Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-43887: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: Libde265 v1.0.12 was discovered to contain multiple buffer overflows via the num_tile_columns and num_tile_row parameters in the function pic_parameter_set::dump.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 8.1
Published: 2023-11-22T18:15Z
Repository: https://github.com/strukturag/libde265
Language: C++
Files changed: libde265/decctx.cc
Commit date: 2023-09-01 21:18:48 +0200
Commit message: fix #418

Diff: diff --git a/libde265/decctx.cc b/libde265/decctx.cc
index 223a6aaf..350f7e7a 100644
--- a/libde265/decctx.cc
+++ b/libde265/decctx.cc
@@ -580,20 +580,21 @@ de265_error decoder_context::read_pps_NAL(bitreader& reader)
   logdebug(LogHeaders,"----> read PPS\n");
 
   std::shared_ptr<pic_parameter_set> new_pps = std::make_shared<pic_parameter_set>();
 
   bool success = new_pps->read(&reader,this);
+  if (!success) {
+    return DE265_WARNING_PPS_HEADER_INVALID;
+  }
 
   if (param_pps_headers_fd>=0) {
     new_pps->dump(param_pps_headers_fd);
   }
 
-  if (success) {
-    pps[ (int)new_pps->pic_parameter_set_id ] = new_pps;
-  }
+  pps[ (int)new_pps->pic_parameter_set_id ] = new_pps;
 
-  return success ? DE265_OK : DE265_WARNING_PPS_HEADER_INVALID;
+  return DE265_OK;
 }
 
 de265_error decoder_context::read_sei_NAL(bitreader& reader, bool suffix)
 {
   logdebug(LogHeaders,"----> read SEI\n");

Vulnerable code:   if (success) {
    pps[ (int)new_pps->pic_parameter_set_id ] = new_pps;
  }
  return success ? DE265_OK : DE265_WARNING_PPS_HEADER_INVALID;
Fixed code:   if (!success) {
    return DE265_WARNING_PPS_HEADER_INVALID;
  }
  pps[ (int)new_pps->pic_parameter_set_id ] = new_pps;
  return DE265_OK;
CVE-2023-47471: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: Buffer Overflow vulnerability in strukturag libde265 v1.10.12 allows a local attacker to cause a denial of service via the slice_segment_header function in the slice.cc component.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 6.5
Published: 2023-11-16T04:15Z
Repository: https://github.com/strukturag/libde265
Language: C++
Files changed: libde265/slice.cc
Commit date: 2023-11-04 15:20:50 +0100
Commit message: null-pointer check in debug output (fixes #426)

Diff: diff --git a/libde265/slice.cc b/libde265/slice.cc
index 280b7417..435123dc 100644
--- a/libde265/slice.cc
+++ b/libde265/slice.cc
@@ -1275,18 +1275,27 @@ void slice_segment_header::dump_slice_segment_header(const decoder_context* ctx,
 #define LOG1(t,d) log2fh(fh, t,d)
 #define LOG2(t,d1,d2) log2fh(fh, t,d1,d2)
 #define LOG3(t,d1,d2,d3) log2fh(fh, t,d1,d2,d3)
 #define LOG4(t,d1,d2,d3,d4) log2fh(fh, t,d1,d2,d3,d4)
 
+  LOG0("----------------- SLICE -----------------\n");
+
   const pic_parameter_set* pps = ctx->get_pps(slice_pic_parameter_set_id);
+  if (!pps) {
+    LOG0("invalid PPS referenced\n");
+    return;
+  }
   assert(pps->pps_read); // TODO: error handling
 
   const seq_parameter_set* sps = ctx->get_sps((int)pps->seq_parameter_set_id);
+  if (!sps) {
+    LOG0("invalid SPS referenced\n");
+    return;
+  }
   assert(sps->sps_read); // TODO: error handling
 
 
-  LOG0("----------------- SLICE -----------------\n");
   LOG1("first_slice_segment_in_pic_flag      : %d\n", first_slice_segment_in_pic_flag);
   if (ctx->get_nal_unit_type() >= NAL_UNIT_BLA_W_LP &&
       ctx->get_nal_unit_type() <= NAL_UNIT_RESERVED_IRAP_VCL23) {
     LOG1("no_output_of_prior_pics_flag         : %d\n", no_output_of_prior_pics_flag);
   }

Vulnerable code:   LOG0("----------------- SLICE -----------------\n");
Fixed code:   LOG0("----------------- SLICE -----------------\n");

  if (!pps) {
    LOG0("invalid PPS referenced\n");
    return;
  }
  if (!sps) {
    LOG0("invalid SPS referenced\n");
    return;
  }
CVE-2015-3010: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: ceph-deploy before 1.5.23 uses weak permissions (644) for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Published: 2015-06-16T16:59Z
Repository: https://github.com/ceph/ceph-deploy
Language: Unknown
Commit date: 2015-03-20 13:49:06 -0400
Commit message: Merge pull request #272 from trhoden/wip_key_perms

Fix: keyring permissions where world readable
CVE-2018-11647: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: index.js in oauth2orize-fprm before 0.2.1 has XSS via a crafted URL.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-06-17T16:29Z
Repository: https://github.com/jaredhanson/oauth2orize-fprm
Language: Unknown
Commit date: 2018-05-01 13:24:35 -0700
Commit message: Merge pull request #4 from MarcinHoppe/fix-number-encoding

Correctly encoding values that are not strings
CVE-2012-2385: Resource Management Errors (CWE-399)
value: The terminal dispatcher in mosh before 1.2.1 allows remote authenticated users to cause a denial of service (long loop and CPU consumption) via an escape sequence with a large repeat count value.
CWE description: Weaknesses in this category are related to improper management of system resources.
Published: 2012-06-29T19:55Z
Repository: https://github.com/keithw/mosh
Language: C++
Files changed: src/terminal/terminaldispatcher.cc, src/terminal/terminaldispatcher.h
Commit date: 2012-05-15 23:46:09 -0400
Commit message: Cap escape sequence parameters to prevent long loops.

Fixes #271 github issue.

Diff: diff --git a/src/terminal/terminaldispatcher.cc b/src/terminal/terminaldispatcher.cc
index ae02bff..de07b80 100644
--- a/src/terminal/terminaldispatcher.cc
+++ b/src/terminal/terminaldispatcher.cc
@@ -114,10 +114,15 @@ int Dispatcher::getparam( size_t N, int defaultval )
   }
 
   if ( parsed_params.size() > N ) {
     ret = parsed_params[ N ];
   }
+
+  if ( ret > PARAM_MAX ) {
+    ret = defaultval;
+  }
+
   if ( ret < 1 ) ret = defaultval;
 
   return ret;
 }
 
diff --git a/src/terminal/terminaldispatcher.h b/src/terminal/terminaldispatcher.h
index bdad3c1..f5f801c 100644
--- a/src/terminal/terminaldispatcher.h
+++ b/src/terminal/terminaldispatcher.h
@@ -75,10 +75,13 @@ namespace Terminal {
     std::vector<wchar_t> OSC_string; /* only used to set the window title */
 
     void parse_params( void );
 
   public:
+    static const int PARAM_MAX = 65535;
+    /* prevent evil escape sequences from causing long loops */
+
     std::string terminal_to_host; /* this is the reply string */
 
     Dispatcher();
     int getparam( size_t N, int defaultval );
     int param_count( void );

Fixed code: 
  if ( ret > PARAM_MAX ) {
    ret = defaultval;
  }

    static const int PARAM_MAX = 65535;
    /* prevent evil escape sequences from causing long loops */
CVE-2021-23555: Insufficient Information (NVD-CWE-noinfo)
value: The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stacktraces, which can lead to execution of arbitrary code on the host machine.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2022-02-11T20:15Z
Repository: https://github.com/patriksimek/vm2
Language: Unknown
Commit date: 2022-02-08 14:26:00 +0100
Commit message: Merge pull request #395 from XmiliaH/security-fixes

Internal restructuring and security improvements
CVE-2022-36067: Improper Control of Dynamically-Managed Code Resources (CWE-913)
value: vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds.
CWE description: The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
CVSS v3 base score: 10
Published: 2022-09-06T22:15Z
Repository: https://github.com/patriksimek/vm2
Language: JavaScript
Files changed: lib/setup-sandbox.js, test/vm.js
Commit date: 2022-08-28 15:50:12 +0200
Commit message: Fix 467

Diff: diff --git a/lib/setup-sandbox.js b/lib/setup-sandbox.js
index 2c80dbc..f6cbb8e 100644
--- a/lib/setup-sandbox.js
+++ b/lib/setup-sandbox.js
@@ -65,11 +65,12 @@ if (!localReflectSetPrototypeOf(context, localObject.prototype)) throw localUnex
 
 Object.defineProperties(global, {
 	global: {value: global, writable: true, configurable: true, enumerable: true},
 	globalThis: {value: global, writable: true, configurable: true},
 	GLOBAL: {value: global, writable: true, configurable: true},
-	root: {value: global, writable: true, configurable: true}
+	root: {value: global, writable: true, configurable: true},
+	Error: {value: LocalError}
 });
 
 if (!localReflectDefineProperty(global, 'VMError', {
 	__proto__: null,
 	value: VMError,
diff --git a/test/vm.js b/test/vm.js
index b72265d..d4f6a9f 100644
--- a/test/vm.js
+++ b/test/vm.js
@@ -1068,10 +1068,17 @@ describe('VM', () => {
 			(_, c) => c.map(c => c.getThis()).find(a => a);
 			const { stack } = new Error();
 			Error.prepareStackTrace = undefined;
 			stack.process
 		`));
+		assert.throws(()=>vm2.run(`(()=>{
+			const OldError = Error;
+			global.Error = {prepareStackTrace: (_, c) => c.map(c => c.getThis()).find(a => a && a.process)};
+			const { stack } = new OldError();
+			global.Error = OldError;
+			return stack.process.mainModule;
+		})()`));
 	});
 
 	it('Node internal prepareStackTrace attack', () => {
 		const vm2 = new VM();
 

Vulnerable code: 	root: {value: global, writable: true, configurable: true}
Fixed code: 	root: {value: global, writable: true, configurable: true},
	Error: {value: LocalError}
		assert.throws(()=>vm2.run(`(()=>{
			const OldError = Error;
			global.Error = {prepareStackTrace: (_, c) => c.map(c => c.getThis()).find(a => a && a.process)};
			const { stack } = new OldError();
			global.Error = OldError;
			return stack.process.mainModule;
		})()`));
CVE-2023-32313: Insufficient Information (NVD-CWE-noinfo)
value: vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node `inspect` method and edit options for `console.log`. As a result a threat actor can edit options for the `console.log` command. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. Users unable to upgrade may make the `inspect` method readonly with `vm.readonly(inspect)` after creating a vm.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.3
Published: 2023-05-15T20:15Z
Repository: https://github.com/patriksimek/vm2
Language: JavaScript
Files changed: lib/vm.js
Commit date: 2023-05-13 21:15:24 +0200
Commit message: Inspect method should be readonly

Diff: diff --git a/lib/vm.js b/lib/vm.js
index 1463e17..0b71f0b 100644
--- a/lib/vm.js
+++ b/lib/vm.js
@@ -42,10 +42,13 @@ const {
 	lookupCompiler
 } = require('./compiler');
 const {
 	VMScript
 } = require('./script');
+const {
+	inspect
+} = require('util');
 
 const objectDefineProperties = Object.defineProperties;
 
 /**
  * Host objects
@@ -363,10 +366,12 @@ class VM extends EventEmitter {
 			_addProtoMappingFactory: {__proto__: null, value: addProtoMappingFactory},
 			_compiler: {__proto__: null, value: resolvedCompiler},
 			_allowAsync: {__proto__: null, value: allowAsync}
 		});
 
+		this.readonly(inspect);
+
 		// prepare global sandbox
 		if (sandbox) {
 			this.setGlobals(sandbox);
 		}
 	}

Fixed code: const {
	inspect
} = require('util');
		this.readonly(inspect);
CVE-2021-39207: Deserialization of Untrusted Data (CWE-502)
value: parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by unsafe loading which leads to Arbitary code execution. This security bug is patched by avoiding unsafe loader users should update to version above v1.1.0. If upgrading is not possible then users can change the Loader used to SafeLoader as a workaround. See commit 507d066ef432ea27d3e201da08009872a2f37725 for details.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 8.8
Published: 2021-09-10T23:15Z
Repository: https://github.com/facebookresearch/ParlAI
Language: Python
Files changed: parlai/chat_service/utils/config.py
Commit date: 2021-01-26 16:06:01 -0500
Commit message: RCE Fixed (#3402)

Co-authored-by: Anon-Artist <61599526+Anon-Artist@users.noreply.github.com>
Co-authored-by: Jamie Slome <jamie@418sec.com>
Diff: diff --git a/parlai/chat_service/utils/config.py b/parlai/chat_service/utils/config.py
index 3c646a36..b98d22f0 100644
--- a/parlai/chat_service/utils/config.py
+++ b/parlai/chat_service/utils/config.py
@@ -34,11 +34,11 @@ def parse_configuration_file(config_path):
         parsed configuration dictionary
     """
     result = {}
     result["configs"] = {}
     with open(config_path) as f:
-        cfg = yaml.load(f.read(), Loader=yaml.FullLoader)
+        cfg = yaml.load(f.read(), Loader=yaml.SafeLoader)
         # get world path
         result["world_path"] = cfg.get("world_module")
         if not result["world_path"]:
             raise ValueError("Did not specify world module")
         result["overworld"] = cfg.get("overworld")

Vulnerable code:         cfg = yaml.load(f.read(), Loader=yaml.FullLoader)
Fixed code:         cfg = yaml.load(f.read(), Loader=yaml.SafeLoader)
CVE-2021-39207: Deserialization of Untrusted Data (CWE-502)
value: parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by unsafe loading which leads to Arbitary code execution. This security bug is patched by avoiding unsafe loader users should update to version above v1.1.0. If upgrading is not possible then users can change the Loader used to SafeLoader as a workaround. See commit 507d066ef432ea27d3e201da08009872a2f37725 for details.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 8.8
Published: 2021-09-10T23:15Z
Repository: https://github.com/facebookresearch/ParlAI
Language: Python
Files changed: parlai/crowdsourcing/tasks/model_chat/model_chat_blueprint.py
Commit date: 2021-02-03 12:52:21 -0500
Commit message: Update model_chat_blueprint.py (#3429)


Diff: diff --git a/parlai/crowdsourcing/tasks/model_chat/model_chat_blueprint.py b/parlai/crowdsourcing/tasks/model_chat/model_chat_blueprint.py
index c6dedbdf7..bf0e74bc2 100644
--- a/parlai/crowdsourcing/tasks/model_chat/model_chat_blueprint.py
+++ b/parlai/crowdsourcing/tasks/model_chat/model_chat_blueprint.py
@@ -451,11 +451,11 @@ class ModelChatBlueprint(BaseModelChatBlueprint):
             }
         )
 
     def _get_shared_models(self, args: "DictConfig") -> Dict[str, dict]:
         with open(args.blueprint.model_opt_path) as f:
-            all_model_opts = yaml.load(f.read())
+            all_model_opts = yaml.safe_load(f.read())
         active_model_opts = {
             model: opt
             for model, opt in all_model_opts.items()
             if self.conversations_needed[model] > 0
         }
@@ -555,7 +555,7 @@ class ModelImageChatBlueprint(BaseModelChatBlueprint):
             }
         )
 
     def _get_shared_models(self, args: "DictConfig") -> Dict[str, dict]:
         with open(args.blueprint.model_opt_path) as f:
-            model_opts = yaml.load(f.read())
+            model_opts = yaml.safe_load(f.read())
         return TurkLikeAgent.get_bot_agents(args=args, model_opts=model_opts)

Vulnerable code:             all_model_opts = yaml.load(f.read())
            model_opts = yaml.load(f.read())
Fixed code:             all_model_opts = yaml.safe_load(f.read())
            model_opts = yaml.safe_load(f.read())
CVE-2017-14498: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an admin/assets/add pathname, as demonstrated by the admin/pages/edit/EditorToolbar/MediaForm/field/AssetUploadField/upload URI, aka issue SS-2017-017.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-09-15T18:29Z
Repository: https://github.com/silverstripe/silverstripe-framework
Language: PHP
Files changed: filesystem/File.php
Commit date: 2017-05-25 13:07:53 +0100
Commit message: [SS-2017-017] FIX SVG uploads disabled by default

Diff: diff --git a/filesystem/File.php b/filesystem/File.php
index f6aca1d1f..5750414ac 100644
--- a/filesystem/File.php
+++ b/filesystem/File.php
@@ -127,11 +127,11 @@ class File extends DataObject {
 	 */
 	private static $allowed_extensions = array(
 		'','ace','arc','arj','asf','au','avi','bmp','bz2','cab','cda','css','csv','dmg','doc','docx','dotx','dotm',
 		'flv','gif','gpx','gz','hqx','ico','jar','jpeg','jpg','js','kml', 'm4a','m4v',
 		'mid','midi','mkv','mov','mp3','mp4','mpa','mpeg','mpg','ogg','ogv','pages','pcx','pdf','pkg',
-		'png','pps','ppt','pptx','potx','potm','ra','ram','rm','rtf','sit','sitx', 'svg', 'tar','tgz','tif','tiff',
+		'png','pps','ppt','pptx','potx','potm','ra','ram','rm','rtf','sit','sitx', 'tar','tgz','tif','tiff',
 		'txt','wav','webm','wma','wmv','xls','xlsx','xltx','xltm','zip','zipx',
 	);
 
 	/**
 	 * @config

Vulnerable code: 		'png','pps','ppt','pptx','potx','potm','ra','ram','rm','rtf','sit','sitx', 'svg', 'tar','tgz','tif','tiff',
Fixed code: 		'png','pps','ppt','pptx','potx','potm','ra','ram','rm','rtf','sit','sitx', 'tar','tgz','tif','tiff',
CVE-2015-7314: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Published: 2015-10-06T01:59Z
Repository: https://github.com/gollum/gollum
Language: Ruby
Files changed: lib/gollum/app.rb
Commit date: 2015-09-20 13:53:02 +0200
Commit message: Added security check.

Diff: diff --git a/lib/gollum/app.rb b/lib/gollum/app.rb
index 12e4754..3fde8bf 100644
--- a/lib/gollum/app.rb
+++ b/lib/gollum/app.rb
@@ -174,10 +174,11 @@ module Precious
 
       if params[:file]
         fullname = params[:file][:filename]
         tempfile = params[:file][:tempfile]
       end
+      halt 500 unless tempfile.is_a? Tempfile
 
       # Remove page file dir prefix from upload path if necessary -- committer handles this itself
       dir      = wiki.per_page_uploads ? params[:upload_dest].match(/^(#{wiki.page_file_dir}\/+)?(.*)/)[2] : 'uploads'
       ext      = ::File.extname(fullname)
       format   = ext.split('.').last || 'txt'

Fixed code:       halt 500 unless tempfile.is_a? Tempfile
CVE-2022-23462: Out-of-bounds Write (CWE-787)
value: IOWOW is a C utility library and persistent key/value storage engine. Versions 1.4.15 and prior contain a stack buffer overflow vulnerability that allows for Denial of Service (DOS) when it parses scientific notation numbers present in JSON. A patch for this issue is available at commit a79d31e4cff1d5a08f665574b29fd885897a28fd in the `master` branch of the repository. There are no workarounds other than applying the patch.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2022-10-21T22:15Z
Repository: https://github.com/Softmotions/iowow
Language: Other
Files changed: Changelog, src/json/iwjson.c
Commit date: 2022-08-25 12:30:36 +0700
Commit message: * Fixed Github Vulnerability Report GHSL-2022-066

Diff: diff --git a/Changelog b/Changelog
index e231d4f..58c1137 100644
--- a/Changelog
+++ b/Changelog
@@ -1,7 +1,8 @@
 iowow (1.4.16) UNRELEASED; urgency=medium
 
+  * Fixed Github Vulnerability Report GHSL-2022-066
   * Added additional IW_ERROR_XX codes (iwlog.h)
   * Added VERBOSE log level (iwlog.h)
   * Added iwhmap_put_str() (iwhmap.h)
   * Added iwulist_remove_first_by(), iwulist_find_first() (iwarr.h)
   * Added iwxstr_new_printf() (iwxstr.h)
diff --git a/src/json/iwjson.c b/src/json/iwjson.c
index 601a36b..df6ff39 100644
--- a/src/json/iwjson.c
+++ b/src/json/iwjson.c
@@ -24,11 +24,11 @@ IW_INLINE int _jbl_printf_estimate_size(const char *format, va_list ap) {
 IW_INLINE void _jbn_remove_item(JBL_NODE parent, JBL_NODE child);
 static void _jbn_add_item(JBL_NODE parent, JBL_NODE node);
 
 void iwjson_ftoa(long double val, char buf[static IWNUMBUF_SIZE], size_t *out_len) {
   // TODO: review
-  int len = snprintf(buf, 64, "%.8Lf", val);
+  int len = snprintf(buf, IWNUMBUF_SIZE, "%.8Lf", val);
   if (len <= 0) {
     buf[0] = '\0';
     *out_len = 0;
     return;
   }

Vulnerable code:   int len = snprintf(buf, 64, "%.8Lf", val);
Fixed code:   * Fixed Github Vulnerability Report GHSL-2022-066
  int len = snprintf(buf, IWNUMBUF_SIZE, "%.8Lf", val);
CVE-2020-4044: Stack-based Buffer Overflow (CWE-121)
value: The xrdp-sesman service before version 0.9.13.1 can be crashed by connecting over port 3350 and supplying a malicious payload. Once the xrdp-sesman process is dead, an unprivileged attacker on the server could then proceed to start their own imposter sesman service listening on port 3350. This will allow them to capture any user credentials that are submitted to XRDP and approve or reject arbitrary login credentials. For xorgxrdp sessions in particular, this allows an unauthorized user to hijack an existing session. This is a buffer overflow attack, so there may be a risk of arbitrary code execution as well.
CWE description: A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CVSS v3 base score: 7.8
Published: 2020-06-30T16:15Z
Repository: https://github.com/neutrinolabs/xrdp
Language: Unknown
Commit date: 2020-06-26 20:09:03 +0900
Commit message: Merge pull request from GHSA-j9fv-6fwf-p3g4

Fix for CVE-2020-4044
CVE-2022-23613: Integer Underflow (Wrap or Wraparound) (CWE-191)
value: xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow leading to a heap overflow in the sesman server allows any unauthenticated attacker which is able to locally access a sesman server to execute code as root. This vulnerability has been patched in version 0.9.18.1 and above. Users are advised to upgrade. There are no known workarounds.
CWE description: The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CVSS v3 base score: 7.8
Published: 2022-02-07T22:15Z
Repository: https://github.com/neutrinolabs/xrdp
Language: Unknown
Commit date: 2022-02-07 15:18:15 +0900
Commit message: Merge pull request from GHSA-8h98-h426-xf32

Add lower bound to sesman data input size check
CVE-2023-40184: Improper Handling of Exceptional Conditions (CWE-755)
value:  xrdp is an open source remote desktop protocol (RDP) server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The `auth_start_session` function can return non-zero (1) value on, e.g., PAM error which may result in in session restrictions such as max concurrent sessions per user by PAM (ex ./etc/security/limits.conf) to be bypassed. Users (administrators) don't use restrictions by PAM are not affected. This issue has been addressed in release version 0.9.23. Users are advised to upgrade. There are no known workarounds for this issue.
CWE description: The product does not handle or incorrectly handles an exceptional condition.
CVSS v3 base score: 6.5
Published: 2023-08-30T18:15Z
Repository: https://github.com/neutrinolabs/xrdp
Language: Unknown
Commit date: 2023-08-24 10:14:48 +0900
Commit message: Merge pull request from GHSA-f489-557v-47jq

Check auth_start_session() result
CVE-2023-42822: Out-of-bounds Read (CWE-125)
value:  xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2023-09-27T18:15Z
Repository: https://github.com/neutrinolabs/xrdp
Language: Unknown
Commit date: 2023-09-27 17:37:24 +0900
Commit message: Merge pull request from GHSA-2hjx-rm4f-r9hw

CVE-2023-42822
CVE-2024-39917: Insufficient Information (NVD-CWE-noinfo)
value: xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be  limited by a configuration parameter `MaxLoginRetry` in `/etc/xrdp/sesman.ini`. However, this mechanism was not effectively working. As a result, xrdp allows an infinite number of login attempts. 
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-12T16:15Z
Repository: https://github.com/neutrinolabs/xrdp
Language: Unknown
Commit date: 2024-07-11 09:37:12 +0900
Commit message: Merge pull request from GHSA-7w22-h4w7-8j5j

Enforce no login screen if require_credentials is set
CVE-2022-4952: Insufficient Information (NVD-CWE-noinfo)
value: A vulnerability has been found in OmniSharp csharp-language-server-protocol up to 0.19.6 and classified as problematic. This vulnerability affects the function CreateSerializerSettings of the file src/JsonRpc/Serialization/SerializerBase.cs of the component JSON Serializer. The manipulation leads to resource consumption. Upgrading to version 0.19.7 is able to address this issue. The patch is identified as 7fd2219f194a9ef2a8901bb131c5fa12272305ce. It is recommended to upgrade the affected component. VDB-234238 is the identifier assigned to this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2023-07-17T02:15Z
Repository: https://github.com/OmniSharp/csharp-language-server-protocol
Language: C#
Files changed: src/JsonRpc/Serialization/SerializerBase.cs
Commit date: 2022-12-02 14:31:07 -0500
Commit message: Set max depth for JSON serializer to mitigate known DOS vulnerability (#902)

The other option is to update Newtonsoft.Json, which now also sets the
maximum depth by default, but this mitigates without having to update.
Diff: diff --git a/src/JsonRpc/Serialization/SerializerBase.cs b/src/JsonRpc/Serialization/SerializerBase.cs
index 868be57c..b50131e1 100644
--- a/src/JsonRpc/Serialization/SerializerBase.cs
+++ b/src/JsonRpc/Serialization/SerializerBase.cs
@@ -17,11 +17,11 @@ protected virtual JsonSerializer CreateSerializer()
             return _jsonSerializer = serializer;
         }
 
         protected virtual JsonSerializerSettings CreateSerializerSettings()
         {
-            var settings = JsonConvert.DefaultSettings != null ? JsonConvert.DefaultSettings() : new JsonSerializerSettings();
+            var settings = JsonConvert.DefaultSettings != null ? JsonConvert.DefaultSettings() : new JsonSerializerSettings { MaxDepth = 128 };
             AddOrReplaceConverters(settings.Converters);
             return _settings = settings;
         }
 
         protected internal static void RemoveConverter<T>(ICollection<JsonConverter> converters)

Vulnerable code:             var settings = JsonConvert.DefaultSettings != null ? JsonConvert.DefaultSettings() : new JsonSerializerSettings();
Fixed code:             var settings = JsonConvert.DefaultSettings != null ? JsonConvert.DefaultSettings() : new JsonSerializerSettings { MaxDepth = 128 };
CVE-2021-4274: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, has been found in sileht bird-lg. This issue affects some unknown processing of the file templates/layout.html. The manipulation of the argument request_args leads to cross site scripting. The attack may be initiated remotely. The name of the patch is ef6b32c527478fefe7a4436e10b96ee28ed5b308. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216479.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-21T19:15Z
Repository: https://github.com/sileht/bird-lg
Language: HTML
Files changed: templates/layout.html
Commit date: 2021-05-10 23:03:14 +0200
Commit message: Fix XSS when handling query

Fixes #63

Diff: diff --git a/templates/layout.html b/templates/layout.html
index d57ca80..c0b7281 100644
--- a/templates/layout.html
+++ b/templates/layout.html
@@ -118,11 +118,11 @@
 		<script type="text/javascript" src="{{url_for('static', filename='js/bootstrap.min.js') }}"></script>
         <script type="text/javascript" src="{{url_for('static', filename='js/jquery.dataTables.js') }}"></script>
         <script type="text/javascript" src="{{url_for('static', filename='js/DT_bootstrap.js') }}"></script>
 		<script type="text/javascript">
 			request_type = "{{session.request_type}}";
-			request_args = "{{session.request_args|safe}}";
+			request_args = "{{session.request_args}}";
 			hosts = "{{session.hosts}}";
 			proto = "{{session.proto}}";
 			history_query = {{session.history|tojson|safe}};
 </script>
 <script type="text/javascript" src="{{url_for('static', filename='js/lg.js') }}"></script>

Vulnerable code: 			request_args = "{{session.request_args|safe}}";
Fixed code: 			request_args = "{{session.request_args}}";
CVE-2020-16587: Out-of-bounds Write (CWE-787)
value: A heap-based buffer overflow vulnerability exists in Academy Software Foundation OpenEXR 2.3.0 in chunkOffsetReconstruction in ImfMultiPartInputFile.cpp that can cause a denial of service via a crafted EXR file.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2020-12-09T21:15Z
Repository: https://github.com/AcademySoftwareFoundation/openexr
Language: C++
Files changed: OpenEXR/IlmImf/ImfMultiPartInputFile.cpp
Commit date: 2019-07-25 20:15:30 +1200
Commit message: Fix #491, issue with part number range check reconstructing chunk offset table

The chunk offset was incorrectly testing for a part number that was the
same size (i.e. an invalid index)

Signed-off-by: Kimball Thurston <kdt3rd@gmail.com>

Diff: diff --git a/OpenEXR/IlmImf/ImfMultiPartInputFile.cpp b/OpenEXR/IlmImf/ImfMultiPartInputFile.cpp
index 6a1fbfd..da061bd 100644
--- a/OpenEXR/IlmImf/ImfMultiPartInputFile.cpp
+++ b/OpenEXR/IlmImf/ImfMultiPartInputFile.cpp
@@ -569,11 +569,11 @@ MultiPartInputFile::Data::chunkOffsetReconstruction(OPENEXR_IMF_INTERNAL_NAMESPA
                 OPENEXR_IMF_INTERNAL_NAMESPACE::Xdr::read <OPENEXR_IMF_INTERNAL_NAMESPACE::StreamIO> (is, partNumber);
             }
             
             
             
-            if(partNumber<0 || partNumber> static_cast<int>(parts.size()))
+            if(partNumber<0 || partNumber>= static_cast<int>(parts.size()))
             {
                 throw IEX_NAMESPACE::IoExc("part number out of range");
             }
             
             Header& header = parts[partNumber]->header;

Vulnerable code:             if(partNumber<0 || partNumber> static_cast<int>(parts.size()))
Fixed code:             if(partNumber<0 || partNumber>= static_cast<int>(parts.size()))
CVE-2020-16588: NULL Pointer Dereference (CWE-476)
value: A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp that can cause a denial of service via a crafted EXR file.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2020-12-09T21:15Z
Repository: https://github.com/AcademySoftwareFoundation/openexr
Language: C++
Files changed: OpenEXR/exrmakepreview/makePreview.cpp
Commit date: 2019-07-25 21:06:57 +1200
Commit message: Fix logic for 1 pixel high/wide preview images (Fixes #493)

Diff: diff --git a/OpenEXR/exrmakepreview/makePreview.cpp b/OpenEXR/exrmakepreview/makePreview.cpp
index ae0e99df..e2d08798 100644
--- a/OpenEXR/exrmakepreview/makePreview.cpp
+++ b/OpenEXR/exrmakepreview/makePreview.cpp
@@ -118,12 +118,12 @@ generatePreview (const char inFileName[],
     //
 
     previewHeight = max (int (h / (w * a) * previewWidth + .5f), 1);
     previewPixels.resizeErase (previewHeight, previewWidth);
 
-    float fx = (previewWidth  > 0)? (float (w - 1) / (previewWidth  - 1)): 1;
-    float fy = (previewHeight > 0)? (float (h - 1) / (previewHeight - 1)): 1;
+    float fx = (previewWidth  > 1)? (float (w - 1) / (previewWidth  - 1)): 1;
+    float fy = (previewHeight > 1)? (float (h - 1) / (previewHeight - 1)): 1;
     float m  = Math<float>::pow (2.f, IMATH_NAMESPACE::clamp (exposure + 2.47393f, -20.f, 20.f));
 
     for (int y = 0; y < previewHeight; ++y)
     {
 	for (int x = 0; x < previewWidth; ++x)

Vulnerable code:     float fx = (previewWidth  > 0)? (float (w - 1) / (previewWidth  - 1)): 1;
    float fy = (previewHeight > 0)? (float (h - 1) / (previewHeight - 1)): 1;
Fixed code:     float fx = (previewWidth  > 1)? (float (w - 1) / (previewWidth  - 1)): 1;
    float fy = (previewHeight > 1)? (float (h - 1) / (previewHeight - 1)): 1;
CVE-2020-16589: Out-of-bounds Write (CWE-787)
value: A head-based buffer overflow exists in Academy Software Foundation OpenEXR 2.3.0 in writeTileData in ImfTiledOutputFile.cpp that can cause a denial of service via a crafted EXR file.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2020-12-09T21:15Z
Repository: https://github.com/AcademySoftwareFoundation/openexr
Language: C++
Files changed: OpenEXR/IlmImf/ImfTiledInputFile.cpp
Commit date: 2019-07-25 21:06:42 +1200
Commit message: Fix for #494: validate tile coordinates when doing copyPixels

Diff: diff --git a/OpenEXR/IlmImf/ImfTiledInputFile.cpp b/OpenEXR/IlmImf/ImfTiledInputFile.cpp
index 15c51c50..bda7bad5 100644
--- a/OpenEXR/IlmImf/ImfTiledInputFile.cpp
+++ b/OpenEXR/IlmImf/ImfTiledInputFile.cpp
@@ -1311,10 +1311,17 @@ TiledInputFile::rawTileData (int &dx, int &dy,
             if (old_dx!=dx || old_dy !=dy || old_lx!=lx || old_ly!=ly)
             {
                 throw IEX_NAMESPACE::ArgExc ("rawTileData read the wrong tile");
             }
         }
+        else
+        {
+             if(!isValidTile (dx, dy, lx, ly) )
+             {
+                 throw IEX_NAMESPACE::IoExc ("rawTileData read an invalid tile");
+             }
+        }
         pixelData = tileBuffer->buffer;
     }
     catch (IEX_NAMESPACE::BaseExc &e)
     {
         REPLACE_EXC (e, "Error reading pixel data from image "

Fixed code:         else
        {
             if(!isValidTile (dx, dy, lx, ly) )
             {
                 throw IEX_NAMESPACE::IoExc ("rawTileData read an invalid tile");
             }
        }
CVE-2021-20298: Out-of-bounds Write (CWE-787)
value: A flaw was found in OpenEXR's B44Compressor. This flaw allows an attacker who can submit a crafted file to be processed by OpenEXR, to exhaust all memory accessible to the application. The highest threat from this vulnerability is to system availability.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2022-08-23T16:15Z
Repository: https://github.com/AcademySoftwareFoundation/openexr
Language: C++
Files changed: OpenEXR/IlmImf/ImfB44Compressor.cpp
Commit date: 2020-10-07 14:38:59 +1300
Commit message: reduce B44 _tmpBufferSize (was allocating two bytes per byte) (#843)

Signed-off-by: Peter Hillman <peterh@wetafx.co.nz>
Diff: diff --git a/OpenEXR/IlmImf/ImfB44Compressor.cpp b/OpenEXR/IlmImf/ImfB44Compressor.cpp
index 0725659d..5e2ab9ea 100644
--- a/OpenEXR/IlmImf/ImfB44Compressor.cpp
+++ b/OpenEXR/IlmImf/ImfB44Compressor.cpp
@@ -492,11 +492,11 @@ B44Compressor::B44Compressor
     // compress() and uncompress() functions, below, and determine
     // if uncompressed pixel data should be in native or Xdr format.
     //
 
     _tmpBuffer = new unsigned short
-        [checkArraySize (uiMult (maxScanLineSize, numScanLines),
+        [checkArraySize (uiMult (maxScanLineSize / sizeof(unsigned short), numScanLines),
                          sizeof (unsigned short))];
 
     const ChannelList &channels = header().channels();
     int numHalfChans = 0;
 

Vulnerable code:         [checkArraySize (uiMult (maxScanLineSize, numScanLines),
Fixed code:         [checkArraySize (uiMult (maxScanLineSize / sizeof(unsigned short), numScanLines),
CVE-2021-20299: NULL Pointer Dereference (CWE-476)
value: A flaw was found in OpenEXR's Multipart input file functionality. A crafted multi-part input file with no actual parts can trigger a NULL pointer dereference. The highest threat from this vulnerability is to system availability.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2022-03-16T15:15Z
Repository: https://github.com/AcademySoftwareFoundation/openexr
Language: C++
Files changed: OpenEXR/IlmImf/ImfMultiPartInputFile.cpp
Commit date: 2020-09-22 18:52:57 +1200
Commit message: add sanity check for reading multipart files with no parts (#840)

Signed-off-by: Peter Hillman <peterh@wetafx.co.nz>
Diff: diff --git a/OpenEXR/IlmImf/ImfMultiPartInputFile.cpp b/OpenEXR/IlmImf/ImfMultiPartInputFile.cpp
index 689956c9..cbb2ec23 100644
--- a/OpenEXR/IlmImf/ImfMultiPartInputFile.cpp
+++ b/OpenEXR/IlmImf/ImfMultiPartInputFile.cpp
@@ -338,10 +338,15 @@ MultiPartInputFile::initialize()
 
     //
     // Perform usual check on headers.
     //
 
+    if ( _data->_headers.size() == 0)
+    {
+        throw IEX_NAMESPACE::ArgExc ("Files must contain at least one header");
+    }
+
     for (size_t i = 0; i < _data->_headers.size(); i++)
     {
         //
         // Silently invent a type if the file is a single part regular image.
         //

Fixed code:     if ( _data->_headers.size() == 0)
    {
        throw IEX_NAMESPACE::ArgExc ("Files must contain at least one header");
    }
CVE-2021-45942: Out-of-bounds Write (CWE-787)
value: OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf_3_1::LineCompositeTask::execute (called from IlmThread_3_1::NullThreadPoolProvider::addTask and IlmThread_3_1::ThreadPool::addGlobalTask). NOTE: db217f2 may be inapplicable.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2022-01-01T01:15Z
Repository: https://github.com/AcademySoftwareFoundation/openexr
Language: C++
Files changed: src/lib/OpenEXR/ImfCompositeDeepScanLine.cpp
Commit date: 2021-12-02 13:06:35 -0800
Commit message: enforce xSampling/ySampling==1 in CompositeDeepScanLine (#1209)

Signed-off-by: Peter Hillman <peterh@wetafx.co.nz>
Diff: diff --git a/src/lib/OpenEXR/ImfCompositeDeepScanLine.cpp b/src/lib/OpenEXR/ImfCompositeDeepScanLine.cpp
index 158a9ec9e..644cb3570 100644
--- a/src/lib/OpenEXR/ImfCompositeDeepScanLine.cpp
+++ b/src/lib/OpenEXR/ImfCompositeDeepScanLine.cpp
@@ -236,10 +236,24 @@ CompositeDeepScanLine::setFrameBuffer(const FrameBuffer& fr)
     _Data->_channels[2]="A";
     _Data->_bufferMap.resize(0);
     
     for(FrameBuffer::ConstIterator q=fr.begin();q!=fr.end();q++)
     {
+
+        //
+        // Frame buffer must have xSampling and ySampling set to 1
+        // (Sampling in FrameBuffers must match sampling in file,
+        //  and Header::sanityCheck enforces sampling in deep files is 1)
+        //
+
+        if(q.slice().xSampling!=1 || q.slice().ySampling!=1)
+        {
+             THROW (IEX_NAMESPACE::ArgExc, "X and/or y subsampling factors "
+				"of \"" << q.name() << "\" channel in framebuffer "
+				"are not 1");
+        }
+
         string name(q.name());
         if(name=="ZBack")
         {
             _Data->_bufferMap.push_back(1);
         }else if(name=="Z")

Fixed code: 
        //
        // Frame buffer must have xSampling and ySampling set to 1
        // (Sampling in FrameBuffers must match sampling in file,
        //  and Header::sanityCheck enforces sampling in deep files is 1)
        //

        if(q.slice().xSampling!=1 || q.slice().ySampling!=1)
        {
             THROW (IEX_NAMESPACE::ArgExc, "X and/or y subsampling factors "
				"of \"" << q.name() << "\" channel in framebuffer "
				"are not 1");
        }
CVE-2022-39304: Generation of Error Message Containing Sensitive Information (CWE-209)
value: ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1, when the request to refresh an installation token failed, the HTTP request and response would be returned for debugging. The request contained the bearer JWT for the App, and was returned back to clients. This token is short lived (10 minute maximum). This issue has been patched and is available in version 2.0.0.

CWE description: The product generates an error message that includes sensitive information about its environment, users, or associated data.
CVSS v3 base score: 4.7
Published: 2022-12-20T20:15Z
Repository: https://github.com/bradleyfalzon/ghinstallation
Language: Go
Files changed: transport.go
Commit date: 2021-03-08 13:28:58 -0500
Commit message: Add StatusCode to error message if refreshToken() fails due to an suspended app (#44)

Add StatusCode to error message if refreshToken() fails due to an suspended app
Diff: diff --git a/transport.go b/transport.go
index c37d09e..d4736c8 100644
--- a/transport.go
+++ b/transport.go
@@ -168,11 +168,11 @@ func (t *Transport) refreshToken(ctx context.Context) error {
 		return fmt.Errorf("could not get access_tokens from GitHub API for installation ID %v: %v", t.installationID, err)
 	}
 	defer resp.Body.Close()
 
 	if resp.StatusCode/100 != 2 {
-		return fmt.Errorf("request %+v received non 2xx response status %q with body %+v and TLS %+v", resp.Request, resp.Body, resp.Request, resp.TLS)
+		return fmt.Errorf("received non 2xx response status %q when fetching %v", resp.Status, req.URL)
 	}
 
 	return json.NewDecoder(resp.Body).Decode(&t.token)
 }
 

Vulnerable code: 		return fmt.Errorf("request %+v received non 2xx response status %q with body %+v and TLS %+v", resp.Request, resp.Body, resp.Request, resp.TLS)
Fixed code: 		return fmt.Errorf("received non 2xx response status %q when fetching %v", resp.Status, req.URL)
CVE-2020-1896: Out-of-bounds Write (CWE-787)
value: A stack overflow vulnerability in Facebook Hermes 'builtin apply' prior to commit 86543ac47e59c522976b5632b8bf9a2a4583c7d2 (https://github.com/facebook/hermes/commit/86543ac47e59c522976b5632b8bf9a2a4583c7d2) allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2021-02-02T07:15Z
Repository: https://github.com/facebook/hermes
Language: C++
Files changed: lib/VM/JSLib/HermesBuiltin.cpp, test/hermes/stack-overflow-apply.js
Commit date: 2020-02-26 19:00:37 -0800
Commit message: Added stack overflow check for hermes::vm:: hermesBuiltinApply

Summary: This adds a missing check for stack overflow.

Reviewed By: tmikov

Differential Revision: D20104955

fbshipit-source-id: 1f37e23d2e28ebcd3aa4176d134b8418e7059ebd

Diff: diff --git a/lib/VM/JSLib/HermesBuiltin.cpp b/lib/VM/JSLib/HermesBuiltin.cpp
index 6b42c091..dfe931b1 100644
--- a/lib/VM/JSLib/HermesBuiltin.cpp
+++ b/lib/VM/JSLib/HermesBuiltin.cpp
@@ -651,10 +651,13 @@ hermesBuiltinApply(void *, Runtime *runtime, NativeArgs args) {
     thisVal = args.getArg(2);
   }
 
   ScopedNativeCallFrame newFrame{
       runtime, len, *fn, isConstructor, thisVal.getHermesValue()};
+  if (LLVM_UNLIKELY(newFrame.overflowed()))
+    return runtime->raiseStackOverflow(Runtime::StackOverflowKind::NativeStack);
+
   for (uint32_t i = 0; i < len; ++i) {
     newFrame->getArgRef(i) = argArray->at(runtime, i);
   }
   return isConstructor ? Callable::construct(fn, runtime, thisVal)
                        : Callable::call(fn, runtime);
diff --git a/test/hermes/stack-overflow-apply.js b/test/hermes/stack-overflow-apply.js
index 7519ea22..caf2dd40 100644
--- a/test/hermes/stack-overflow-apply.js
+++ b/test/hermes/stack-overflow-apply.js
@@ -30,5 +30,16 @@ try {
   func.apply(99, x);
 } catch (e) {
     print("caught:", e.name, e.message);
 }
 //CHECK: caught: RangeError {{.*}}
+
+try {
+  v0 = [1.1];
+  function v1() {
+    v1(...v0);
+  }
+  v1();
+} catch (e) {
+    print("caught:", e.name, e.message);
+}
+//CHECK: caught: RangeError {{.*}}

Fixed code:   if (LLVM_UNLIKELY(newFrame.overflowed()))
    return runtime->raiseStackOverflow(Runtime::StackOverflowKind::NativeStack);


try {
  v0 = [1.1];
  function v1() {
    v1(...v0);
  }
  v1();
} catch (e) {
    print("caught:", e.name, e.message);
}
//CHECK: caught: RangeError {{.*}}