 || ZEND_LONG_INT_OVFL(ncolors)) {
+		php_error_docref(NULL, E_WARNING, "Number of colors has to be greater than zero and no more than %d", INT_MAX);
 		RETURN_FALSE;
 	}
-	gdImageTrueColorToPalette(im, dither, ncolors);
+	gdImageTrueColorToPalette(im, dither, (int)ncolors);
 
 	RETURN_TRUE;
 }
 /* }}} */
 
diff --git a/ext/gd/tests/bug72697.phpt b/ext/gd/tests/bug72697.phpt
new file mode 100644
index 00000000000..6110385fcb8
--- /dev/null
+++ b/ext/gd/tests/bug72697.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Bug #72697: select_colors write out-of-bounds
+--SKIPIF--
+<?php 
+if (!function_exists("imagecreatetruecolor")) die("skip");
+if (PHP_INT_MAX !== 9223372036854775807) die("skip for 64-bit long systems only");
+?>
+--FILE--
+<?php
+
+$img=imagecreatetruecolor(10, 10);
+imagetruecolortopalette($img, false, PHP_INT_MAX / 8);
+?>
+DONE
+--EXPECTF--
+Warning: imagetruecolortopalette(): Number of colors has to be greater than zero and no more than 2147483647 in %sbug72697.php on line %d
+DONE
\ No newline at end of file

Vulnerable code: 	if (ncolors <= 0) {
		php_error_docref(NULL, E_WARNING, "Number of colors has to be greater than zero");
	gdImageTrueColorToPalette(im, dither, ncolors);
Fixed code: 	if (ncolors <= 0 || ZEND_LONG_INT_OVFL(ncolors)) {
		php_error_docref(NULL, E_WARNING, "Number of colors has to be greater than zero and no more than %d", INT_MAX);
	gdImageTrueColorToPalette(im, dither, (int)ncolors);
--TEST--
Bug #72697: select_colors write out-of-bounds
--SKIPIF--
<?php 
if (!function_exists("imagecreatetruecolor")) die("skip");
if (PHP_INT_MAX !== 9223372036854775807) die("skip for 64-bit long systems only");
?>
--FILE--
<?php

$img=imagecreatetruecolor(10, 10);
imagetruecolortopalette($img, false, PHP_INT_MAX / 8);
?>
DONE
--EXPECTF--
Warning: imagetruecolortopalette(): Number of colors has to be greater than zero and no more than 2147483647 in %sbug72697.php on line %d
DONE
CVE-2016-7127: Out-of-bounds Write (CWE-787)
value: The imagegammacorrect function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate gamma values, which allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by providing different signs for the second and third arguments.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2016-09-12T01:59Z
Repository: https://github.com/php/php-src
Language: C
Files changed: ext/gd/gd.c, ext/gd/tests/bug72730.phpt
Commit date: 2016-08-16 22:55:40 -0700
Commit message: Fix bug #72730 - imagegammacorrect allows arbitrary write access

Diff: diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index 5c604b7a80a..0fb96041087 100644
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -3080,10 +3080,15 @@ PHP_FUNCTION(imagegammacorrect)
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rdd", &IM, &input, &output) == FAILURE) {
 		return;
 	}
 
+	if ( input <= 0.0 || output <= 0.0 ) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Gamma values should be positive");
+		RETURN_FALSE;
+	}
+
 	ZEND_FETCH_RESOURCE(im, gdImagePtr, &IM, -1, "Image", le_gd);
 
 	if (gdImageTrueColor(im))	{
 		int x, y, c;
 
diff --git a/ext/gd/tests/bug72730.phpt b/ext/gd/tests/bug72730.phpt
new file mode 100644
index 00000000000..e7c13cb5e9d
--- /dev/null
+++ b/ext/gd/tests/bug72730.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #72730: imagegammacorrect allows arbitrary write access
+--SKIPIF--
+<?php 
+if (!function_exists("imagecreatetruecolor")) die("skip");
+?>
+--FILE--
+<?php
+$img =  imagecreatetruecolor(1, 1);
+imagegammacorrect($img, -1, 1337);
+?>
+DONE
+--EXPECTF--
+Warning: imagegammacorrect(): Gamma values should be positive in %sbug72730.php on line %d
+DONE
\ No newline at end of file

Fixed code: 	if ( input <= 0.0 || output <= 0.0 ) {
		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Gamma values should be positive");
		RETURN_FALSE;
	}

--TEST--
Bug #72730: imagegammacorrect allows arbitrary write access
--SKIPIF--
<?php 
if (!function_exists("imagecreatetruecolor")) die("skip");
?>
--FILE--
<?php
$img =  imagecreatetruecolor(1, 1);
imagegammacorrect($img, -1, 1337);
?>
DONE
--EXPECTF--
Warning: imagegammacorrect(): Gamma values should be positive in %sbug72730.php on line %d
DONE
CVE-2016-7134: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: ext/curl/interface.c in PHP 7.x before 7.0.10 does not work around a libcurl integer overflow, which allows remote attackers to cause a denial of service (allocation error and heap-based buffer overflow) or possibly have unspecified other impact via a long string that is mishandled in a curl_escape call.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2016-09-12T01:59Z
Repository: https://github.com/php/php-src
Language: C
Files changed: ext/curl/interface.c
Commit date: 2016-08-03 00:58:55 -0700
Commit message: Fix bug #72674 - check both curl_escape and curl_unescape

Diff: diff --git a/ext/curl/interface.c b/ext/curl/interface.c
index be15785cd0e..7069710ece1 100644
--- a/ext/curl/interface.c
+++ b/ext/curl/interface.c
@@ -3515,11 +3515,11 @@ PHP_FUNCTION(curl_reset)
 /* {{{ proto void curl_escape(resource ch, string str)
    URL encodes the given string */
 PHP_FUNCTION(curl_escape)
 {
 	char       *str = NULL, *res = NULL;
-	size_t        str_len = 0;
+	size_t     str_len = 0;
 	zval       *zid;
 	php_curl   *ch;
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "rs", &zid, &str, &str_len) == FAILURE) {
 		return;
@@ -3527,10 +3527,14 @@ PHP_FUNCTION(curl_escape)
 
 	if ((ch = (php_curl*)zend_fetch_resource(Z_RES_P(zid), le_curl_name, le_curl)) == NULL) {
 		RETURN_FALSE;
 	}
 
+	if (ZEND_SIZE_T_INT_OVFL(str_len)) {
+		RETURN_FALSE;
+	}
+
 	if ((res = curl_easy_escape(ch->cp, str, str_len))) {
 		RETVAL_STRING(res);
 		curl_free(res);
 	} else {
 		RETURN_FALSE;
@@ -3554,11 +3558,11 @@ PHP_FUNCTION(curl_unescape)
 
 	if ((ch = (php_curl*)zend_fetch_resource(Z_RES_P(zid), le_curl_name, le_curl)) == NULL) {
 		RETURN_FALSE;
 	}
 
-	if (str_len > INT_MAX) {
+	if (ZEND_SIZE_T_INT_OVFL(str_len)) {
 		RETURN_FALSE;
 	}
 
 	if ((out = curl_easy_unescape(ch->cp, str, str_len, &out_len))) {
 		RETVAL_STRINGL(out, out_len);

Vulnerable code: 	size_t        str_len = 0;
	if (str_len > INT_MAX) {
Fixed code: 	size_t     str_len = 0;
	if (ZEND_SIZE_T_INT_OVFL(str_len)) {
		RETURN_FALSE;
	}

	if (ZEND_SIZE_T_INT_OVFL(str_len)) {