Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2008-7050: Credentials Management Errors (CWE-255)
value: The password_check function in auth/auth_phpbb3.php in WoW Raid Manager 3.5.1 before Patch 1, when using PHPBB3 authentication, (1) does not invoke the CheckPassword function with the required arguments, which always triggers an authentication failure, and (2) returns true instead of false when an authentication failure occurs, which allows remote attackers to bypass authentication and gain privileges with an arbitrary password.
CWE description: Weaknesses in this category are related to the management of credentials.
Published: 2009-08-24T10:30Z
Repository: https://github.com/Illydth/wowraidmanager
Language: PHP
Files changed: auth/auth_phpbb3.php
Commit date: 2008-10-13 16:26:19 -0500
Commit message: Bug Fix: Fixes problem with phpBB3 bridge allowing login with ANY password.

Diff: diff --git a/auth/auth_phpbb3.php b/auth/auth_phpbb3.php
index 9f8dd59..131c1e8 100644
--- a/auth/auth_phpbb3.php
+++ b/auth/auth_phpbb3.php
@@ -122,15 +122,16 @@ function password_check($oldpassword, $profile_id)
 	$result_passchk = $db_raid->sql_query($sql_passchk) or print_error($sql_passchk, mysql_error(), 1);
 	$data_passchk = $db_raid->sql_fetchrow($result_passchk, true);
 	$db_pass = $data_passchk[$db_user_password];
 	
 	$initString = '$H$';
-	$testVal = $pwd_hasher->CheckPassword($oldpassword, $db_pass);
+	$testVal = $pwd_hasher->CheckPassword($oldpassword, $db_pass, $initString);
+
 	if ($testVal)
-		return 0;
+		return TRUE;
 	else
-		return 1;
+		return FALSE;
 }
 
 function phpraid_login() 
 {
 	global $db_user_id, $db_group_id, $db_user_name, $db_user_email, $db_user_password, $db_table_user_name; 
@@ -160,11 +161,10 @@ function phpraid_login()
 					" FROM " . $table_prefix . $db_table_user_name. 
 					" WHERE ".$db_user_name." = %s", quote_smart($username)
 			);
 
 	$result = $db_raid->sql_query($sql) or print_error($sql, mysql_error(), 1);
-
 	//WRM database
 	//$sql = sprintf("SELECT username, password FROM " . $phpraid_config['db_prefix'] . "profile WHERE username = %s",
 	//				quote_smart($username)
 	//		);
 	//$result2 = $db_raid->sql_query($sql) or print_error($sql, mysql_error(), 1);
@@ -297,6 +297,6 @@ if (!isset($_SESSION['initiated'])) {
 		$_SESSION['session_logged_in'] = 0;
 		$_SESSION['profile_id'] = -1;
 	}
 }
 
-?>
\ No newline at end of file
+?>

Vulnerable code: 	$testVal = $pwd_hasher->CheckPassword($oldpassword, $db_pass);
		return 0;
		return 1;

?>
Fixed code: 	$testVal = $pwd_hasher->CheckPassword($oldpassword, $db_pass, $initString);

		return TRUE;
		return FALSE;
?>
CVE-2023-1496: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository imgproxy/imgproxy prior to 3.14.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-19T17:15Z
Repository: https://github.com/imgproxy/imgproxy
Language: Go
Files changed: CHANGELOG.md, svg/svg.go
Commit date: 2023-02-25 18:59:28 +0300
Commit message: Sanitize `use` tag in SVG

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0e4534b..334754d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,10 +6,11 @@
 - Add the `IMGPROXY_ALLOW_SECURITY_OPTIONS` config + `max_src_resolution`, `max_src_file_size`, `max_animation_frames`, and `max_animation_frame_resolution` processing options.
 - (pro) Add [advanced smart crop](https://docs.imgproxy.net/latest/configuration?id=smart-crop).
 
 ### Change
 - Make the `expires` processing option set `Expires` and `Cache-Control` headers.
+- Sanitize `use` tags in SVGs.
 
 ## [3.13.2] - 2023-02-15
 ### Change
 - Remove color-related EXIF data when stripping ICC profile.
 - (pro) Optimize saving to MP4.
diff --git a/svg/svg.go b/svg/svg.go
index 92a45fa..8e51d0b 100644
--- a/svg/svg.go
+++ b/svg/svg.go
@@ -33,10 +33,12 @@ func Satitize(data *imagedata.ImageData) (*imagedata.ImageData, error) {
 
 	buf, cancel := imagedata.BorrowBuffer()
 
 	ignoreTag := 0
 
+	var curTagName string
+
 	for {
 		tt, tdata := l.Next()
 
 		if ignoreTag > 0 {
 			switch tt {
@@ -65,19 +67,32 @@ func Satitize(data *imagedata.ImageData) (*imagedata.ImageData, error) {
 			}
 			newData.SetCancel(cancel)
 
 			return &newData, nil
 		case xml.StartTagToken:
-			if strings.ToLower(string(l.Text())) == "script" {
+			curTagName = strings.ToLower(string(l.Text()))
+
+			if curTagName == "script" {
 				ignoreTag++
 				continue
 			}
+
 			buf.Write(tdata)
 		case xml.AttributeToken:
-			if _, unsafe := unsafeAttrs[strings.ToLower(string(l.Text()))]; unsafe {
+			attrName := strings.ToLower(string(l.Text()))
+
+			if _, unsafe := unsafeAttrs[attrName]; unsafe {
 				continue
 			}
+
+			if curTagName == "use" && (attrName == "href" || attrName == "xlink:href") {
+				val := strings.TrimSpace(strings.Trim(string(l.AttrVal()), `"'`))
+				if len(val) > 0 && val[0] != '#' {
+					continue
+				}
+			}
+
 			buf.Write(tdata)
 		default:
 			buf.Write(tdata)
 		}
 	}

Vulnerable code: 			if strings.ToLower(string(l.Text())) == "script" {
			if _, unsafe := unsafeAttrs[strings.ToLower(string(l.Text()))]; unsafe {
Fixed code: - Sanitize `use` tags in SVGs.
	var curTagName string

			curTagName = strings.ToLower(string(l.Text()))

			if curTagName == "script" {

			attrName := strings.ToLower(string(l.Text()))

			if _, unsafe := unsafeAttrs[attrName]; unsafe {

			if curTagName == "use" && (attrName == "href" || attrName == "xlink:href") {
				val := strings.TrimSpace(strings.Trim(string(l.AttrVal()), `"'`))
				if len(val) > 0 && val[0] != '#' {
					continue
				}
			}
CVE-2023-33964: Insufficient Information (NVD-CWE-noinfo)
value: mx-chain-go is an implementation of the MultiversX blockchain protocol written in the Go language. Metachain cannot process a cross-shard miniblock. Prior to version 1.4.16, an invalid transaction with the wrong username on metachain is not treated correctly on the metachain transaction processor. This is strictly a processing issue that could have happened on MultiversX chain. If an error like this had occurred, the metachain would have stopped notarizing blocks from the shard chains. The resuming of notarization is possible only after applying a patched binary version. A patch in version 1.4.16 introduces `processIfTxErrorCrossShard` for the metachain transaction processor. There are no known workarounds for this issue.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2023-05-31T18:15Z
Repository: https://github.com/multiversx/mx-chain-go
Language: Unknown
Commit date: 2023-04-19 19:18:52 +0300
Commit message: Merge pull request from GHSA-7xpv-4pm9-xch2

fixed issue on metachain when treating tx with invalid username
CVE-2023-34458: Insufficient Information (NVD-CWE-noinfo)
value: mx-chain-go is the official implementation of the MultiversX blockchain protocol, written in golang. When executing a relayed transaction, if the inner transaction failed, it would have increased the inner transaction's sender account nonce. This could have contributed to a limited DoS attack on a targeted account. The fix is a breaking change so a new flag `RelayedNonceFixEnableEpoch` was needed. This was a strict processing issue while validating blocks on a chain. This vulnerability has been patched in version 1.4.17.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.3
Published: 2023-07-13T19:15Z
Repository: https://github.com/multiversx/mx-chain-go
Language: Unknown
Commit date: 2023-05-28 18:51:48 +0300
Commit message: Merge pull request from GHSA-j494-7x2v-vvvp

Fix wrong nonce in relayed failed transaction
CVE-2022-22114: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In Teedy, versions v1.5 through v1.9 are vulnerable to Reflected Cross-Site Scripting (XSS). The “search term" search functionality is not sufficiently sanitized while displaying the results of the search, which can be leveraged to inject arbitrary scripts. These scripts are executed in a victim’s browser when they enter the crafted URL. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account Takeover of the administrator, by an unauthenticated attacker.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 9.6
Published: 2022-01-10T16:15Z
Repository: https://github.com/sismics/docs
Language: JavaScript
Files changed: docs-web/src/main/webapp/src/app/docs/app.js, docs-web/src/main/webapp/src/app/share/app.js
Commit date: 2021-11-16 20:01:36 +0100
Commit message: escape ngTranslate parameters

Diff: diff --git a/docs-web/src/main/webapp/src/app/docs/app.js b/docs-web/src/main/webapp/src/app/docs/app.js
index 6eff1971..0b6aa2a7 100644
--- a/docs-web/src/main/webapp/src/app/docs/app.js
+++ b/docs-web/src/main/webapp/src/app/docs/app.js
@@ -422,11 +422,11 @@ angular.module('docs',
   // Configuring Restangular
   RestangularProvider.setBaseUrl('../api');
 
   // Configuring Angular Translate
   $translateProvider
-    .useSanitizeValueStrategy(null)
+    .useSanitizeValueStrategy('escapeParameters')
     .useStaticFilesLoader({
       prefix: 'locale/',
       suffix: '.json?@build.date@'
     })
     .registerAvailableLanguageKeys(['en', 'es', 'fr', 'de', 'el', 'ru', 'it', 'pl', 'zh_CN', 'zh_TW'], {
diff --git a/docs-web/src/main/webapp/src/app/share/app.js b/docs-web/src/main/webapp/src/app/share/app.js
index 3eda2d02..446e7e74 100644
--- a/docs-web/src/main/webapp/src/app/share/app.js
+++ b/docs-web/src/main/webapp/src/app/share/app.js
@@ -54,11 +54,11 @@ angular.module('share',
   // Configuring Restangular
   RestangularProvider.setBaseUrl('../api');
 
   // Configuring Angular Translate
   $translateProvider
-      .useSanitizeValueStrategy(null)
+      .useSanitizeValueStrategy('escapeParameters')
       .useStaticFilesLoader({
         prefix: 'locale/',
         suffix: '.json?@build.date@'
       })
       .registerAvailableLanguageKeys(['en', 'es', 'fr', 'de', 'el', 'ru', 'it', 'pl', 'zh_CN', 'zh_TW'], {

Vulnerable code:     .useSanitizeValueStrategy(null)
      .useSanitizeValueStrategy(null)
Fixed code:     .useSanitizeValueStrategy('escapeParameters')
      .useSanitizeValueStrategy('escapeParameters')
CVE-2022-22115: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In Teedy, versions v1.5 through v1.9 are vulnerable to Stored Cross-Site Scripting (XSS) in the name of a created Tag. Since the Tag name is not being sanitized properly in the edit tag page, a low privileged attacker can store malicious scripts in the name of the Tag. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account Takeover of the administrator, and privileges escalation.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 9
Published: 2022-01-10T16:15Z
Repository: https://github.com/sismics/docs
Language: JavaScript
Files changed: docs-web/src/main/webapp/src/app/docs/app.js, docs-web/src/main/webapp/src/app/share/app.js
Commit date: 2021-11-16 20:01:36 +0100
Commit message: escape ngTranslate parameters

Diff: diff --git a/docs-web/src/main/webapp/src/app/docs/app.js b/docs-web/src/main/webapp/src/app/docs/app.js
index 6eff1971..0b6aa2a7 100644
--- a/docs-web/src/main/webapp/src/app/docs/app.js
+++ b/docs-web/src/main/webapp/src/app/docs/app.js
@@ -422,11 +422,11 @@ angular.module('docs',
   // Configuring Restangular
   RestangularProvider.setBaseUrl('../api');
 
   // Configuring Angular Translate
   $translateProvider
-    .useSanitizeValueStrategy(null)
+    .useSanitizeValueStrategy('escapeParameters')
     .useStaticFilesLoader({
       prefix: 'locale/',
       suffix: '.json?@build.date@'
     })
     .registerAvailableLanguageKeys(['en', 'es', 'fr', 'de', 'el', 'ru', 'it', 'pl', 'zh_CN', 'zh_TW'], {
diff --git a/docs-web/src/main/webapp/src/app/share/app.js b/docs-web/src/main/webapp/src/app/share/app.js
index 3eda2d02..446e7e74 100644
--- a/docs-web/src/main/webapp/src/app/share/app.js
+++ b/docs-web/src/main/webapp/src/app/share/app.js
@@ -54,11 +54,11 @@ angular.module('share',
   // Configuring Restangular
   RestangularProvider.setBaseUrl('../api');
 
   // Configuring Angular Translate
   $translateProvider
-      .useSanitizeValueStrategy(null)
+      .useSanitizeValueStrategy('escapeParameters')
       .useStaticFilesLoader({
         prefix: 'locale/',
         suffix: '.json?@build.date@'
       })
       .registerAvailableLanguageKeys(['en', 'es', 'fr', 'de', 'el', 'ru', 'it', 'pl', 'zh_CN', 'zh_TW'], {

Vulnerable code:     .useSanitizeValueStrategy(null)
      .useSanitizeValueStrategy(null)
Fixed code:     .useSanitizeValueStrategy('escapeParameters')
      .useSanitizeValueStrategy('escapeParameters')
CVE-2014-3119: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Multiple SQL injection vulnerabilities in web2Project 3.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search_string parameter in the contacts module to index.php or allow remote attackers to execute arbitrary SQL commands via the updatekey parameter to (2) do_updatecontact.php or (3) updatecontact.php.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 8.8
Published: 2020-01-31T21:15Z
Repository: https://github.com/web2project/web2project
Language: PHP
Files changed: includes/main_functions.php
Commit date: 2014-04-30 15:06:08 -0500
Commit message: adding some more things to filter

Diff: diff --git a/includes/main_functions.php b/includes/main_functions.php
index d1b8bd29..f91701a9 100644
--- a/includes/main_functions.php
+++ b/includes/main_functions.php
@@ -195,11 +195,11 @@ function w2PgetParam(&$arr, $name, $def = null)
                 $_result[$_key] = preg_replace("/<>'\"\[\]{}:;/", "", $_value);
             }
             $result  = $_result;
         } else {
             $_result = strip_tags($arr[$key]);
-            $result  = preg_replace("/<>'\"\[\]{}:;/", "", $_result);
+            $result  = preg_replace("/<>\`'\"\[\]{}():;/", "", $_result);
         }
     } else {
         $result = $def;
     }
 

Vulnerable code:             $result  = preg_replace("/<>'\"\[\]{}:;/", "", $_result);
Fixed code:             $result  = preg_replace("/<>\`'\"\[\]{}():;/", "", $_result);
CVE-2014-3119: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Multiple SQL injection vulnerabilities in web2Project 3.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search_string parameter in the contacts module to index.php or allow remote attackers to execute arbitrary SQL commands via the updatekey parameter to (2) do_updatecontact.php or (3) updatecontact.php.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 8.8
Published: 2020-01-31T21:15Z
Repository: https://github.com/web2project/web2project
Language: PHP
Files changed: do_updatecontact.php, updatecontact.php
Commit date: 2014-04-30 15:17:57 -0500
Commit message: filtering the update key a bit better

Diff: diff --git a/do_updatecontact.php b/do_updatecontact.php
index a6ac79977..4ae70aa12 100644
--- a/do_updatecontact.php
+++ b/do_updatecontact.php
@@ -5,10 +5,11 @@ require_once W2P_BASE_DIR . '/includes/main_functions.php';
 require_once W2P_BASE_DIR . '/includes/db_adodb.php';
 
 $AppUI = new w2p_Core_CAppUI();
 
 $updatekey = w2PgetParam($_POST, 'updatekey', 0);
+$updatekey = preg_replace("/[^A-Za-z0-9]/", "", $updatekey);
 $contact_id = (int) CContact::getContactByUpdatekey($updatekey);
 
 if (!$contact_id) {
 	echo $AppUI->_('You are not authorized to use this page. If you should be authorized please contact the sender to give you another valid link, thank you.');
 	exit;
diff --git a/updatecontact.php b/updatecontact.php
index e1adc3804..01a1f0abb 100644
--- a/updatecontact.php
+++ b/updatecontact.php
@@ -4,10 +4,11 @@ require_once W2P_BASE_DIR . '/includes/config.php';
 require_once W2P_BASE_DIR . '/includes/main_functions.php';
 require_once W2P_BASE_DIR . '/includes/db_adodb.php';
 $AppUI = new w2p_Core_CAppUI();
 
 $updatekey = w2PgetParam($_GET, 'updatekey', 0);
+$updatekey = preg_replace("/[^A-Za-z0-9]/", "", $updatekey);
 $contact_id = CContact::getContactByUpdatekey($updatekey);
 
 $company_id = intval(w2PgetParam($_REQUEST, 'company_id', 0));
 $company_name = w2PgetParam($_REQUEST, 'company_name', null);
 

Fixed code: $updatekey = preg_replace("/[^A-Za-z0-9]/", "", $updatekey);
$updatekey = preg_replace("/[^A-Za-z0-9]/", "", $updatekey);
CVE-2024-31209: Insufficient Information (NVD-CWE-noinfo)
value: oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`. This issue has been patched in version(s)`3.1.2` & `3.2.0-beta.3`.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-04T16:15Z
Repository: https://github.com/erlef/oidcc
Language: Other
Files changed: src/oidcc_provider_configuration_worker.erl
Commit date: 2024-04-03 16:47:54 +0200
Commit message: Merge pull request from GHSA-mj35-2rgf-cv8p


Diff: diff --git a/src/oidcc_provider_configuration_worker.erl b/src/oidcc_provider_configuration_worker.erl
index 51fb33c..d4539ec 100644
--- a/src/oidcc_provider_configuration_worker.erl
+++ b/src/oidcc_provider_configuration_worker.erl
@@ -380,20 +380,19 @@ lookup_in_ets_or_call(Name, Key, Call) ->
         _ -> gen_server:call(Name, Call)
     end.
 
 -spec get_ets_table_name(WorkerRef :: gen_server:server_ref()) ->
     {ok, gen_server:server_ref()} | error.
-get_ets_table_name(WorkerName) when is_atom(WorkerName) ->
-    {ok, erlang:list_to_atom(erlang:atom_to_list(WorkerName) ++ "_table")};
+get_ets_table_name(Name) when is_atom(Name) ->
+    {ok, Name};
 get_ets_table_name(_Ref) ->
     error.
 
 -spec register_ets_table(Opts :: opts()) -> ets:table() | undefined.
 register_ets_table(Opts) ->
     case maps:get(name, Opts, undefined) of
-        {local, WorkerName} ->
-            Name = erlang:list_to_atom(erlang:atom_to_list(WorkerName) ++ "_table"),
+        {local, Name} ->
             ets:new(Name, [named_table, bag, protected, {read_concurrency, true}]);
         _OtherName ->
             undefined
     end.
 

Vulnerable code: get_ets_table_name(WorkerName) when is_atom(WorkerName) ->
    {ok, erlang:list_to_atom(erlang:atom_to_list(WorkerName) ++ "_table")};
        {local, WorkerName} ->
            Name = erlang:list_to_atom(erlang:atom_to_list(WorkerName) ++ "_table"),
Fixed code: get_ets_table_name(Name) when is_atom(Name) ->
    {ok, Name};
        {local, Name} ->
CVE-2020-36541: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in Demokratian. It has been rated as critical. Affected by this issue is some unknown functionality of the file basicos_php/genera_select.php. The manipulation of the argument id_provincia with the input -1%20union%20all%20select%201,2,3,4,database() leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2022-06-07T18:15Z
Repository: https://bitbucket.org/csalgadow/demokratian_votaciones
Language: PHP
Files changed: basicos_php/genera_select.php
Commit date: 2019-04-20 14:26:13 +0200
Commit message: error de tipo de dato

Cambiamos el filtro contra sql inyection para que detecte solo datos numéricos
Diff: diff --git a/basicos_php/genera_select.php b/basicos_php/genera_select.php
index 5c24f48..6863f61 100644
--- a/basicos_php/genera_select.php
+++ b/basicos_php/genera_select.php
@@ -22,11 +22,11 @@
 ###############################################################################################################################################################
 ###############################################################################################################################################################
 require_once("../config/config.inc.php");
 include('../inc_web/conexion.php');
 include("../basicos_php/basico.php");
-$id_provincia = fn_filtro($con, $_GET['id_provincia']);
+$id_provincia = fn_filtro_numerico($con, $_GET['id_provincia']);
 if (isset($_GET['id_municipio'])) {
     $municipio = $_GET['id_municipio'];
 } else {
     $municipio = "";
 }

Vulnerable code: $id_provincia = fn_filtro($con, $_GET['id_provincia']);
Fixed code: $id_provincia = fn_filtro_numerico($con, $_GET['id_provincia']);
CVE-2023-2191: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository azuracast/azuracast prior to 0.18.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-04-20T02:15Z
Repository: https://github.com/azuracast/azuracast
Language: Other
Files changed: templates/main.phtml
Commit date: 2023-04-19 19:25:15 -0500
Commit message: Escape user display name in menu.

Diff: diff --git a/templates/main.phtml b/templates/main.phtml
index 5052d2956..80af6b9fa 100644
--- a/templates/main.phtml
+++ b/templates/main.phtml
@@ -80,11 +80,11 @@ endif; ?>">
 
     <div id="radio-player-controls"></div>
 
     <div class="dropdown ml-3 d-inline-flex align-items-center">
         <div class="mr-2">
-            <?= $user->getDisplayName() ?>
+            <?= $this->e($user->getDisplayName()) ?>
         </div>
 
         <button aria-expanded="false" aria-haspopup="true" class="navbar-toggler" aria-label="<?= __(
             'Toggle Menu'
         ) ?>" data-toggle="dropdown" type="button">

Vulnerable code:             <?= $user->getDisplayName() ?>
Fixed code:             <?= $this->e($user->getDisplayName()) ?>
CVE-2023-39150: Insufficient Information (NVD-CWE-noinfo)
value: ConEmu before commit 230724 does not sanitize title responses correctly for control characters, potentially leading to arbitrary code execution. This is related to an incomplete fix for CVE-2022-46387.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2023-09-12T13:15Z
Repository: https://github.com/Maximus5/ConEmu
Language: C++
Files changed: src/ConEmuCD/ConAnsiImpl.cpp, src/ConEmuHk/Ansi.cpp
Commit date: 2023-07-24 01:04:12 +0200
Commit message: gh-2536: Do not emit control characters in title reports (capability fix).

Diff: diff --git a/src/ConEmuCD/ConAnsiImpl.cpp b/src/ConEmuCD/ConAnsiImpl.cpp
index 18b6d156..9b73acb1 100644
--- a/src/ConEmuCD/ConAnsiImpl.cpp
+++ b/src/ConEmuCD/ConAnsiImpl.cpp
@@ -983,11 +983,11 @@ bool SrvAnsiImpl::ReportString(LPCWSTR asRet)
 
 	INPUT_RECORD* p = pir;
 	LPCWSTR pc = asRet;
 	for (int i = 0; i < nLen; i++, p++, pc++)
 	{
-		const char ch = *pc >= 0x20 ? *pc : L' ';
+		const char ch = (*pc == 0x1B || *pc >= 0x20) ? *pc : L' ';
 		p->EventType = KEY_EVENT;
 		p->Event.KeyEvent.bKeyDown = TRUE;
 		p->Event.KeyEvent.wRepeatCount = 1;
 		p->Event.KeyEvent.uChar.UnicodeChar = ch;
 	}
@@ -2472,6 +2472,5 @@ void SrvAnsiImpl::XTermAltBuffer(bool bSetAltBuffer/*, condata::TablePtr& table*
 
 		// #condata Save gDisplayCursor.StoredCursorPos separately by primary/alternative
 
 	}
 }
-
diff --git a/src/ConEmuHk/Ansi.cpp b/src/ConEmuHk/Ansi.cpp
index 56fda733..b8fa471e 100644
--- a/src/ConEmuHk/Ansi.cpp
+++ b/src/ConEmuHk/Ansi.cpp
@@ -2503,11 +2503,11 @@ BOOL CEAnsi::ReportString(LPCWSTR asRet)
 
 	INPUT_RECORD* p = pir;
 	LPCWSTR pc = asRet;
 	for (size_t i = 0; i < nLen; i++, p++, pc++)
 	{
-		const char ch = *pc >= 0x20 ? *pc : L' ';
+		const char ch = (*pc == 0x1B || *pc >= 0x20) ? *pc : L' ';
 		p->EventType = KEY_EVENT;
 		p->Event.KeyEvent.bKeyDown = TRUE;
 		p->Event.KeyEvent.wRepeatCount = 1;
 		p->Event.KeyEvent.uChar.UnicodeChar = ch;
 	}

Vulnerable code: 		const char ch = *pc >= 0x20 ? *pc : L' ';

		const char ch = *pc >= 0x20 ? *pc : L' ';
Fixed code: 		const char ch = (*pc == 0x1B || *pc >= 0x20) ? *pc : L' ';
		const char ch = (*pc == 0x1B || *pc >= 0x20) ? *pc : L' ';
CVE-2015-10027: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: A vulnerability, which was classified as problematic, has been found in hydrian TTRSS-Auth-LDAP. Affected by this issue is some unknown functionality of the component Username Handler. The manipulation leads to ldap injection. Upgrading to version 2.0b1 is able to address this issue. The patch is identified as a7f7a5a82d9202a5c40d606a5c519ba61b224eb8. It is recommended to upgrade the affected component. VDB-217622 is the identifier assigned to this vulnerability.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2023-01-07T17:15Z
Repository: https://github.com/hydrian/TTRSS-Auth-LDAP
Language: Unknown
Commit date: 2015-11-02 10:30:48 -0500
Commit message: Merge pull request #14 from tsmgeek/master

Pull to properly escape provided username to prevent exploit.
CVE-2011-2161: Resource Management Errors (CWE-399)
value: The ape_read_header function in ape.c in libavformat in FFmpeg before 0.5.4, as used in MPlayer, VideoLAN VLC media player, and other products, allows remote attackers to cause a denial of service (application crash) via an APE (aka Monkey's Audio) file that contains a header but no frames.
CWE description: Weaknesses in this category are related to improper management of system resources.
Published: 2011-05-20T22:55Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavformat/ape.c
Commit date: 2011-03-16 12:53:52 +0100
Commit message: Do not attempt to decode APE file with no frames

This fixes invalid reads/writes with this sample:
http://packetstorm.linuxsecurity.com/1103-exploits/vlc105-dos.txt

Diff: diff --git a/libavformat/ape.c b/libavformat/ape.c
index 6c269849f..dd2aeb9ff 100644
--- a/libavformat/ape.c
+++ b/libavformat/ape.c
@@ -240,10 +240,14 @@ static int ape_read_header(AVFormatContext * s, AVFormatParameters * ap)
         /* Skip any stored wav header */
         if (!(ape->formatflags & MAC_FORMAT_FLAG_CREATE_WAV_HEADER))
             avio_seek(pb, ape->wavheaderlength, SEEK_CUR);
     }
 
+    if(!ape->totalframes){
+        av_log(s, AV_LOG_ERROR, "No frames in the file!\n");
+        return AVERROR(EINVAL);
+    }
     if(ape->totalframes > UINT_MAX / sizeof(APEFrame)){
         av_log(s, AV_LOG_ERROR, "Too many frames: %d\n", ape->totalframes);
         return -1;
     }
     ape->frames       = av_malloc(ape->totalframes * sizeof(APEFrame));

Fixed code:     if(!ape->totalframes){
        av_log(s, AV_LOG_ERROR, "No frames in the file!\n");
        return AVERROR(EINVAL);
    }
CVE-2013-4264: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The kempf_decode_tile function in libavcodec/g2meet.c in FFmpeg before 2.0.1 allows remote attackers to cause a denial of service (out-of-bounds heap write) via a G2M4 encoded file.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2013-11-23T17:55Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/g2meet.c
Commit date: 2013-08-07 16:28:28 +0200
Commit message: avcodec/g2meet: fix src pointer checks in kempf_decode_tile()

Fixes Ticket2842

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Diff: diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c
index 57c6fb8db6..99d4d1ec37 100644
--- a/libavcodec/g2meet.c
+++ b/libavcodec/g2meet.c
@@ -387,11 +387,11 @@ static int kempf_decode_tile(G2MContext *c, int tile_x, int tile_y,
 
     if (src_end - src < 2)
         return 0;
     zsize = (src[0] << 8) | src[1]; src += 2;
 
-    if (src_end - src < zsize)
+    if (src_end - src < zsize + (sub_type != 2))
         return AVERROR_INVALIDDATA;
 
     ret = uncompress(c->kempf_buf, &dlen, src, zsize);
     if (ret)
         return AVERROR_INVALIDDATA;
@@ -409,10 +409,12 @@ static int kempf_decode_tile(G2MContext *c, int tile_x, int tile_y,
     // blocks are coded LSB and we need normal bitreader for JPEG data
     bits = 0;
     for (i = 0; i < (FFALIGN(height, 16) >> 4); i++) {
         for (j = 0; j < (FFALIGN(width, 16) >> 4); j++) {
             if (!bits) {
+                if (src >= src_end)
+                    return AVERROR_INVALIDDATA;
                 bitbuf = *src++;
                 bits   = 8;
             }
             coded = bitbuf & 1;
             bits--;

Vulnerable code:     if (src_end - src < zsize)
Fixed code:     if (src_end - src < zsize + (sub_type != 2))
                if (src >= src_end)
                    return AVERROR_INVALIDDATA;
CVE-2013-4265: Other (NVD-CWE-Other)
value: The av_reallocp_array function in libavutil/mem.c in FFmpeg before 2.0.1 has an unspecified impact and remote vectors related to a "wrong return code" and a resultant NULL pointer dereference.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Published: 2013-11-23T17:55Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavutil/mem.c
Commit date: 2013-08-09 13:47:10 +0200
Commit message: avutil/mem: Fix flipped condition

Fixes return code and later null pointer dereference

Found-by: Laurent Butti <laurentb@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Diff: diff --git a/libavutil/mem.c b/libavutil/mem.c
index 76f6b65d1ab..20dfd629a84 100644
--- a/libavutil/mem.c
+++ b/libavutil/mem.c
@@ -189,11 +189,11 @@ void *av_realloc_array(void *ptr, size_t nmemb, size_t size)
 
 int av_reallocp_array(void *ptr, size_t nmemb, size_t size)
 {
     void **ptrptr = ptr;
     *ptrptr = av_realloc_f(*ptrptr, nmemb, size);
-    if (!*ptrptr && !(nmemb && size))
+    if (!*ptrptr && nmemb && size)
         return AVERROR(ENOMEM);
     return 0;
 }
 
 void av_free(void *ptr)

Vulnerable code:     if (!*ptrptr && !(nmemb && size))
Fixed code:     if (!*ptrptr && nmemb && size)
CVE-2013-7010: Numeric Errors (CWE-189)
value: Multiple integer signedness errors in libavcodec/dsputil.c in FFmpeg before 2.1 allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted data.
CWE description: Weaknesses in this category are related to improper calculation or conversion of numbers.
Published: 2013-12-09T16:36Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/dsputil.c
Commit date: 2013-08-30 23:40:47 +0200
Commit message: avcodec/dsputil: fix signedness in sizeof() comparissions

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Diff: diff --git a/libavcodec/dsputil.c b/libavcodec/dsputil.c
index 0161347cc4e..53fd5720cdb 100644
--- a/libavcodec/dsputil.c
+++ b/libavcodec/dsputil.c
@@ -1929,11 +1929,11 @@ void ff_set_cmp(DSPContext* c, me_cmp_func *cmp, int type){
     }
 }
 
 static void add_bytes_c(uint8_t *dst, uint8_t *src, int w){
     long i;
-    for(i=0; i<=w-sizeof(long); i+=sizeof(long)){
+    for(i=0; i<=w-(int)sizeof(long); i+=sizeof(long)){
         long a = *(long*)(src+i);
         long b = *(long*)(dst+i);
         *(long*)(dst+i) = ((a&pb_7f) + (b&pb_7f)) ^ ((a^b)&pb_80);
     }
     for(; i<w; i++)
@@ -1954,11 +1954,11 @@ static void diff_bytes_c(uint8_t *dst, const uint8_t *src1, const uint8_t *src2,
             dst[i+6] = src1[i+6]-src2[i+6];
             dst[i+7] = src1[i+7]-src2[i+7];
         }
     }else
 #endif
-    for(i=0; i<=w-sizeof(long); i+=sizeof(long)){
+    for(i=0; i<=w-(int)sizeof(long); i+=sizeof(long)){
         long a = *(long*)(src1+i);
         long b = *(long*)(src2+i);
         *(long*)(dst+i) = ((a|pb_80) - (b&pb_7f)) ^ ((a^b^pb_80)&pb_80);
     }
     for(; i<w; i++)

Vulnerable code:     for(i=0; i<=w-sizeof(long); i+=sizeof(long)){
    for(i=0; i<=w-sizeof(long); i+=sizeof(long)){
Fixed code:     for(i=0; i<=w-(int)sizeof(long); i+=sizeof(long)){
    for(i=0; i<=w-(int)sizeof(long); i+=sizeof(long)){
CVE-2013-7012: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The get_siz function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not prevent attempts to use non-zero image offsets, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG2000 data.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2013-12-09T16:36Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/jpeg2000dec.c
Commit date: 2013-10-26 02:19:13 +0200
Commit message: avcodec/jpeg2000dec: non zero image offsets are not supported

Fixes out of array accesses
Fixes Ticket3080
Found-by: ami_stuff
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Diff: diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c
index 80bc335507f..b150bc15950 100644
--- a/libavcodec/jpeg2000dec.c
+++ b/libavcodec/jpeg2000dec.c
@@ -241,10 +241,15 @@ static int get_siz(Jpeg2000DecoderContext *s)
     s->tile_height    = bytestream2_get_be32u(&s->g); // YTSiz
     s->tile_offset_x  = bytestream2_get_be32u(&s->g); // XT0Siz
     s->tile_offset_y  = bytestream2_get_be32u(&s->g); // YT0Siz
     ncomponents       = bytestream2_get_be16u(&s->g); // CSiz
 
+    if (s->image_offset_x || s->image_offset_y) {
+        avpriv_request_sample(s->avctx, "Support for image offsets");
+        return AVERROR_PATCHWELCOME;
+    }
+
     if (ncomponents <= 0) {
         av_log(s->avctx, AV_LOG_ERROR, "Invalid number of components: %d\n",
                s->ncomponents);
         return AVERROR_INVALIDDATA;
     }

Fixed code:     if (s->image_offset_x || s->image_offset_y) {
        avpriv_request_sample(s->avctx, "Support for image offsets");
        return AVERROR_PATCHWELCOME;
    }
CVE-2013-7013: Numeric Errors (CWE-189)
value: The g2m_init_buffers function in libavcodec/g2meet.c in FFmpeg before 2.1 uses an incorrect ordering of arithmetic operations, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Go2Webinar data.
CWE description: Weaknesses in this category are related to improper calculation or conversion of numbers.
Published: 2013-12-09T16:36Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/g2meet.c
Commit date: 2013-09-15 16:33:27 +0200
Commit message: avcodec/g2meet: Fix order of align and pixel size multiplication.

Fixes out of array accesses
Fixes Ticket2922

Found-by: ami_stuff
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Diff: diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c
index 9a228b8873f..ccccf218346 100644
--- a/libavcodec/g2meet.c
+++ b/libavcodec/g2meet.c
@@ -451,11 +451,11 @@ static int g2m_init_buffers(G2MContext *c)
             return AVERROR(ENOMEM);
     }
     if (!c->synth_tile || !c->jpeg_tile ||
         c->old_tile_w < c->tile_width ||
         c->old_tile_h < c->tile_height) {
-        c->tile_stride = FFALIGN(c->tile_width * 3, 16);
+        c->tile_stride = FFALIGN(c->tile_width, 16) * 3;
         aligned_height = FFALIGN(c->tile_height,    16);
         av_free(c->synth_tile);
         av_free(c->jpeg_tile);
         av_free(c->kempf_buf);
         av_free(c->kempf_flags);

Vulnerable code:         c->tile_stride = FFALIGN(c->tile_width * 3, 16);
Fixed code:         c->tile_stride = FFALIGN(c->tile_width, 16) * 3;
CVE-2013-7014: Numeric Errors (CWE-189)
value: Integer signedness error in the add_bytes_l2_c function in libavcodec/pngdsp.c in FFmpeg before 2.1 allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted PNG data.
CWE description: Weaknesses in this category are related to improper calculation or conversion of numbers.
Published: 2013-12-09T16:36Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/pngdsp.c
Commit date: 2013-08-30 23:22:18 +0200
Commit message: avcodec/pngdsp: fix (un)signed type in end comparission

Fixes out of array accesses
Fixes Ticket2919

Found_by: ami_stuff
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Diff: diff --git a/libavcodec/pngdsp.c b/libavcodec/pngdsp.c
index 0d247759cc0..5ab1c351b25 100644
--- a/libavcodec/pngdsp.c
+++ b/libavcodec/pngdsp.c
@@ -29,11 +29,11 @@
 #define pb_80 (~0UL/255 * 0x80)
 
 static void add_bytes_l2_c(uint8_t *dst, uint8_t *src1, uint8_t *src2, int w)
 {
     long i;
-    for (i = 0; i <= w - sizeof(long); i += sizeof(long)) {
+    for (i = 0; i <= w - (int)sizeof(long); i += sizeof(long)) {
         long a = *(long *)(src1 + i);
         long b = *(long *)(src2 + i);
         *(long *)(dst + i) = ((a & pb_7f) + (b & pb_7f)) ^ ((a ^ b) & pb_80);
     }
     for (; i < w; i++)

Vulnerable code:     for (i = 0; i <= w - sizeof(long); i += sizeof(long)) {
Fixed code:     for (i = 0; i <= w - (int)sizeof(long); i += sizeof(long)) {
CVE-2013-7015: Improper Input Validation (CWE-20)
value: The flashsv_decode_frame function in libavcodec/flashsv.c in FFmpeg before 2.1 does not properly validate a certain height value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Flash Screen Video data.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2013-12-09T16:36Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/flashsv.c
Commit date: 2013-08-20 23:18:48 +0200
Commit message: avcodec/flashsv: check diff_start/height

Fixes out of array accesses
Fixes Ticket2844

Found-by: ami_stuff
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Diff: diff --git a/libavcodec/flashsv.c b/libavcodec/flashsv.c
index 9982b5e9663..f00bf21d472 100644
--- a/libavcodec/flashsv.c
+++ b/libavcodec/flashsv.c
@@ -385,10 +385,14 @@ static int flashsv_decode_frame(AVCodecContext *avctx, void *data,
                                "inter frame without keyframe\n");
                         return AVERROR_INVALIDDATA;
                     }
                     s->diff_start  = get_bits(&gb, 8);
                     s->diff_height = get_bits(&gb, 8);
+                    if (s->diff_start + s->diff_height > cur_blk_height) {
+                        av_log(avctx, AV_LOG_ERROR, "Block parameters invalid\n");
+                        return AVERROR_INVALIDDATA;
+                    }
                     av_log(avctx, AV_LOG_DEBUG,
                            "%dx%d diff start %d height %d\n",
                            i, j, s->diff_start, s->diff_height);
                     size -= 2;
                 }

Fixed code:                     if (s->diff_start + s->diff_height > cur_blk_height) {
                        av_log(avctx, AV_LOG_ERROR, "Block parameters invalid\n");
                        return AVERROR_INVALIDDATA;
                    }
CVE-2013-7016: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The get_siz function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not ensure the expected sample separation, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG2000 data.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2013-12-09T16:36Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/jpeg2000dec.c
Commit date: 2013-08-23 01:02:03 +0200
Commit message: avcodec/jpeg2000dec: Check cdx/y values more carefully

Some invalid values where not handled correctly in the later pixel
format matching code.
Fixes out of array accesses
Fixes Ticket2848

Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Diff: diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c
index 3c14a13f8ed..34ac5360560 100644
--- a/libavcodec/jpeg2000dec.c
+++ b/libavcodec/jpeg2000dec.c
@@ -271,11 +271,12 @@ static int get_siz(Jpeg2000DecoderContext *s)
         s->cbps[i]   = (x & 0x7f) + 1;
         s->precision = FFMAX(s->cbps[i], s->precision);
         s->sgnd[i]   = !!(x & 0x80);
         s->cdx[i]    = bytestream2_get_byteu(&s->g);
         s->cdy[i]    = bytestream2_get_byteu(&s->g);
-        if (!s->cdx[i] || !s->cdy[i]) {
+        if (   !s->cdx[i] || s->cdx[i] == 3 || s->cdx[i] > 4
+            || !s->cdy[i] || s->cdy[i] == 3 || s->cdy[i] > 4) {
             av_log(s->avctx, AV_LOG_ERROR, "Invalid sample seperation\n");
             return AVERROR_INVALIDDATA;
         }
         log2_chroma_wh |= s->cdy[i] >> 1 << i * 4 | s->cdx[i] >> 1 << i * 4 + 2;
     }

Vulnerable code:         if (!s->cdx[i] || !s->cdy[i]) {
Fixed code:         if (   !s->cdx[i] || s->cdx[i] == 3 || s->cdx[i] > 4
            || !s->cdy[i] || s->cdy[i] == 3 || s->cdy[i] > 4) {
CVE-2013-7018: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not ensure the use of valid code-block dimension values, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG2000 data.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2013-12-09T16:36Z
Repository: https://github.com/FFmpeg/FFmpeg
Language: C
Files changed: libavcodec/jpeg2000dec.c
Commit date: 2013-08-24 03:42:54 +0200
Commit message: jpeg2000: check log2_cblk dimensions

Fixes out of array access
Fixes Ticket2895

Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Diff: diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c
index 34ac5360560..8c0e6ffd66e 100644
--- a/libavcodec/jpeg2000dec.c
+++ b/libavcodec/jpeg2000dec.c
@@ -382,10 +382,15 @@ static int get_cox(Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *c)
         c->log2_cblk_width + c->log2_cblk_height > 12) {
         av_log(s->avctx, AV_LOG_ERROR, "cblk size invalid\n");
         return AVERROR_INVALIDDATA;
     }
 
+    if (c->log2_cblk_width > 6 || c->log2_cblk_height > 6) {
+        avpriv_request_sample(s->avctx, "cblk size > 64");
+        return AVERROR_PATCHWELCOME;
+    }
+
     c->cblk_style = bytestream2_get_byteu(&s->g);
     if (c->cblk_style != 0) { // cblk style
         av_log(s->avctx, AV_LOG_WARNING, "extra cblk styles %X\n", c->cblk_style);
     }
     c->transform = bytestream2_get_byteu(&s->g); // DWT transformation type
@@ -1023,10 +1028,13 @@ static int decode_cblk(Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *codsty,
     int passno = cblk->npasses, pass_t = 2, bpno = cblk->nonzerobits - 1, y;
     int clnpass_cnt = 0;
     int bpass_csty_symbol           = codsty->cblk_style & JPEG2000_CBLK_BYPASS;
     int vert_causal_ctx_csty_symbol = codsty->cblk_style & JPEG2000_CBLK_VSC;
 
+    av_assert0(width  <= JPEG2000_MAX_CBLKW);
+    av_assert0(height <= JPEG2000_MAX_CBLKH);
+
     for (y = 0; y < height; y++)
         memset(t1->data[y], 0, width * sizeof(**t1->data));
 
     /* If code-block contains no compressed data: nothing to do. */
     if (!cblk->length)

Fixed code:     if (c->log2_cblk_width > 6 || c->log2_cblk_height > 6) {
        avpriv_request_sample(s->avctx, "cblk size > 64");
        return AVERROR_PATCHWELCOME;
    }

    av_assert0(width  <= JPEG2000_MAX_CBLKW);
    av_assert0(height <= JPEG2000_MAX_CBLKH);