Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2024-28123: Insufficient Information (NVD-CWE-noinfo)
value: Wasmi is an efficient and lightweight WebAssembly interpreter with a focus on constrained and embedded systems. In the WASMI Interpreter, an Out-of-bounds Buffer Write will arise if the host calls or resumes a Wasm function with more parameters than the default limit (128), as it will surpass the stack value. This doesn’t affect calls from Wasm to Wasm, only from host to Wasm. This vulnerability was patched in version 0.31.1.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-21T02:52Z
Repository: https://github.com/wasmi-labs/wasmi
Language: Rust
Files changed: crates/wasmi/src/engine/mod.rs
Commit date: 2023-12-01 10:35:28 +0100
Commit message: fix bug in wasmi executor

Diff: diff --git a/crates/wasmi/src/engine/mod.rs b/crates/wasmi/src/engine/mod.rs
index ec0adec..e870f01 100644
--- a/crates/wasmi/src/engine/mod.rs
+++ b/crates/wasmi/src/engine/mod.rs
@@ -645,11 +645,13 @@ impl<'engine> EngineExecutor<'engine> {
     ) -> Result<<Results as CallResults>::Results, TaggedTrap>
     where
         Results: CallResults,
     {
         self.stack.reset();
-        self.stack.values.extend(params.call_params());
+        let call_params = params.call_params();
+        self.stack.values.reserve(call_params.len())?;
+        self.stack.values.extend(call_params);
         match ctx.as_context().store.inner.resolve_func(func) {
             FuncEntity::Wasm(wasm_func) => {
                 self.stack
                     .prepare_wasm_call(wasm_func, &self.res.code_map)?;
                 self.execute_wasm_func(ctx.as_context_mut())?;
@@ -687,11 +689,13 @@ impl<'engine> EngineExecutor<'engine> {
         Results: CallResults,
     {
         self.stack
             .values
             .drop(host_func.ty(ctx.as_context()).params().len());
-        self.stack.values.extend(params.call_params());
+        let call_params = params.call_params();
+        self.stack.values.reserve(call_params.len())?;
+        self.stack.values.extend(call_params);
         assert!(
             self.stack.frames.peek().is_some(),
             "a frame must be on the call stack upon resumption"
         );
         self.execute_wasm_func(ctx.as_context_mut())?;

Vulnerable code:         self.stack.values.extend(params.call_params());
        self.stack.values.extend(params.call_params());
Fixed code:         let call_params = params.call_params();
        self.stack.values.reserve(call_params.len())?;
        self.stack.values.extend(call_params);
        let call_params = params.call_params();
        self.stack.values.reserve(call_params.len())?;
        self.stack.values.extend(call_params);
CVE-2022-1997: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-06-08T14:15Z
Repository: https://github.com/francoisjacquet/rosariosis
Language: PHP
Files changed: functions/PreparePHP_SELF.fnc.php
Commit date: 2022-06-04 13:44:21 +0200
Commit message: Fix stored XSS security issue: remove inline JS from URL in PreparePHP_SELF.fnc.php

Diff: diff --git a/functions/PreparePHP_SELF.fnc.php b/functions/PreparePHP_SELF.fnc.php
index 80da4699..f7dfe677 100644
--- a/functions/PreparePHP_SELF.fnc.php
+++ b/functions/PreparePHP_SELF.fnc.php
@@ -198,11 +198,11 @@ function URLEscape( $string )
 		'javascript:',
 	];
 
 	foreach ( $remove as $remove_string )
 	{
-		while ( strpos( $string, $remove_string ) !== false )
+		while ( stripos( $string, $remove_string ) !== false )
 		{
 			$string = str_ireplace( $remove, '', $string );
 		}
 	}
 

Vulnerable code: 		while ( strpos( $string, $remove_string ) !== false )
Fixed code: 		while ( stripos( $string, $remove_string ) !== false )
CVE-2022-2036: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.1.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-06-09T17:15Z
Repository: https://github.com/francoisjacquet/rosariosis
Language: PHP
Files changed: CHANGES.md, functions/PreparePHP_SELF.fnc.php
Commit date: 2022-06-08 22:08:35 +0200
Commit message: Fix stored XSS security issue: decode HTML entities from URL

Diff: diff --git a/CHANGES.md b/CHANGES.md
index 9ded02ad9..33f44155e 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,8 +1,12 @@
 # CHANGES
 ## RosarioSIS Student Information System
 
+Changes in 9.0.1
+----------------
+- Fix stored XSS security issue: decode HTML entities from URL in PreparePHP_SELF.fnc.php, thanks to @domiee13
+
 Changes in 9.0
 --------------
 - CSS add length to previous meals select in DailyMenus.php
 - CSS FlatSIS fix calendar menu text wrapping in stylesheet.css
 - Add Export list button in TransactionsReport.php
diff --git a/functions/PreparePHP_SELF.fnc.php b/functions/PreparePHP_SELF.fnc.php
index f7dfe677b..280b6a03c 100644
--- a/functions/PreparePHP_SELF.fnc.php
+++ b/functions/PreparePHP_SELF.fnc.php
@@ -189,11 +189,11 @@ function URLEscape( $string )
 		},
 		$string
 	);
 
 	// Fix stored XSS security issue: decode HTML entities from URL.
-	$string = html_entity_decode( (string) $string );
+	$string = html_entity_decode( (string) $string, ENT_QUOTES | ENT_HTML5 );
 
 	$remove = [
 		// Fix stored XSS security issue: remove inline JS from URL.
 		'javascript:',
 	];

Vulnerable code: 	$string = html_entity_decode( (string) $string );
Fixed code: Changes in 9.0.1
----------------
- Fix stored XSS security issue: decode HTML entities from URL in PreparePHP_SELF.fnc.php, thanks to @domiee13

	$string = html_entity_decode( (string) $string, ENT_QUOTES | ENT_HTML5 );
CVE-2018-25077: Inefficient Regular Expression Complexity (CWE-1333)
value: A vulnerability was found in melnaron mel-spintax. It has been rated as problematic. Affected by this issue is some unknown functionality of the file lib/spintax.js. The manipulation of the argument text leads to inefficient regular expression complexity. The name of the patch is 37767617846e27b87b63004e30216e8f919637d3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218456.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2023-01-18T01:15Z
Repository: https://github.com/melnaron/mel-spintax
Language: Other
Files changed: .gitignore, .npmignore, lib/spintax.js, package.json
Commit date: 2018-06-01 23:16:20 -0700
Commit message: Fix possible ReDoS attack

Diff: diff --git a/.gitignore b/.gitignore
index 4befed3..0a71bd0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 .DS_Store
 .idea
+.vscode
diff --git a/.npmignore b/.npmignore
index d70a748..92ae353 100644
--- a/.npmignore
+++ b/.npmignore
@@ -1,3 +1,4 @@
 .DS_Store
 .idea
+.vscode
 .git*
diff --git a/lib/spintax.js b/lib/spintax.js
index 49deffc..0c474c4 100644
--- a/lib/spintax.js
+++ b/lib/spintax.js
@@ -32,21 +32,21 @@
 	 *
 	 * @param text {String} Spintax formatted string
 	 * @return {Boolean}
 	 */
 	exports.isSpintax = function(text) {
-		return text.match(/{.*(\|.*)+}/) !== null;
+		return text.match(/\{[^}]*\|*[^}]*\}/) !== null;
 	};
 
 	/**
 	 * Find and return array of first Spintax occurence or null
 	 *
 	 * @param text {String} Spintax formatted string
 	 * @return {null|Array}
 	 */
 	exports.findSpintax = function(text) {
-		return text.match(/{([^{}]+?)}/);
+		return text.match(/\{([^{}]+?)\}/);
 	};
 
 	/**
 	 * Unspin Spintax text
 	 *
@@ -150,9 +150,9 @@
 	exports.validate = function(text) {
 		// Unspin text
 		text = exports.unspin(text);
 
 		// Check text for remaining Spintax format sequences: { then | or | then }
-		return text.match(/({[^}]*\|)|(\|[^{]*})/) === null;
+		return text.match(/(\{[^}]*\|)|(\|[^{]*\})/) === null;
 	};
 
 })(typeof exports === 'undefined' ? this['spintax'] = {} : exports);
diff --git a/package.json b/package.json
index 3fa0213..50651f8 100644
--- a/package.json
+++ b/package.json
@@ -1,8 +1,8 @@
 {
   "name": "mel-spintax",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Parse Spintax formatted text (Nested Spintax supported)",
   "main": "index.js",
   "directories": {
     "lib": "lib",
     "test": "test"

Vulnerable code: 		return text.match(/{.*(\|.*)+}/) !== null;
		return text.match(/{([^{}]+?)}/);
		return text.match(/({[^}]*\|)|(\|[^{]*})/) === null;
  "version": "1.0.2",
Fixed code: .vscode
.vscode
		return text.match(/\{[^}]*\|*[^}]*\}/) !== null;
		return text.match(/\{([^{}]+?)\}/);
		return text.match(/(\{[^}]*\|)|(\|[^{]*\})/) === null;
  "version": "1.0.3",
CVE-2020-19316: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2021-12-20T20:15Z
Repository: https://github.com/laravel/framework
Language: PHP
Files changed: src/Illuminate/Filesystem/Filesystem.php
Commit date: 2019-05-14 10:58:33 -0500
Commit message: use escapeshellarg on windows symlink

Diff: diff --git a/src/Illuminate/Filesystem/Filesystem.php b/src/Illuminate/Filesystem/Filesystem.php
index d9e3cf77e..1f99029f7 100644
--- a/src/Illuminate/Filesystem/Filesystem.php
+++ b/src/Illuminate/Filesystem/Filesystem.php
@@ -252,11 +252,11 @@ public function link($target, $link)
             return symlink($target, $link);
         }
 
         $mode = $this->isDirectory($target) ? 'J' : 'H';
 
-        exec("mklink /{$mode} \"{$link}\" \"{$target}\"");
+        exec("mklink /{$mode} ".escapeshellarg($link)." ".escapeshellarg($target));
     }
 
     /**
      * Extract the file name from a file path.
      *

Vulnerable code:         exec("mklink /{$mode} \"{$link}\" \"{$target}\"");
Fixed code:         exec("mklink /{$mode} ".escapeshellarg($link)." ".escapeshellarg($target));
CVE-2014-9625: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: The GetUpdateFile function in misc/update.c in the Updater in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation from a 64-bit integer to a 32-bit integer, which allows remote attackers to conduct buffer overflow attacks and execute arbitrary code via a crafted update status file, aka an "integer truncation" vulnerability.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 7.8
Published: 2020-01-24T22:15Z
Repository: https://github.com/videolan/vlc
Language: C
Files changed: src/misc/update.c
Commit date: 2014-12-10 19:48:06 +0100
Commit message: misc: update: fix buffer overflow in updater

On 32 bit builds, parsing of update status files with a size of
4294967295 or more lead to an integer truncation in a call to malloc
and a subsequent buffer overflow. This happened prior to checking the
files' signature. The commit fixes this by disallowing overly large
status files (above 65k in practice)

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>

Diff: diff --git a/src/misc/update.c b/src/misc/update.c
index b00eb27bbf..e1257b7d82 100644
--- a/src/misc/update.c
+++ b/src/misc/update.c
@@ -191,10 +191,17 @@ static bool GetUpdateFile( update_t *p_update )
                  UPDATE_VLC_STATUS_URL );
         goto error;
     }
 
     const int64_t i_read = stream_Size( p_stream );
+
+    if( i_read < 0 || i_read >= UINT16_MAX)
+    {
+        msg_Err(p_update->p_libvlc, "Status file too large");
+        goto error;
+    }
+
     psz_update_data = malloc( i_read + 1 ); /* terminating '\0' */
     if( !psz_update_data )
         goto error;
 
     if( stream_Read( p_stream, psz_update_data, i_read ) != i_read )

Fixed code: 
    if( i_read < 0 || i_read >= UINT16_MAX)
    {
        msg_Err(p_update->p_libvlc, "Status file too large");
        goto error;
    }
CVE-2014-9626: Integer Underflow (Wrap or Wraparound) (CWE-191)
value: Integer underflow in the MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a box size less than 7.
CWE description: The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CVSS v3 base score: 7.8
Published: 2020-01-24T22:15Z
Repository: https://github.com/videolan/vlc
Language: C
Files changed: modules/demux/mp4/libmp4.c
Commit date: 2014-12-08 13:11:36 +0100
Commit message: demux: mp4: fix buffer overflow in parsing of string boxes.

We ensure that pbox->i_size is never smaller than 8 to avoid an
integer underflow in the third argument of the subsequent call to
memcpy. We also make sure no truncation occurs when passing values
derived from the 64 bit integer p_box->i_size to arguments of malloc
and memcpy that may be 32 bit integers on 32 bit platforms.

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>

Diff: diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c
index 9429ff3588..45b54c2b16 100644
--- a/modules/demux/mp4/libmp4.c
+++ b/modules/demux/mp4/libmp4.c
@@ -2856,10 +2856,13 @@ static int MP4_ReadBox_drms( stream_t *p_stream, MP4_Box_t *p_box )
 
 static int MP4_ReadBox_String( stream_t *p_stream, MP4_Box_t *p_box )
 {
     MP4_READBOX_ENTER( MP4_Box_data_string_t );
 
+    if( p_box->i_size < 8 || p_box->i_size > SIZE_MAX )
+        MP4_READBOX_EXIT( 0 );
+
     p_box->data.p_string->psz_text = malloc( p_box->i_size + 1 - 8 ); /* +\0, -name, -size */
     if( p_box->data.p_string->psz_text == NULL )
         MP4_READBOX_EXIT( 0 );
 
     memcpy( p_box->data.p_string->psz_text, p_peek, p_box->i_size - 8 );

Fixed code:     if( p_box->i_size < 8 || p_box->i_size > SIZE_MAX )
        MP4_READBOX_EXIT( 0 );
CVE-2014-9627: Incorrect Type Conversion or Cast (CWE-704)
value: The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation from a 64-bit integer to a 32-bit integer, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large box size.
CWE description: The product does not correctly convert an object, resource, or structure from one type to a different type.
CVSS v3 base score: 7.8
Published: 2020-01-24T22:15Z
Repository: https://github.com/videolan/vlc
Language: C
Files changed: modules/demux/mp4/libmp4.c
Commit date: 2014-12-08 13:11:36 +0100
Commit message: demux: mp4: fix buffer overflow in parsing of string boxes.

We ensure that pbox->i_size is never smaller than 8 to avoid an
integer underflow in the third argument of the subsequent call to
memcpy. We also make sure no truncation occurs when passing values
derived from the 64 bit integer p_box->i_size to arguments of malloc
and memcpy that may be 32 bit integers on 32 bit platforms.

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>

Diff: diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c
index 9429ff3588..45b54c2b16 100644
--- a/modules/demux/mp4/libmp4.c
+++ b/modules/demux/mp4/libmp4.c
@@ -2856,10 +2856,13 @@ static int MP4_ReadBox_drms( stream_t *p_stream, MP4_Box_t *p_box )
 
 static int MP4_ReadBox_String( stream_t *p_stream, MP4_Box_t *p_box )
 {
     MP4_READBOX_ENTER( MP4_Box_data_string_t );
 
+    if( p_box->i_size < 8 || p_box->i_size > SIZE_MAX )
+        MP4_READBOX_EXIT( 0 );
+
     p_box->data.p_string->psz_text = malloc( p_box->i_size + 1 - 8 ); /* +\0, -name, -size */
     if( p_box->data.p_string->psz_text == NULL )
         MP4_READBOX_EXIT( 0 );
 
     memcpy( p_box->data.p_string->psz_text, p_peek, p_box->i_size - 8 );

Fixed code:     if( p_box->i_size < 8 || p_box->i_size > SIZE_MAX )
        MP4_READBOX_EXIT( 0 );
CVE-2014-9628: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote attackers to trigger an unintended zero-size malloc and conduct buffer overflow attacks, and consequently execute arbitrary code, via a box size of 7.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 7.8
Published: 2020-01-24T22:15Z
Repository: https://github.com/videolan/vlc
Language: C
Files changed: modules/demux/mp4/libmp4.c
Commit date: 2014-12-08 13:11:36 +0100
Commit message: demux: mp4: fix buffer overflow in parsing of string boxes.

We ensure that pbox->i_size is never smaller than 8 to avoid an
integer underflow in the third argument of the subsequent call to
memcpy. We also make sure no truncation occurs when passing values
derived from the 64 bit integer p_box->i_size to arguments of malloc
and memcpy that may be 32 bit integers on 32 bit platforms.

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>

Diff: diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c
index 9429ff3588..45b54c2b16 100644
--- a/modules/demux/mp4/libmp4.c
+++ b/modules/demux/mp4/libmp4.c
@@ -2856,10 +2856,13 @@ static int MP4_ReadBox_drms( stream_t *p_stream, MP4_Box_t *p_box )
 
 static int MP4_ReadBox_String( stream_t *p_stream, MP4_Box_t *p_box )
 {
     MP4_READBOX_ENTER( MP4_Box_data_string_t );
 
+    if( p_box->i_size < 8 || p_box->i_size > SIZE_MAX )
+        MP4_READBOX_EXIT( 0 );
+
     p_box->data.p_string->psz_text = malloc( p_box->i_size + 1 - 8 ); /* +\0, -name, -size */
     if( p_box->data.p_string->psz_text == NULL )
         MP4_READBOX_EXIT( 0 );
 
     memcpy( p_box->data.p_string->psz_text, p_peek, p_box->i_size - 8 );

Fixed code:     if( p_box->i_size < 8 || p_box->i_size > SIZE_MAX )
        MP4_READBOX_EXIT( 0 );
CVE-2014-9629: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: Integer overflow in the Encode function in modules/codec/schroedinger.c in VideoLAN VLC media player before 2.1.6 and 2.2.x before 2.2.1 allows remote attackers to conduct buffer overflow attacks and execute arbitrary code via a crafted length value.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 7.8
Published: 2020-01-24T22:15Z
Repository: https://github.com/videolan/vlc
Language: C
Files changed: modules/codec/schroedinger.c
Commit date: 2014-12-06 18:50:18 +0100
Commit message: codec: schroedinger: fix potential buffer overflow.

The variable len is a raw 32 bit value read using GetDWBE. If this
value is larger than UINT32_MAX - sizeof(eos), this will cause an
integer overflow in the subsequent call to malloc, and finally a
buffer overflow when calling memcpy. We fix this by checking len
accordingly.

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>

Diff: diff --git a/modules/codec/schroedinger.c b/modules/codec/schroedinger.c
index f48aa2ba48..977afca0f2 100644
--- a/modules/codec/schroedinger.c
+++ b/modules/codec/schroedinger.c
@@ -1546,10 +1546,14 @@ static block_t *Encode( encoder_t *p_enc, picture_t *p_pic )
                      * sequence header for muxers such as ogg */
                     /* The OggDirac spec advises that a Dirac EOS DataUnit
                      * is appended to the sequence header to allow guard
                      * against poor streaming servers */
                     /* XXX, should this be done using the packetizer ? */
+
+                    if( len > UINT32_MAX - sizeof( eos ) )
+                        return NULL;
+
                     p_enc->fmt_out.p_extra = malloc( len + sizeof( eos ) );
                     if( !p_enc->fmt_out.p_extra )
                         return NULL;
                     memcpy( p_enc->fmt_out.p_extra, p_block->p_buffer, len );
                     memcpy( (uint8_t*)p_enc->fmt_out.p_extra + len, eos, sizeof( eos ) );

Fixed code: 
                    if( len > UINT32_MAX - sizeof( eos ) )
                        return NULL;
CVE-2014-9630: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The rtp_packetize_xiph_config function in modules/stream_out/rtpfmt.c in VideoLAN VLC media player before 2.1.6 uses a stack-allocation approach with a size determined by arbitrary input data, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted length value.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2020-01-24T22:15Z
Repository: https://github.com/videolan/vlc
Language: C
Files changed: modules/stream_out/rtpfmt.c
Commit date: 2014-12-10 21:32:27 +0100
Commit message: stream_out: rtp: don't use VLA for user controlled data

It should fix a possible invalid memory access

When streaming ogg-files via rtp, an ogg-file can trigger an invalid
write access using an overly long 'configuration' string.

The original code attemps to allocate space to hold the string on the stack
and hence, cannot verify if allocation succeeds. Instead, we now allocate the
buffer on the heap and return if allocation fails.

In detail, rtp_packetize_xiph_config allocates a buffer on the stack at (1) where
the size depends on the local variable 'len'. The variable 'len' is
calculated at (0) to be the length of a string contained in a specially
crafted Ogg Vorbis file, and therefore, it is attacker-controlled.

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>

Diff: diff --git a/modules/stream_out/rtpfmt.c b/modules/stream_out/rtpfmt.c
index 17f347878f..cf8635bdd9 100644
--- a/modules/stream_out/rtpfmt.c
+++ b/modules/stream_out/rtpfmt.c
@@ -557,20 +557,25 @@ int rtp_packetize_xiph_config( sout_stream_id_sys_t *id, const char *fmtp,
     assert(start != NULL);
     start += sizeof("configuration=") - 1;
     char *end = strchr(start, ';');
     assert(end != NULL);
     size_t len = end - start;
-    char b64[len + 1];
+
+    char *b64 = malloc(len + 1);
+    if(!b64)
+        return VLC_EGENERIC;
+
     memcpy(b64, start, len);
     b64[len] = '\0';
 
     int     i_max   = rtp_mtu (id) - 6; /* payload max in one packet */
 
     uint8_t *p_orig, *p_data;
     int i_data;
 
     i_data = vlc_b64_decode_binary(&p_orig, b64);
+    free(b64);
     if (i_data <= 9)
     {
         free(p_orig);
         return VLC_EGENERIC;
     }

Vulnerable code:     char b64[len + 1];
Fixed code: 
    char *b64 = malloc(len + 1);
    if(!b64)
        return VLC_EGENERIC;

    free(b64);
CVE-2013-7455: Other (NVD-CWE-Other)
value: Double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers to execute arbitrary code via a malformed ICC profile that triggers an error in the default intent handler.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 9.8
Published: 2016-05-07T10:59Z
Repository: https://github.com/mm2/Little-CMS
Language: Other
Files changed: ChangeLog, src/cmscnvrt.c
Commit date: 2013-07-10 10:04:36 +0200
Commit message: Fix a double free on error recovering

Diff: diff --git a/ChangeLog b/ChangeLog
index 6ef1303..641549a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -123,5 +123,8 @@ Transform2Devicelink now keeps white point when guessing deviceclass is enabled
 Added some checks for non-happy path, mostly failing mallocs
 
 -----------------------
 2.5 Maintenance release
 -----------------------
+
+Fixed a double free in recovering from a previous error in default intent handler.
+
diff --git a/src/cmscnvrt.c b/src/cmscnvrt.c
index 908f787..4696cc8 100644
--- a/src/cmscnvrt.c
+++ b/src/cmscnvrt.c
@@ -569,21 +569,23 @@ cmsPipeline* DefaultICCintents(cmsContext       ContextID,
         }
 
         // Concatenate to the output LUT
         if (!cmsPipelineCat(Result, Lut))
             goto Error;
+
         cmsPipelineFree(Lut);
+        Lut = NULL;
 
         // Update current space
         CurrentColorSpace = ColorSpaceOut;
     }
 
     return Result;
 
 Error:
 
-    cmsPipelineFree(Lut);
+    if (Lut != NULL) cmsPipelineFree(Lut);
     if (Result != NULL) cmsPipelineFree(Result);
     return NULL;
 
     cmsUNUSED_PARAMETER(dwFlags);
 }

Vulnerable code:     cmsPipelineFree(Lut);
Fixed code: 
Fixed a double free in recovering from a previous error in default intent handler.


        Lut = NULL;
    if (Lut != NULL) cmsPipelineFree(Lut);
CVE-2016-10165: Out-of-bounds Read (CWE-125)
value: The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.1
Published: 2017-02-03T19:59Z
Repository: https://github.com/mm2/Little-CMS
Language: C
Files changed: src/cmstypes.c
Commit date: 2016-08-15 23:31:39 +0200
Commit message: Added an extra check to MLU bounds

Thanks to Ibrahim el-sayed for spotting the bug

Diff: diff --git a/src/cmstypes.c b/src/cmstypes.c
index cb61860..c7328b9 100644
--- a/src/cmstypes.c
+++ b/src/cmstypes.c
@@ -1458,10 +1458,11 @@ void *Type_MLU_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER* io, cmsU
         if (!_cmsReadUInt32Number(io, &Len)) goto Error;
         if (!_cmsReadUInt32Number(io, &Offset)) goto Error;
 
         // Check for overflow
         if (Offset < (SizeOfHeader + 8)) goto Error;
+        if ((Offset + Len) > SizeOfTag + 8) goto Error;
 
         // True begin of the string
         BeginOfThisString = Offset - SizeOfHeader - 8;
 
         // Ajust to wchar_t elements

Fixed code:         if ((Offset + Len) > SizeOfTag + 8) goto Error;
CVE-2017-7412: Insufficient Information (NVD-CWE-noinfo)
value: NixOS 17.03 before 17.03.887 has a world-writable Docker socket, which allows local users to gain privileges by executing docker commands.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.8
Published: 2017-04-04T00:59Z
Repository: https://github.com/NixOS/nixpkgs
Language: Other
Files changed: nixos/modules/virtualisation/docker.nix
Commit date: 2017-04-03 09:05:37 -0400
Commit message: docker: fix socket permissions

Docker socket is world writable. This means any user on the system is
able to invoke docker command. (Which is equal to having a root access
to the machine.)

This commit makes socket group-writable and owned by docker group.

Inspired by
https://github.com/docker/docker/blob/master/contrib/init/systemd/docker.socket

Diff: diff --git a/nixos/modules/virtualisation/docker.nix b/nixos/modules/virtualisation/docker.nix
index 4b30a38f83..f1101d7ea6 100644
--- a/nixos/modules/virtualisation/docker.nix
+++ b/nixos/modules/virtualisation/docker.nix
@@ -124,11 +124,21 @@ in
           ];
         } // proxy_env;
 
         path = [ pkgs.kmod ] ++ (optional (cfg.storageDriver == "zfs") pkgs.zfs);
       };
-      systemd.sockets.docker.socketConfig.ListenStream = cfg.listenOptions;
+
+      systemd.sockets.docker = {
+        description = "Docker Socket for the API";
+        wantedBy = [ "sockets.target" ];
+        socketConfig = {
+          ListenStream = cfg.listenOptions;
+          SocketMode = "0660";
+          SocketUser = "root";
+          SocketGroup = "docker";
+        };
+      };
     }
   ]);
 
   imports = [
     (mkRemovedOptionModule ["virtualisation" "docker" "socketActivation"] "This option was removed in favor of starting docker at boot")

Vulnerable code:       systemd.sockets.docker.socketConfig.ListenStream = cfg.listenOptions;
Fixed code: 
      systemd.sockets.docker = {
        description = "Docker Socket for the API";
        wantedBy = [ "sockets.target" ];
        socketConfig = {
          ListenStream = cfg.listenOptions;
          SocketMode = "0660";
          SocketUser = "root";
          SocketGroup = "docker";
        };
      };
CVE-2015-2141: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: The InvertibleRWFunction::CalculateInverse function in rw.cpp in libcrypt++ 5.6.2 does not properly blind private key operations for the Rabin-Williams digital signature algorithm, which allows remote attackers to obtain private keys via a timing attack.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Published: 2015-07-01T14:59Z
Repository: https://github.com/weidai11/cryptopp
Language: C++
Files changed: rw.cpp
Commit date: 2015-06-27 17:56:01 -0400
Commit message: Fix for CVE-2015-2141. Thanks to Evgeny Sidorov for reporting. Squaring to satisfy Jacobi requirements suggested by JPM.

Diff: diff --git a/rw.cpp b/rw.cpp
index cdd9f2d..0b9318b 100644
--- a/rw.cpp
+++ b/rw.cpp
@@ -124,14 +124,20 @@ void InvertibleRWFunction::DEREncode(BufferedTransformation &bt) const
 Integer InvertibleRWFunction::CalculateInverse(RandomNumberGenerator &rng, const Integer &x) const
 {
 	DoQuickSanityCheck();
 	ModularArithmetic modn(m_n);
 	Integer r, rInv;
-	do {	// do this in a loop for people using small numbers for testing
+
+	// do this in a loop for people using small numbers for testing
+	do {
 		r.Randomize(rng, Integer::One(), m_n - Integer::One());
+		// Fix for CVE-2015-2141. Thanks to Evgeny Sidorov for reporting.
+		// Squaring to satisfy Jacobi requirements suggested by JPM.
+		r = modn.Square(r);
 		rInv = modn.MultiplicativeInverse(r);
 	} while (rInv.IsZero());
+
 	Integer re = modn.Square(r);
 	re = modn.Multiply(re, x);			// blind
 
 	Integer cp=re%m_p, cq=re%m_q;
 	if (Jacobi(cp, m_p) * Jacobi(cq, m_q) != 1)

Vulnerable code: 	do {	// do this in a loop for people using small numbers for testing
Fixed code: 
	// do this in a loop for people using small numbers for testing
	do {
		// Fix for CVE-2015-2141. Thanks to Evgeny Sidorov for reporting.
		// Squaring to satisfy Jacobi requirements suggested by JPM.
		r = modn.Square(r);
CVE-2014-3158: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Integer overflow in the getword function in options.c in pppd in Paul's PPP Package (ppp) before 2.4.7 allows attackers to "access privileged options" via a long word in an options file, which triggers a heap-based buffer overflow that "[corrupts] security-relevant variables."
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2014-11-15T21:59Z
Repository: https://github.com/paulusmack/ppp
Language: C
Files changed: pppd/options.c
Commit date: 2014-08-01 21:36:48 +1000
Commit message: pppd: Eliminate potential integer overflow in option parsing

When we are reading in a word from an options file, we maintain a count
of the length we have seen so far in 'len', which is an int.  When len
exceeds MAXWORDLEN - 1 (i.e. 1023) we cease storing characters in the
buffer but we continue to increment len.  Since len is an int, it will
wrap around to -2147483648 after it reaches 2147483647.  At that point
our test of (len < MAXWORDLEN-1) will succeed and we will start writing
characters to memory again.

This may enable an attacker to overwrite the heap and thereby corrupt
security-relevant variables.  For this reason it has been assigned a
CVE identifier, CVE-2014-3158.

This fixes the bug by ceasing to increment len once it reaches MAXWORDLEN.

Reported-by: Lee Campbell <leecam@google.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>

Diff: diff --git a/pppd/options.c b/pppd/options.c
index 45fa742..e9042d1 100644
--- a/pppd/options.c
+++ b/pppd/options.c
@@ -1287,13 +1287,14 @@ getword(f, word, newlinep, filename)
 	    }
 
 	    /*
 	     * Store the resulting character for the escape sequence.
 	     */
-	    if (len < MAXWORDLEN-1)
+	    if (len < MAXWORDLEN) {
 		word[len] = value;
-	    ++len;
+		++len;
+	    }
 
 	    if (!got)
 		c = getc(f);
 	    continue;
 	}
@@ -1327,13 +1328,14 @@ getword(f, word, newlinep, filename)
 	}
 
 	/*
 	 * An ordinary character: store it in the word and get another.
 	 */
-	if (len < MAXWORDLEN-1)
+	if (len < MAXWORDLEN) {
 	    word[len] = c;
-	++len;
+	    ++len;
+	}
 
 	c = getc(f);
     }
 
     /*

Vulnerable code: 	    if (len < MAXWORDLEN-1)
	    ++len;
	if (len < MAXWORDLEN-1)
	++len;
Fixed code: 	    if (len < MAXWORDLEN) {
		++len;
	    }
	if (len < MAXWORDLEN) {
	    ++len;
	}
CVE-2020-8597: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 9.8
Published: 2020-02-03T23:15Z
Repository: https://github.com/paulusmack/ppp
Language: C
Files changed: pppd/eap.c
Commit date: 2020-02-03 15:53:28 +1100
Commit message: pppd: Fix bounds check in EAP code

Given that we have just checked vallen < len, it can never be the case
that vallen >= len + sizeof(rhostname).  This fixes the check so we
actually avoid overflowing the rhostname array.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>

Diff: diff --git a/pppd/eap.c b/pppd/eap.c
index 94407f56..1b93db01 100644
--- a/pppd/eap.c
+++ b/pppd/eap.c
@@ -1418,11 +1418,11 @@ int len;
 			eap_send_nak(esp, id, EAPT_SRP);
 			break;
 		}
 
 		/* Not so likely to happen. */
-		if (vallen >= len + sizeof (rhostname)) {
+		if (len - vallen >= sizeof (rhostname)) {
 			dbglog("EAP: trimming really long peer name down");
 			BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1);
 			rhostname[sizeof (rhostname) - 1] = '\0';
 		} else {
 			BCOPY(inp + vallen, rhostname, len - vallen);
@@ -1844,11 +1844,11 @@ int len;
 			eap_figure_next_state(esp, 1);
 			break;
 		}
 
 		/* Not so likely to happen. */
-		if (vallen >= len + sizeof (rhostname)) {
+		if (len - vallen >= sizeof (rhostname)) {
 			dbglog("EAP: trimming really long peer name down");
 			BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1);
 			rhostname[sizeof (rhostname) - 1] = '\0';
 		} else {
 			BCOPY(inp + vallen, rhostname, len - vallen);

Vulnerable code: 		if (vallen >= len + sizeof (rhostname)) {
		if (vallen >= len + sizeof (rhostname)) {
Fixed code: 		if (len - vallen >= sizeof (rhostname)) {
		if (len - vallen >= sizeof (rhostname)) {
CVE-2024-22779: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Directory Traversal vulnerability in Kihron ServerRPExposer v.1.0.2 and before allows a remote attacker to execute arbitrary code via the loadServerPack in ServerResourcePackProviderMixin.java.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.8
Published: 2024-02-02T02:15Z
Repository: https://github.com/Kihron/ServerRPExposer
Language: Other
Files changed: gradle.properties, src/main/java/com/kihron/serverrpexposer/mixins/ServerResourcePackProviderMixin.java
Commit date: 2024-01-06 21:35:04 -0500
Commit message: - bumped version to 1.0.3
- fixed vulnerability allowing servers to add files into arbitrary folders (unlikely but possible)

Diff: diff --git a/gradle.properties b/gradle.properties
index 5877301..6388f88 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -4,8 +4,8 @@ org.gradle.jvmargs=-Xmx1G
 # check these on https://modmuss50.me/fabric.html
 minecraft_version=1.20.1
 yarn_mappings=1.20.1+build.9
 loader_version=0.14.14
 # Mod Properties
-mod_version=1.0.2
+mod_version=1.0.3
 maven_group=com.kihron
 archives_base_name=ServerRPExposer
\ No newline at end of file
diff --git a/src/main/java/com/kihron/serverrpexposer/mixins/ServerResourcePackProviderMixin.java b/src/main/java/com/kihron/serverrpexposer/mixins/ServerResourcePackProviderMixin.java
index 57577d3..4386801 100644
--- a/src/main/java/com/kihron/serverrpexposer/mixins/ServerResourcePackProviderMixin.java
+++ b/src/main/java/com/kihron/serverrpexposer/mixins/ServerResourcePackProviderMixin.java
@@ -40,10 +40,11 @@ public class ServerResourcePackProviderMixin {
 
                 Enumeration<? extends ZipEntry> entries = zipFile.entries();
                 while (entries.hasMoreElements()) {
                     ZipEntry entry = entries.nextElement();
                     File entryDestination = path.resolve(entry.getName()).toFile();
+                    if (!entryDestination.getCanonicalPath().startsWith(path.toRealPath() + "/")) continue;
                     if (entry.isDirectory()) {
                         entryDestination.mkdirs();
                     } else {
                         entryDestination.getParentFile().mkdirs();
                         InputStream in = zipFile.getInputStream(entry);

Vulnerable code: mod_version=1.0.2
Fixed code: mod_version=1.0.3
                    if (!entryDestination.getCanonicalPath().startsWith(path.toRealPath() + "/")) continue;
CVE-2024-32648: Insufficient Information (NVD-CWE-noinfo)
value: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Prior to version 0.3.0, default functions don't respect nonreentrancy keys and the lock isn't emitted. No vulnerable production contracts were found. Additionally, using a lock on a `default` function is a very sparsely used pattern. As such, the impact is low. Version 0.3.0 contains a patch for the issue.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-25T18:15Z
Repository: https://github.com/vyperlang/vyper
Language: Unknown
Commit date: 2021-10-02 22:58:47 -0700
Commit message: Merge pull request #2447 from charles-cooper/abi_refactor

rewrite internal calling convention
CVE-2024-34341: Insufficient Information (NVD-CWE-noinfo)
value: Trix is a rich text editor. The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker to embed malicious scripts which are executed within the context of the application. Users should upgrade to Trix editor version 2.1.1 or later, which incorporates proper sanitization of input from copied content.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-07T16:15Z
Repository: https://github.com/basecamp/trix
Language: Unknown
Commit date: 2024-05-01 15:22:41 +0100
Commit message: Merge pull request #1149 from basecamp/paste-html-sanitize

Sanitize HTML content in data-trix-* attributes
CVE-2024-34341: Insufficient Information (NVD-CWE-noinfo)
value: Trix is a rich text editor. The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker to embed malicious scripts which are executed within the context of the application. Users should upgrade to Trix editor version 2.1.1 or later, which incorporates proper sanitization of input from copied content.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-07T16:15Z
Repository: https://github.com/basecamp/trix
Language: Unknown
Commit date: 2024-04-26 16:10:14 +0100
Commit message: Merge pull request #1147 from basecamp/sanitize-noscript

Sanitize noscript to prevent copy and paste XSS
CVE-2017-8920: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: irc.cgi in CGI:IRC before 0.5.12 reflects user-supplied input from the R parameter without proper output encoding, aka XSS.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-06-06T16:29Z
Repository: https://github.com/dgl/cgiirc
Language: Other
Files changed: irc.cgi
Commit date: 2017-05-09 22:34:22 +0100
Commit message: Validate R parameter in irc.cgi

This matches the check done in nph-irc.cgi.

Diff: diff --git a/irc.cgi b/irc.cgi
index aba37ca..75844a3 100755
--- a/irc.cgi
+++ b/irc.cgi
@@ -71,10 +71,11 @@ $interface =~ /^([a-z0-9]+)/;
 $interface = $1;
 require($interface . '.pm');
 
 if(ref $cgi && defined $cgi->{item}) {
    print "\r\n"; # send final header
+   error('Communication socket name is invalid') if $cgi->{R} =~ /[^A-Za-z0-9]/;
    my $name = $cgi->{item};
    exit unless $interface->exists($name);
    $interface->$name($cgi, $config, 0);
 }elsif(ref $cgi && defined $cgi->{Nickname}) {
    print "\r\n"; # send final header

Fixed code:    error('Communication socket name is invalid') if $cgi->{R} =~ /[^A-Za-z0-9]/;
CVE-2020-23489: Missing Authorization (CWE-862)
value: The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, which leads to certain privilege checks not being in place, and therefore a user can escalate privileges to admin.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 8.8
Published: 2020-11-16T18:15Z
Repository: https://github.com/WWBN/AVideo
Language: PHP
Files changed: objects/import.json.php
Commit date: 2020-05-22 09:06:06 -0300
Commit message: https://github.com/WWBN/AVideo/issues/3117
If fileURI is not a MP4 file return false
Diff: diff --git a/objects/import.json.php b/objects/import.json.php
index 6c91b3217..3baadb29f 100644
--- a/objects/import.json.php
+++ b/objects/import.json.php
@@ -7,10 +7,14 @@ header('Content-Type: application/json');
 
 if (!User::canUpload() || !empty($advancedCustom->doNotShowImportMP4Button)) {
     return false;
 }
 
+if(!preg_match("/.*\\.mp4$/i", $_POST['fileURI'])){
+    return false;
+}
+
 $obj = new stdClass();
 
 $obj->error = true;
 
 $obj->fileURI = pathinfo($_POST['fileURI']);

Fixed code: if(!preg_match("/.*\\.mp4$/i", $_POST['fileURI'])){
    return false;
}
CVE-2020-23490: Insufficient Information (NVD-CWE-noinfo)
value: There was a local file disclosure vulnerability in AVideo < 8.9 via the proxy streaming. An unauthenticated attacker can exploit this issue to read an arbitrary file on the server. Which could leak database credentials or other sensitive information such as /etc/passwd file.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2020-11-16T18:15Z
Repository: https://github.com/WWBN/AVideo
Language: PHP
Files changed: plugin/LiveLinks/proxy.php
Commit date: 2020-05-22 08:55:45 -0300
Commit message: https://github.com/WWBN/AVideo/issues/3117
Make sure the livelink starts with http
Diff: diff --git a/plugin/LiveLinks/proxy.php b/plugin/LiveLinks/proxy.php
index 449551611..d2c171b05 100644
--- a/plugin/LiveLinks/proxy.php
+++ b/plugin/LiveLinks/proxy.php
@@ -10,11 +10,11 @@ try {
 
 
 /*
  * this file is to handle HTTP URLs into HTTPS
  */
-if (!filter_var($_GET['livelink'], FILTER_VALIDATE_URL) && preg_match("/^http.*/i", $_GET['livelink'])) {
+if (!filter_var($_GET['livelink'], FILTER_VALIDATE_URL) || !preg_match("/^http.*/i", $_GET['livelink'])) {
     echo "Invalid Link";
     exit;
 }
 header("Content-Type: video/vnd.mpegurl");
 header("Content-Disposition: attachment;filename=playlist.m3u");

Vulnerable code: if (!filter_var($_GET['livelink'], FILTER_VALIDATE_URL) && preg_match("/^http.*/i", $_GET['livelink'])) {
Fixed code: if (!filter_var($_GET['livelink'], FILTER_VALIDATE_URL) || !preg_match("/^http.*/i", $_GET['livelink'])) {