Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2017-7185: Use After Free (CWE-416)
value: Use-after-free vulnerability in the mg_http_multipart_wait_for_boundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.7 and earlier and Mongoose OS 1.2 and earlier allows remote attackers to cause a denial of service (crash) via a multipart/form-data POST request without a MIME boundary string.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.5
Published: 2017-04-10T15:59Z
Repository: https://github.com/cesanta/mongoose-os
Language: C
Files changed: mongoose/mongoose.c
Commit date: 2017-04-03 09:24:47 +0000
Commit message: Fix crash in multipart handling

Close cesanta/dev#6974

PUBLISHED_FROM=4d4e4a46eceba10aec8dacb7f8f58bd078c92307

Diff: diff --git a/mongoose/mongoose.c b/mongoose/mongoose.c
index 8bc2546b..bd953571 100644
--- a/mongoose/mongoose.c
+++ b/mongoose/mongoose.c
@@ -5959,10 +5959,16 @@ static int mg_http_multipart_finalize(struct mg_connection *c) {
 static int mg_http_multipart_wait_for_boundary(struct mg_connection *c) {
   const char *boundary;
   struct mbuf *io = &c->recv_mbuf;
   struct mg_http_proto_data *pd = mg_http_get_proto_data(c);
 
+  if (pd->mp_stream.boundary == NULL) {
+    pd->mp_stream.state = MPS_FINALIZE;
+    DBG(("Invalid request: boundary not initilaized"));
+    return 0;
+  }
+
   if ((int) io->len < pd->mp_stream.boundary_len + 2) {
     return 0;
   }
 
   boundary = c_strnstr(io->buf, pd->mp_stream.boundary, io->len);

Fixed code:   if (pd->mp_stream.boundary == NULL) {
    pd->mp_stream.state = MPS_FINALIZE;
    DBG(("Invalid request: boundary not initilaized"));
    return 0;
  }
CVE-2017-14623: Improper Authentication (CWE-287)
value: In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: (1) it relies only on the return error of the Bind function call to determine whether a user is authorized (i.e., a nil return value is interpreted as successful authorization) and (2) it is used with an LDAP server allowing unauthenticated bind.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 8.1
Published: 2017-09-20T23:29Z
Repository: https://github.com/go-ldap/ldap
Language: Unknown
Commit date: 2017-08-24 10:36:02 -0700
Commit message: Merge pull request #126 from tiziano88/check_empty_password

Require explicit intention for empty password.
CVE-2021-21412: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: Potential for arbitrary code execution in npm package @thi.ng/egf `#gpg`-tagged property values (only if `decrypt: true` option is enabled). PR with patch has been submitted and will has been released as of v0.4.0 By default the EGF parse functions do NOT attempt to decrypt values (since GPG only available in non-browser env). However, if GPG encrypted values are used/required: 1. Perform a regex search for `#gpg`-tagged values in the EGF source file/string and check for backtick (\`) chars in the encrypted value string 2. Replace/remove them or skip parsing if present.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2021-03-30T18:15Z
Repository: https://github.com/thi-ng/umbrella
Language: Unknown
Commit date: 2021-03-27 08:52:42 +0000
Commit message: Merge pull request from GHSA-rj44-gpjc-29r7

fix(egf): update GPG invocation to avoid arb code exec
CVE-2023-44389: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). All versions of Zope 4 and Zope 5 are affected. Patches will be released with Zope versions 4.8.11 and 5.8.6.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-10-04T21:15Z
Repository: https://github.com/zopefoundation/Zope
Language: Other
Files changed: src/App/dtml/manage_tabs.dtml
Commit date: 2023-10-04 11:40:29 +0000
Commit message: Merge pull request from GHSA-m755-gxxg-r5qh

* - html_quote titles in ZMI breadcrumbs

* Revert "- html_quote titles in ZMI breadcrumbs"

This reverts commit 9f86b416980ef1d0a59ace39f64a9a8e8cff2f3c.

* - html_quote title in ZMI breadcrumbs
Diff: diff --git a/src/App/dtml/manage_tabs.dtml b/src/App/dtml/manage_tabs.dtml
index 4ff4d6a807..0b38689bb3 100644
--- a/src/App/dtml/manage_tabs.dtml
+++ b/src/App/dtml/manage_tabs.dtml
@@ -40,11 +40,11 @@
 	</dtml-unless>
 </dtml-comment>
 
 	<nav aria-label="breadcrumb">
 	<dtml-let breadcrumb_length="tabs_path_length(REQUEST)">
-		<ol class="breadcrumb <dtml-var "'zmi-' + title_or_id().replace(' ','')">"
+		<ol class="breadcrumb <dtml-var "'zmi-' + title_or_id().replace(' ','')" html_quote>"
 			data-length="<dtml-var breadcrumb_length>">
 			<li class="breadcrumb-item meta_type">
 				<dtml-if meta_type>
 					<i class="&dtml-zmi_icon;" title="&dtml-meta_type;"></i>
 					<dtml-var "breadcrumb_length==1 and 'Root Folder' or meta_type">

Vulnerable code: 		<ol class="breadcrumb <dtml-var "'zmi-' + title_or_id().replace(' ','')">"
Fixed code: 		<ol class="breadcrumb <dtml-var "'zmi-' + title_or_id().replace(' ','')" html_quote>"
CVE-2023-27483: Uncontrolled Resource Consumption (CWE-400)
value: crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. An out of memory panic vulnerability has been discovered in affected versions. Applications that use the `Paved` type's `SetValue` method with user provided input without proper validation might use excessive amounts of memory and cause an out of memory panic. In the fieldpath package, the Paved.SetValue method sets a value on the Paved object according to the provided path, without any validation. This allows setting values in slices at any provided index, which grows the target array up to the requested index, the index is currently capped at max uint32 (4294967295) given how indexes are parsed,  but that is still an unnecessarily large value. If callers are not validating paths' indexes on their own, which most probably are not going to do, given that the input is parsed directly in the SetValue method, this could allow users to consume arbitrary amounts of memory. Applications that do not use the `Paved` type's `SetValue` method are not affected. This issue has been addressed in versions 0.16.1 and 0.19.2. Users are advised to upgrade. Users unable to upgrade can parse and validate the path before passing it to the `SetValue` method of the `Paved` type, constraining the index size as deemed appropriate.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 7.5
Published: 2023-03-09T21:15Z
Repository: https://github.com/crossplane/crossplane-runtime
Language: Unknown
Commit date: 2023-03-08 16:44:59 +0300
Commit message: Merge pull request from GHSA-vfvj-3m3g-m532

fix: enforce max index value for paths
CVE-2022-24752: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SyliusGridBundle is a package of generic data grids for Symfony applications. Prior to versions 1.10.1 and 1.11-rc2, values added at the end of query sorting were passed directly to the database. The maintainers do not know if this could lead to direct SQL injections but took steps to remediate the vulnerability. The issue is fixed in versions 1.10.1 and 1.11-rc2. As a workaround, overwrite the`Sylius\Component\Grid\Sorting\Sorter.php` class and register it in the container. More information about this workaround is available in the GitHub Security Advisory.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2022-03-15T15:15Z
Repository: https://github.com/Sylius/SyliusGridBundle
Language: Unknown
Commit date: 2022-03-14 15:40:46 +0100
Commit message: bug #222 [Security] Dql injection through sorting parameters blocked (TheMilek)

This PR was merged into the 1.10 branch.

Discussion
----------



Commits
-------

b702009975bcf8dd869bb6f5e619ea93c454f48b Dql injection through sorting parameters blocked
CVE-2023-47109: Insufficient Information (NVD-CWE-noinfo)
value: PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustworthy. When adding a block in blockreassurance module, a BO user can modify the http request and give the path of any file in the project instead of an image. When deleting the block from the BO, the file will be deleted. It is possible to make the website completely unavailable by removing index.php for example. This issue has been patched in version 5.1.4.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 8.1
Published: 2023-11-08T22:15Z
Repository: https://github.com/PrestaShop/blockreassurance
Language: Unknown
Commit date: 2023-11-08 18:32:14 +0100
Commit message: Merge pull request from GHSA-83j2-qhx2-p7jc

Remove images only from dedicated folder and forbid non image extension
CVE-2023-47109: Insufficient Information (NVD-CWE-noinfo)
value: PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustworthy. When adding a block in blockreassurance module, a BO user can modify the http request and give the path of any file in the project instead of an image. When deleting the block from the BO, the file will be deleted. It is possible to make the website completely unavailable by removing index.php for example. This issue has been patched in version 5.1.4.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 8.1
Published: 2023-11-08T22:15Z
Repository: https://github.com/PrestaShop/blockreassurance
Language: Unknown
Commit date: 2023-11-08 11:56:14 +0100
Commit message: Merge pull request #619 from matthieu-rolland/add-security-fixes
CVE-2020-36653: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in GENI Portal. It has been rated as problematic. Affected by this issue is some unknown functionality of the file portal/www/portal/error-text.php. The manipulation of the argument error leads to cross site scripting. The attack may be launched remotely. The patch is identified as c2356cc41260551073bfaa3a94d1ab074f554938. It is recommended to apply a patch to fix this issue. VDB-218474 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-18T08:15Z
Repository: https://github.com/GENI-NSF/geni-portal
Language: Unknown
Commit date: 2020-01-29 11:00:23 -0500
Commit message: Merge pull request #1822 from GENI-NSF/hussamnasir-xssvul1_fix

Update error-text.php
CVE-2020-36654: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic has been found in GENI Portal. This affects the function no_invocation_id_error of the file portal/www/portal/sliceresource.php. The manipulation of the argument invocation_id/invocation_user leads to cross site scripting. It is possible to initiate the attack remotely. The patch is named 39a96fb4b822bd3497442a96135de498d4a81337. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218475.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-18T08:15Z
Repository: https://github.com/GENI-NSF/geni-portal
Language: PHP
Files changed: portal/www/portal/sliceresource.php
Commit date: 2020-08-27 11:11:16 -0400
Commit message: Fix XSS Vul for $invocation_user

Since the invocation id and invocation user cannot be anything but an alphanumeric string , we will use that check as our fix . This will avoid the usage of any JS code as values since it would need special chars like "<>"
Diff: diff --git a/portal/www/portal/sliceresource.php b/portal/www/portal/sliceresource.php
index 357bc6424..afc360ac0 100644
--- a/portal/www/portal/sliceresource.php
+++ b/portal/www/portal/sliceresource.php
@@ -60,10 +60,14 @@ if (! count($_REQUEST)) {
 // set user ID and invocation
 if(array_key_exists("invocation_id", $_REQUEST) &&
         array_key_exists("invocation_user", $_REQUEST)) {
     $invocation_user = $_REQUEST['invocation_user'];
     $invocation_id = $_REQUEST['invocation_id'];
+    if(!ctype_alnum($invocation_id) || !ctype_alnum($invocation_user))
+    {
+      relative_redirect('dashboard.php#slices');
+    }
 }
 else {
     no_invocation_id_error();
 }
 

Fixed code:     if(!ctype_alnum($invocation_id) || !ctype_alnum($invocation_user))
    {
      relative_redirect('dashboard.php#slices');
    }
CVE-2017-5594: Weak Password Recovery Mechanism for Forgotten Password (CWE-640)
value: An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug toolbar is enabled. The password is successfully recovered using this exploit. The SecureLayer7 ID is SL7_PGKT_01.
CWE description: The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
CVSS v3 base score: 7.5
Published: 2017-01-25T18:59Z
Repository: https://github.com/pagekit/pagekit
Language: Unknown
Commit date: 2017-01-20 14:15:58 +0100
Commit message: Merge branch 'release/1.0.11'
CVE-2021-21375: Improper Check for Unusual or Exceptional Conditions (CWE-754)
value: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP version 2.10 and earlier, after an initial INVITE has been sent, when two 183 responses are received, with the first one causing negotiation failure, a crash will occur. This results in a denial of service.
CWE description: The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
CVSS v3 base score: 6.5
Published: 2021-03-10T23:15Z
Repository: https://github.com/pjsip/pjproject
Language: C
Files changed: pjmedia/src/pjmedia/sdp_neg.c
Commit date: 2021-03-08 17:09:34 +0800
Commit message: Merge pull request from GHSA-hvq6-f89p-frvp


Diff: diff --git a/pjmedia/src/pjmedia/sdp_neg.c b/pjmedia/src/pjmedia/sdp_neg.c
index f4838f75d..9f76b5200 100644
--- a/pjmedia/src/pjmedia/sdp_neg.c
+++ b/pjmedia/src/pjmedia/sdp_neg.c
@@ -302,11 +302,10 @@ PJ_DEF(pj_status_t) pjmedia_sdp_neg_modify_local_offer2(
                                     unsigned flags,
 				    const pjmedia_sdp_session *local)
 {
     pjmedia_sdp_session *new_offer;
     pjmedia_sdp_session *old_offer;
-    char media_used[PJMEDIA_MAX_SDP_MEDIA];
     unsigned oi; /* old offer media index */
     pj_status_t status;
 
     /* Check arguments are valid. */
     PJ_ASSERT_RETURN(pool && neg && local, PJ_EINVAL);
@@ -321,12 +320,23 @@ PJ_DEF(pj_status_t) pjmedia_sdp_neg_modify_local_offer2(
 	return status;
 
     /* Change state to STATE_LOCAL_OFFER */
     neg->state = PJMEDIA_SDP_NEG_STATE_LOCAL_OFFER;
 
+    /* When there is no active local SDP in state PJMEDIA_SDP_NEG_STATE_DONE,
+     * it means that the previous initial SDP nego must have been failed,
+     * so we'll just set the local SDP offer here.
+     */
+    if (!neg->active_local_sdp) {
+	neg->initial_sdp_tmp = NULL;
+	neg->initial_sdp = pjmedia_sdp_session_clone(pool, local);
+	neg->neg_local_sdp = pjmedia_sdp_session_clone(pool, local);
+
+	return PJ_SUCCESS;
+    }
+
     /* Init vars */
-    pj_bzero(media_used, sizeof(media_used));
     old_offer = neg->active_local_sdp;
     new_offer = pjmedia_sdp_session_clone(pool, local);
 
     /* RFC 3264 Section 8: When issuing an offer that modifies the session,
      * the "o=" line of the new SDP MUST be identical to that in the

Vulnerable code:     char media_used[PJMEDIA_MAX_SDP_MEDIA];
    pj_bzero(media_used, sizeof(media_used));
Fixed code:     /* When there is no active local SDP in state PJMEDIA_SDP_NEG_STATE_DONE,
     * it means that the previous initial SDP nego must have been failed,
     * so we'll just set the local SDP offer here.
     */
    if (!neg->active_local_sdp) {
	neg->initial_sdp_tmp = NULL;
	neg->initial_sdp = pjmedia_sdp_session_clone(pool, local);
	neg->neg_local_sdp = pjmedia_sdp_session_clone(pool, local);

	return PJ_SUCCESS;
    }
CVE-2021-37706: Integer Underflow (Wrap or Wraparound) (CWE-191)
value: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming STUN message contains an ERROR-CODE attribute, the header length is not checked before performing a subtraction operation, potentially resulting in an integer underflow scenario. This issue affects all users that use STUN. A malicious actor located within the victim’s network may forge and send a specially crafted UDP (STUN) message that could remotely execute arbitrary code on the victim’s machine. Users are advised to upgrade as soon as possible. There are no known workarounds.
CWE description: The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CVSS v3 base score: 9.8
Published: 2021-12-22T18:15Z
Repository: https://github.com/pjsip/pjproject
Language: C
Files changed: pjnath/src/pjnath/stun_msg.c
Commit date: 2021-08-10 11:53:25 +0800
Commit message: Merge pull request from GHSA-2qpg-f6wf-w984


Diff: diff --git a/pjnath/src/pjnath/stun_msg.c b/pjnath/src/pjnath/stun_msg.c
index cd5870f82..bd83351e6 100644
--- a/pjnath/src/pjnath/stun_msg.c
+++ b/pjnath/src/pjnath/stun_msg.c
@@ -1761,10 +1761,13 @@ static pj_status_t decode_errcode_attr(pj_pool_t *pool,
     attr->err_code = buf[6] * 100 + buf[7];
 
     /* Get pointer to the string in the message */
     value.ptr = ((char*)buf + ATTR_HDR_LEN + 4);
     value.slen = attr->hdr.length - 4;
+    /* Make sure the length is never negative */
+    if (value.slen < 0)
+    	value.slen = 0;
 
     /* Copy the string to the attribute */
     pj_strdup(pool, &attr->reason, &value);
 
     /* Done */

Fixed code:     /* Make sure the length is never negative */
    if (value.slen < 0)
    	value.slen = 0;
CVE-2021-43804: Out-of-bounds Read (CWE-125)
value: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming RTCP BYE message contains a reason's length, this declared length is not checked against the actual received packet size, potentially resulting in an out-of-bound read access. This issue affects all users that use PJMEDIA and RTCP. A malicious actor can send a RTCP BYE message with an invalid reason length. Users are advised to upgrade as soon as possible. There are no known workarounds.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.3
Published: 2021-12-22T18:15Z
Repository: https://github.com/pjsip/pjproject
Language: C
Files changed: pjmedia/src/pjmedia/rtcp.c
Commit date: 2021-12-22 08:49:27 +0800
Commit message: Merge pull request from GHSA-3qx3-cg72-wrh9


Diff: diff --git a/pjmedia/src/pjmedia/rtcp.c b/pjmedia/src/pjmedia/rtcp.c
index 31822d2853..f675724579 100644
--- a/pjmedia/src/pjmedia/rtcp.c
+++ b/pjmedia/src/pjmedia/rtcp.c
@@ -755,12 +755,19 @@ static void parse_rtcp_bye(pjmedia_rtcp_session *sess,
 {
     pj_str_t reason = {"-", 1};
 
     /* Check and get BYE reason */
     if (size > 8) {
+    	/* Make sure the BYE reason does not exceed:
+    	 * - the size of the available buffer
+    	 * - the declared reason's length
+    	 * - the actual packet size
+    	 */
 	reason.slen = PJ_MIN(sizeof(sess->stat.peer_sdes_buf_),
                              *((pj_uint8_t*)pkt+8));
+        reason.slen = PJ_MIN(reason.slen, size-9);
+
 	pj_memcpy(sess->stat.peer_sdes_buf_, ((pj_uint8_t*)pkt+9),
 		  reason.slen);
 	reason.ptr = sess->stat.peer_sdes_buf_;
     }
 

Fixed code:     	/* Make sure the BYE reason does not exceed:
    	 * - the size of the available buffer
    	 * - the declared reason's length
    	 * - the actual packet size
    	 */
        reason.slen = PJ_MIN(reason.slen, size-9);
CVE-2021-43845: Out-of-bounds Read (CWE-125)
value: PJSIP is a free and open source multimedia communication library. In version 2.11.1 and prior, if incoming RTCP XR message contain block, the data field is not checked against the received packet size, potentially resulting in an out-of-bound read access. This affects all users that use PJMEDIA and RTCP XR. A malicious actor can send a RTCP XR message with an invalid packet size.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2021-12-27T18:15Z
Repository: https://github.com/pjsip/pjproject
Language: C
Files changed: pjmedia/src/pjmedia/rtcp_xr.c
Commit date: 2021-12-24 12:17:15 +0800
Commit message: Merge pull request from GHSA-r374-qrwv-86hh


Diff: diff --git a/pjmedia/src/pjmedia/rtcp_xr.c b/pjmedia/src/pjmedia/rtcp_xr.c
index 44927063b1..f554698a20 100644
--- a/pjmedia/src/pjmedia/rtcp_xr.c
+++ b/pjmedia/src/pjmedia/rtcp_xr.c
@@ -434,20 +434,36 @@ void pjmedia_rtcp_xr_rx_rtcp_xr( pjmedia_rtcp_xr_session *sess,
 
 	/* Just skip any block with length == 0 (no report content) */
 	if (rb_len) {
 	    switch (rb_hdr->bt) {
 		case BT_RR_TIME:
-		    rb_rr_time = (pjmedia_rtcp_xr_rb_rr_time*) rb_hdr;
+		    if ((char*)rb_hdr + sizeof(*rb_rr_time) <=
+			(char*)pkt + size) 
+		    {
+			rb_rr_time = (pjmedia_rtcp_xr_rb_rr_time*)rb_hdr;
+		    }
 		    break;
 		case BT_DLRR:
-		    rb_dlrr = (pjmedia_rtcp_xr_rb_dlrr*) rb_hdr;
+		    if ((char*)rb_hdr + sizeof(*rb_dlrr) <=
+			(char*)pkt + size)
+		    {
+			rb_dlrr = (pjmedia_rtcp_xr_rb_dlrr*)rb_hdr;
+		    }
 		    break;
 		case BT_STATS:
-		    rb_stats = (pjmedia_rtcp_xr_rb_stats*) rb_hdr;
+		    if ((char*)rb_hdr + sizeof(*rb_stats) <=
+			(char*)pkt + size)
+		    {
+			rb_stats = (pjmedia_rtcp_xr_rb_stats*)rb_hdr;
+		    }
 		    break;
 		case BT_VOIP_METRICS:
-		    rb_voip_mtc = (pjmedia_rtcp_xr_rb_voip_mtc*) rb_hdr;
+		    if ((char*)rb_hdr + sizeof(*rb_voip_mtc) <=
+			(char*)pkt + size)
+		    {
+			rb_voip_mtc = (pjmedia_rtcp_xr_rb_voip_mtc*)rb_hdr;
+		    }
 		    break;
 		default:
 		    break;
 	    }
 	}

Vulnerable code: 		    rb_rr_time = (pjmedia_rtcp_xr_rb_rr_time*) rb_hdr;
		    rb_dlrr = (pjmedia_rtcp_xr_rb_dlrr*) rb_hdr;
		    rb_stats = (pjmedia_rtcp_xr_rb_stats*) rb_hdr;
		    rb_voip_mtc = (pjmedia_rtcp_xr_rb_voip_mtc*) rb_hdr;
Fixed code: 		    if ((char*)rb_hdr + sizeof(*rb_rr_time) <=
			(char*)pkt + size) 
		    {
			rb_rr_time = (pjmedia_rtcp_xr_rb_rr_time*)rb_hdr;
		    }
		    if ((char*)rb_hdr + sizeof(*rb_dlrr) <=
			(char*)pkt + size)
		    {
			rb_dlrr = (pjmedia_rtcp_xr_rb_dlrr*)rb_hdr;
		    }
		    if ((char*)rb_hdr + sizeof(*rb_stats) <=
			(char*)pkt + size)
		    {
			rb_stats = (pjmedia_rtcp_xr_rb_stats*)rb_hdr;
		    }
		    if ((char*)rb_hdr + sizeof(*rb_voip_mtc) <=
			(char*)pkt + size)
		    {
			rb_voip_mtc = (pjmedia_rtcp_xr_rb_voip_mtc*)rb_hdr;
		    }
CVE-2022-21723: Out-of-bounds Read (CWE-125)
value: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the `master` branch. There are no known workarounds.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2022-01-27T00:15Z
Repository: https://github.com/pjsip/pjproject
Language: C
Files changed: pjlib-util/src/pjlib-util/scanner.c
Commit date: 2022-01-26 13:28:57 +0800
Commit message: Merge pull request from GHSA-7fw8-54cv-r7pm


Diff: diff --git a/pjlib-util/src/pjlib-util/scanner.c b/pjlib-util/src/pjlib-util/scanner.c
index 27a0b88310..a54edf2d8e 100644
--- a/pjlib-util/src/pjlib-util/scanner.c
+++ b/pjlib-util/src/pjlib-util/scanner.c
@@ -442,20 +442,25 @@ PJ_DEF(void) pj_scan_get_n( pj_scanner *scanner,
 }
 
 
 PJ_DEF(int) pj_scan_get_char( pj_scanner *scanner )
 {
-    int chr = *scanner->curptr;
+    register char *s = scanner->curptr;
+    int chr;
 
-    if (!chr) {
+    if (s >= scanner->end || !*s) {
 	pj_scan_syntax_err(scanner);
 	return 0;
     }
 
-    ++scanner->curptr;
+    chr = *s;
 
-    if (PJ_SCAN_IS_PROBABLY_SPACE(*scanner->curptr) && scanner->skip_ws) {
+    ++s;
+    scanner->curptr = s;
+    if (PJ_SCAN_CHECK_EOF(s) && PJ_SCAN_IS_PROBABLY_SPACE(*s) &&
+    	scanner->skip_ws)
+    {
 	pj_scan_skip_whitespace(scanner);
     }
     return chr;
 }
 

Vulnerable code:     int chr = *scanner->curptr;
    if (!chr) {
    ++scanner->curptr;
    if (PJ_SCAN_IS_PROBABLY_SPACE(*scanner->curptr) && scanner->skip_ws) {
Fixed code:     register char *s = scanner->curptr;
    int chr;
    if (s >= scanner->end || !*s) {
    chr = *s;
    ++s;
    scanner->curptr = s;
    if (PJ_SCAN_CHECK_EOF(s) && PJ_SCAN_IS_PROBABLY_SPACE(*s) &&
    	scanner->skip_ws)
    {
CVE-2022-23547: Heap-based Buffer Overflow (CWE-122)
value: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. This issue is similar to GHSA-9pfh-r8x4-w26w. Possible buffer overread when parsing a certain STUN message. The vulnerability affects applications that uses STUN including PJNATH and PJSUA-LIB. The patch is available as commit in the master branch.
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 9.8
Published: 2022-12-23T15:15Z
Repository: https://github.com/pjsip/pjproject
Language: C
Files changed: pjnath/src/pjnath/stun_msg.c
Commit date: 2022-12-23 15:05:28 +0800
Commit message: Merge pull request from GHSA-cxwq-5g9x-x7fr

* Fixed heap buffer overflow when parsing STUN errcode attribute

* Also fixed uint parsing
Diff: diff --git a/pjnath/src/pjnath/stun_msg.c b/pjnath/src/pjnath/stun_msg.c
index c6b0bdd284..b55d29849a 100644
--- a/pjnath/src/pjnath/stun_msg.c
+++ b/pjnath/src/pjnath/stun_msg.c
@@ -1436,16 +1436,16 @@ static pj_status_t decode_uint_attr(pj_pool_t *pool,
 
     /* Create the attribute */
     attr = PJ_POOL_ZALLOC_T(pool, pj_stun_uint_attr);
     GETATTRHDR(buf, &attr->hdr);
 
-    attr->value = GETVAL32H(buf, 4);
-
     /* Check that the attribute length is valid */
     if (attr->hdr.length != 4)
         return PJNATH_ESTUNINATTRLEN;
 
+    attr->value = GETVAL32H(buf, 4);
+
     /* Done */
     *p_attr = attr;
 
     return PJ_SUCCESS;
 }
@@ -1755,18 +1755,19 @@ static pj_status_t decode_errcode_attr(pj_pool_t *pool,
 
     /* Create the attribute */
     attr = PJ_POOL_ZALLOC_T(pool, pj_stun_errcode_attr);
     GETATTRHDR(buf, &attr->hdr);
 
+    /* Check that the attribute length is valid */
+    if (attr->hdr.length < 4)
+        return PJNATH_ESTUNINATTRLEN;
+
     attr->err_code = buf[6] * 100 + buf[7];
 
     /* Get pointer to the string in the message */
     value.ptr = ((char*)buf + ATTR_HDR_LEN + 4);
     value.slen = attr->hdr.length - 4;
-    /* Make sure the length is never negative */
-    if (value.slen < 0)
-        value.slen = 0;
 
     /* Copy the string to the attribute */
     pj_strdup(pool, &attr->reason, &value);
 
     /* Done */

Vulnerable code:     attr->value = GETVAL32H(buf, 4);

    /* Make sure the length is never negative */
    if (value.slen < 0)
        value.slen = 0;
Fixed code:     attr->value = GETVAL32H(buf, 4);

    /* Check that the attribute length is valid */
    if (attr->hdr.length < 4)
        return PJNATH_ESTUNINATTRLEN;
CVE-2022-24763: Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
value: PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-service vulnerability that affects PJSIP users that consume PJSIP's XML parsing in their apps. Users are advised to update. There are no known workarounds.
CWE description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CVSS v3 base score: 7.5
Published: 2022-03-30T21:15Z
Repository: https://github.com/pjsip/pjproject
Language: C
Files changed: pjlib-util/src/pjlib-util/xml.c
Commit date: 2022-03-29 14:59:03 +0800
Commit message: Merge pull request from GHSA-5x45-qp78-g4p4

* Prevent infinite loop in scanning xml content

* Simplify scanning method

* Optimization
Diff: diff --git a/pjlib-util/src/pjlib-util/xml.c b/pjlib-util/src/pjlib-util/xml.c
index b0aad26608..5c2d8eb174 100644
--- a/pjlib-util/src/pjlib-util/xml.c
+++ b/pjlib-util/src/pjlib-util/xml.c
@@ -148,10 +148,12 @@ static pj_xml_node *xml_parse_node( pj_pool_t *pool, pj_scanner *scanner)
     {
 	pj_scan_advance_n(scanner, 9, PJ_FALSE);
 	pj_scan_get_until_ch(scanner, ']', &node->content);
 	while (pj_scan_strcmp(scanner, "]]>", 3)) {
 	    pj_str_t dummy;
+
+	    pj_scan_advance_n(scanner, 1, PJ_FALSE);
 	    pj_scan_get_until_ch(scanner, ']', &dummy);
 	}
 	node->content.slen = scanner->curptr - node->content.ptr;
 	pj_scan_advance_n(scanner, 3, PJ_TRUE);
     }

Fixed code: 
	    pj_scan_advance_n(scanner, 1, PJ_FALSE);
CVE-2022-24764: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print(), pjmedia_sdp_media_print()`. Applications that do not use PJSUA2 and do not directly call `pjmedia_sdp_print()` or `pjmedia_sdp_media_print()` should not be affected. A patch is available on the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 7.5
Published: 2022-03-22T17:15Z
Repository: https://github.com/pjsip/pjproject
Language: C
Files changed: pjmedia/src/pjmedia/sdp.c
Commit date: 2022-03-22 16:30:47 +0800
Commit message: Merge pull request from GHSA-f5qg-pqcg-765m


Diff: diff --git a/pjmedia/src/pjmedia/sdp.c b/pjmedia/src/pjmedia/sdp.c
index 31446b5424..3905c2f525 100644
--- a/pjmedia/src/pjmedia/sdp.c
+++ b/pjmedia/src/pjmedia/sdp.c
@@ -731,16 +731,25 @@ static int print_media_desc(const pjmedia_sdp_media *m, char *buf, pj_size_t len
     }
     *p++ = ' ';
     pj_memcpy(p, m->desc.transport.ptr, m->desc.transport.slen);
     p += m->desc.transport.slen;
     for (i=0; i<m->desc.fmt_count; ++i) {
-	*p++ = ' ';
-	pj_memcpy(p, m->desc.fmt[i].ptr, m->desc.fmt[i].slen);
-	p += m->desc.fmt[i].slen;
+	if (end-p > m->desc.fmt[i].slen) {
+	    *p++ = ' ';
+	    pj_memcpy(p, m->desc.fmt[i].ptr, m->desc.fmt[i].slen);
+	    p += m->desc.fmt[i].slen;
+	} else {
+	    return -1;
+	}
+    }
+
+    if (end-p >= 2) {
+	*p++ = '\r';
+	*p++ = '\n';
+    } else {
+	return -1;
     }
-    *p++ = '\r';
-    *p++ = '\n';
 
     /* print connection info, if present. */
     if (m->conn) {
 	printed = print_connection_info(m->conn, p, (int)(end-p));
 	if (printed < 0) {

Vulnerable code: 	*p++ = ' ';
	pj_memcpy(p, m->desc.fmt[i].ptr, m->desc.fmt[i].slen);
	p += m->desc.fmt[i].slen;
    *p++ = '\r';
    *p++ = '\n';
Fixed code: 	if (end-p > m->desc.fmt[i].slen) {
	    *p++ = ' ';
	    pj_memcpy(p, m->desc.fmt[i].ptr, m->desc.fmt[i].slen);
	    p += m->desc.fmt[i].slen;
	} else {
	    return -1;
	}
    }

    if (end-p >= 2) {
	*p++ = '\r';
	*p++ = '\n';
    } else {
	return -1;
CVE-2022-24764: Stack-based Buffer Overflow (CWE-121)
value: PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print(), pjmedia_sdp_media_print()`. Applications that do not use PJSUA2 and do not directly call `pjmedia_sdp_print()` or `pjmedia_sdp_media_print()` should not be affected. A patch is available on the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.
CWE description: A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CVSS v3 base score: 7.5
Published: 2022-03-22T17:15Z
Repository: https://github.com/pjsip/pjproject
Language: C
Files changed: pjmedia/src/pjmedia/sdp.c
Commit date: 2022-03-22 16:30:47 +0800
Commit message: Merge pull request from GHSA-f5qg-pqcg-765m


Diff: diff --git a/pjmedia/src/pjmedia/sdp.c b/pjmedia/src/pjmedia/sdp.c
index 31446b5424..3905c2f525 100644
--- a/pjmedia/src/pjmedia/sdp.c
+++ b/pjmedia/src/pjmedia/sdp.c
@@ -731,16 +731,25 @@ static int print_media_desc(const pjmedia_sdp_media *m, char *buf, pj_size_t len
     }
     *p++ = ' ';
     pj_memcpy(p, m->desc.transport.ptr, m->desc.transport.slen);
     p += m->desc.transport.slen;
     for (i=0; i<m->desc.fmt_count; ++i) {
-	*p++ = ' ';
-	pj_memcpy(p, m->desc.fmt[i].ptr, m->desc.fmt[i].slen);
-	p += m->desc.fmt[i].slen;
+	if (end-p > m->desc.fmt[i].slen) {
+	    *p++ = ' ';
+	    pj_memcpy(p, m->desc.fmt[i].ptr, m->desc.fmt[i].slen);
+	    p += m->desc.fmt[i].slen;
+	} else {
+	    return -1;
+	}
+    }
+
+    if (end-p >= 2) {
+	*p++ = '\r';
+	*p++ = '\n';
+    } else {
+	return -1;
     }
-    *p++ = '\r';
-    *p++ = '\n';
 
     /* print connection info, if present. */
     if (m->conn) {
 	printed = print_connection_info(m->conn, p, (int)(end-p));
 	if (printed < 0) {

Vulnerable code: 	*p++ = ' ';
	pj_memcpy(p, m->desc.fmt[i].ptr, m->desc.fmt[i].slen);
	p += m->desc.fmt[i].slen;
    *p++ = '\r';
    *p++ = '\n';
Fixed code: 	if (end-p > m->desc.fmt[i].slen) {
	    *p++ = ' ';
	    pj_memcpy(p, m->desc.fmt[i].ptr, m->desc.fmt[i].slen);
	    p += m->desc.fmt[i].slen;
	} else {
	    return -1;
	}
    }

    if (end-p >= 2) {
	*p++ = '\r';
	*p++ = '\n';
    } else {
	return -1;
CVE-2022-31031: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions prior to and including 2.12.1 a stack buffer overflow vulnerability affects PJSIP users that use STUN in their applications, either by: setting a STUN server in their account/media config in PJSUA/PJSUA2 level, or directly using `pjlib-util/stun_simple` API. A patch is available in commit 450baca which should be included in the next release. There are no known workarounds for this issue.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 9.8
Published: 2022-06-09T16:15Z
Repository: https://github.com/pjsip/pjproject
Language: C
Files changed: pjlib-util/src/pjlib-util/stun_simple.c
Commit date: 2022-06-07 12:00:13 +0800
Commit message: Merge pull request from GHSA-26j7-ww69-c4qj


Diff: diff --git a/pjlib-util/src/pjlib-util/stun_simple.c b/pjlib-util/src/pjlib-util/stun_simple.c
index 7225195846..d0549176dd 100644
--- a/pjlib-util/src/pjlib-util/stun_simple.c
+++ b/pjlib-util/src/pjlib-util/stun_simple.c
@@ -52,10 +52,11 @@ PJ_DEF(pj_status_t) pjstun_create_bind_req( pj_pool_t *pool,
 PJ_DEF(pj_status_t) pjstun_parse_msg( void *buf, pj_size_t buf_len, 
 				      pjstun_msg *msg)
 {
     pj_uint16_t msg_type, msg_len;
     char *p_attr;
+    int attr_max_cnt = PJ_ARRAY_SIZE(msg->attr);
 
     PJ_CHECK_STACK();
 
     msg->hdr = (pjstun_msg_hdr*)buf;
     msg_type = pj_ntohs(msg->hdr->type);
@@ -81,11 +82,11 @@ PJ_DEF(pj_status_t) pjstun_parse_msg( void *buf, pj_size_t buf_len,
     }
 
     msg->attr_count = 0;
     p_attr = (char*)buf + sizeof(pjstun_msg_hdr);
 
-    while (msg_len > 0) {
+    while (msg_len > 0 && msg->attr_count < attr_max_cnt) {
 	pjstun_attr_hdr **attr = &msg->attr[msg->attr_count];
 	pj_uint32_t len;
 	pj_uint16_t attr_type;
 
 	*attr = (pjstun_attr_hdr*)p_attr;
@@ -109,10 +110,14 @@ PJ_DEF(pj_status_t) pjstun_parse_msg( void *buf, pj_size_t buf_len,
 
 	msg_len = (pj_uint16_t)(msg_len - len);
 	p_attr += len;
 	++msg->attr_count;
     }
+    if (msg->attr_count == attr_max_cnt) {
+	PJ_LOG(4, (THIS_FILE, "Warning: max number attribute %d reached.",
+		   attr_max_cnt));
+    }
 
     return PJ_SUCCESS;
 }
 
 PJ_DEF(void*) pjstun_msg_find_attr( pjstun_msg *msg, pjstun_attr_type t)

Vulnerable code:     while (msg_len > 0) {
Fixed code:     int attr_max_cnt = PJ_ARRAY_SIZE(msg->attr);
    while (msg_len > 0 && msg->attr_count < attr_max_cnt) {
    if (msg->attr_count == attr_max_cnt) {
	PJ_LOG(4, (THIS_FILE, "Warning: max number attribute %d reached.",
		   attr_max_cnt));
    }
CVE-2022-39269: Insufficient Information (NVD-CWE-noinfo)
value: PJSIP is a free and open source multimedia communication library written in C. When processing certain packets, PJSIP may incorrectly switch from using SRTP media transport to using basic RTP upon SRTP restart, causing the media to be sent insecurely. The vulnerability impacts all PJSIP users that use SRTP. The patch is available as commit d2acb9a in the master branch of the project and will be included in version 2.13. Users are advised to manually patch or to upgrade. There are no known workarounds for this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.1
Published: 2022-10-06T18:16Z
Repository: https://github.com/pjsip/pjproject
Language: C
Files changed: pjmedia/src/pjmedia/transport_srtp.c
Commit date: 2022-10-06 14:55:13 +0800
Commit message: Merge pull request from GHSA-wx5m-cj97-4wwg


Diff: diff --git a/pjmedia/src/pjmedia/transport_srtp.c b/pjmedia/src/pjmedia/transport_srtp.c
index 2d393beaae..39d06434ba 100644
--- a/pjmedia/src/pjmedia/transport_srtp.c
+++ b/pjmedia/src/pjmedia/transport_srtp.c
@@ -1529,17 +1529,18 @@ static void srtp_rtp_cb(pjmedia_tp_cb_param *param)
 	 * will return err_status_replay_*. Restarting SRTP can resolve this.
 	 */
 	pjmedia_srtp_crypto tx, rx;
 	pj_status_t status;
 
+	tx = srtp->tx_policy;
+	rx = srtp->rx_policy;
+
 	/* Stop SRTP first, otherwise srtp_start() will maintain current
 	 * roll-over counter.
 	 */
 	pjmedia_transport_srtp_stop((pjmedia_transport*)srtp);
 
-	tx = srtp->tx_policy;
-	rx = srtp->rx_policy;
 	status = pjmedia_transport_srtp_start((pjmedia_transport*)srtp,
 					      &tx, &rx);
 	if (status != PJ_SUCCESS) {
 	    PJ_LOG(5,(srtp->pool->obj_name, "Failed to restart SRTP, err=%s",
 		      get_libsrtp_errstr(err)));

Vulnerable code: 	tx = srtp->tx_policy;
	rx = srtp->rx_policy;
Fixed code: 	tx = srtp->tx_policy;
	rx = srtp->rx_policy;
CVE-2023-30627: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: jellyfin-web is the web client for Jellyfin, a free-software media system. Starting in version 10.1.0 and prior to version 10.8.10, a stored cross-site scripting vulnerability in device.js can be used to make arbitrary calls to the `REST` endpoints with admin privileges. When combined with CVE-2023-30626, this results in remote code execution on the Jellyfin instance in the context of the user who's running it. This issue is patched in version 10.8.10. There are no known workarounds.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-04-24T21:15Z
Repository: https://github.com/jellyfin/jellyfin-web
Language: Unknown
Commit date: 2023-04-23 11:00:06 -0400
Commit message: Merge pull request from GHSA-89hp-h43h-r5pq

Escape device id in raw HTML
CVE-2017-8825: NULL Pointer Dereference (CWE-476)
value: A null dereference vulnerability has been found in the MIME handling component of LibEtPan before 1.8, as used in MailCore and MailCore 2. A crash can occur in low-level/imf/mailimf.c during a failed parse of a Cc header containing multiple e-mail addresses.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2017-05-08T16:29Z
Repository: https://github.com/dinhviethoa/libetpan
Language: C
Files changed: src/low-level/imf/mailimf.c
Commit date: 2017-05-07 15:58:48 -0700
Commit message: Fixed crash #274

Diff: diff --git a/src/low-level/imf/mailimf.c b/src/low-level/imf/mailimf.c
index 4554f1c..b557070 100644
--- a/src/low-level/imf/mailimf.c
+++ b/src/low-level/imf/mailimf.c
@@ -3081,10 +3081,11 @@ static int mailimf_group_parse(const char * message, size_t length,
   char * display_name;
   struct mailimf_mailbox_list * mailbox_list;
   struct mailimf_group * group;
   int r;
   int res;
+  clist * list;
 
   cur_token = * indx;
 
   mailbox_list = NULL;
 
@@ -3108,10 +3109,21 @@ static int mailimf_group_parse(const char * message, size_t length,
     r = mailimf_cfws_parse(message, length, &cur_token);
     if ((r != MAILIMF_NO_ERROR) && (r != MAILIMF_ERROR_PARSE)) {
       res = r;
       goto free_display_name;
     }
+    list = clist_new();
+    if (list == NULL) {
+      res = MAILIMF_ERROR_MEMORY;
+      goto free_display_name;
+    }
+    mailbox_list = mailimf_mailbox_list_new(list);
+    if (mailbox_list == NULL) {
+      res = MAILIMF_ERROR_MEMORY;
+      clist_free(list);
+      goto free_display_name;
+    }
     break;
   default:
     res = r;
     goto free_display_name;
   }

Fixed code:   clist * list;
    list = clist_new();
    if (list == NULL) {
      res = MAILIMF_ERROR_MEMORY;
      goto free_display_name;
    }
    mailbox_list = mailimf_mailbox_list_new(list);
    if (mailbox_list == NULL) {
      res = MAILIMF_ERROR_MEMORY;
      clist_free(list);
      goto free_display_name;
    }
CVE-2022-1253: Heap-based Buffer Overflow (CWE-122)
value: Heap-based Buffer Overflow in GitHub repository strukturag/libde265 prior to and including 1.0.8. The fix is established in commit 8e89fe0e175d2870c39486fdd09250b230ec10b8 but does not yet belong to an official release.
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 9.8
Published: 2022-04-06T12:15Z
Repository: https://github.com/strukturag/libde265
Language: C++
Files changed: libde265/sps.cc, libde265/vui.cc
Commit date: 2022-04-05 09:52:57 +0200
Commit message: error on out-of-range cpb_cnt_minus1 (oss-fuzz issue 27590)

Diff: diff --git a/libde265/sps.cc b/libde265/sps.cc
index addd73c..cb99c3f 100644
--- a/libde265/sps.cc
+++ b/libde265/sps.cc
@@ -433,11 +433,14 @@ de265_error seq_parameter_set::read(error_queue* errqueue, bitreader* br)
   sps_temporal_mvp_enabled_flag = get_bits(br,1);
   strong_intra_smoothing_enable_flag = get_bits(br,1);
 
   vui_parameters_present_flag = get_bits(br,1);
   if (vui_parameters_present_flag) {
-    vui.read(errqueue, br, this);
+    de265_error err = vui.read(errqueue, br, this);
+    if (err) {
+      return err;
+    }
   }
 
 
   sps_extension_present_flag = get_bits(br,1);
   if (sps_extension_present_flag) {
diff --git a/libde265/vui.cc b/libde265/vui.cc
index b5f46ac..76086ff 100644
--- a/libde265/vui.cc
+++ b/libde265/vui.cc
@@ -199,10 +199,13 @@ de265_error video_usability_information::hrd_parameters(error_queue* errqueue, b
       low_delay_hrd_flag[i] = get_bits(br, 1);
     }
     if (!low_delay_hrd_flag[i])
     {
       READ_VLC_OFFSET(cpb_cnt_minus1[i], uvlc, 0);
+      if (cpb_cnt_minus1[i] > 31) {
+	return DE265_ERROR_CODED_PARAMETER_OUT_OF_RANGE;
+      }
     }
 
     for (nalOrVcl = 0; nalOrVcl < 2; nalOrVcl++)
     {
       if (((nalOrVcl == 0) && nal_hrd_parameters_present_flag) ||
@@ -359,10 +362,13 @@ de265_error video_usability_information::read(error_queue* errqueue, bitreader*
 
     vui_hrd_parameters_present_flag = get_bits(br, 1);
     if (vui_hrd_parameters_present_flag) {
       de265_error err;
       err = hrd_parameters(errqueue, br, sps);
+      if (err) {
+	return err;
+      }
     }
   }
 
   // --- bitstream restriction ---
 

Vulnerable code:     vui.read(errqueue, br, this);
Fixed code:     de265_error err = vui.read(errqueue, br, this);
    if (err) {
      return err;
    }
      if (cpb_cnt_minus1[i] > 31) {
	return DE265_ERROR_CODED_PARAMETER_OUT_OF_RANGE;
      }
      if (err) {
	return err;
      }