Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2017-16359: NULL Pointer Dereference (CWE-476)
value: In radare 2.0.1, a pointer wraparound vulnerability exists in store_versioninfo_gnu_verdef() in libr/bin/format/elf/elf.c.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2017-11-01T17:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/bin/format/elf/elf.c
Commit date: 2017-10-31 23:35:41 +0800
Commit message: Fix #8764 - huge vd_aux caused pointer wraparound

Diff: diff --git a/libr/bin/format/elf/elf.c b/libr/bin/format/elf/elf.c
index b466c312cba..ba3d1d5404f 100644
--- a/libr/bin/format/elf/elf.c
+++ b/libr/bin/format/elf/elf.c
@@ -729,11 +729,11 @@ static Sdb *store_versioninfo_gnu_verdef(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz)
 	sdb_num_set (sdb, "addr", shdr->sh_addr, 0);
 	sdb_num_set (sdb, "offset", shdr->sh_offset, 0);
 	sdb_num_set (sdb, "link", shdr->sh_link, 0);
 	sdb_set (sdb, "link_section_name", link_section_name, 0);
 
-	for (cnt = 0, i = 0; i >= 0 && cnt < shdr->sh_info && ((char *)defs + i < end); ++cnt) {
+	for (cnt = 0, i = 0; i >= 0 && cnt < shdr->sh_info && (end - (char *)defs > i); ++cnt) {
 		Sdb *sdb_verdef = sdb_new0 ();
 		char *vstart = ((char*)defs) + i;
 		char key[32] = {0};
 		Elf_(Verdef) *verdef = (Elf_(Verdef)*)vstart;
 		Elf_(Verdaux) aux = {0};
@@ -747,16 +747,16 @@ static Sdb *store_versioninfo_gnu_verdef(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz)
 		verdef->vd_cnt = READ16 (dfs, j)
 		verdef->vd_hash = READ32 (dfs, j)
 		verdef->vd_aux = READ32 (dfs, j)
 		verdef->vd_next = READ32 (dfs, j)
 		int vdaux = verdef->vd_aux;
-		if (vdaux < 1) {
+		if (vdaux < 1 || (char *)UINTPTR_MAX - vstart < vdaux) {
 			sdb_free (sdb_verdef);
 			goto out_error;
 		}
 		vstart += vdaux;
-		if (vstart > end || vstart + sizeof (Elf_(Verdaux)) > end) {
+		if (vstart > end || end - vstart < sizeof (Elf_(Verdaux))) {
 			sdb_free (sdb_verdef);
 			goto out_error;
 		}
 
 		j = 0;
@@ -779,11 +779,11 @@ static Sdb *store_versioninfo_gnu_verdef(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz)
 		for (j = 1; j < verdef->vd_cnt; ++j) {
 			int k;
 			Sdb *sdb_parent = sdb_new0 ();
 			isum += aux.vda_next;
 			vstart += aux.vda_next;
-			if (vstart > end || vstart + sizeof(Elf_(Verdaux)) > end) {
+			if (vstart > end || end - vstart < sizeof (Elf_(Verdaux))) {
 				sdb_free (sdb_verdef);
 				sdb_free (sdb_parent);
 				goto out_error;
 			}
 			k = 0;

Vulnerable code: 	for (cnt = 0, i = 0; i >= 0 && cnt < shdr->sh_info && ((char *)defs + i < end); ++cnt) {
		if (vdaux < 1) {
		if (vstart > end || vstart + sizeof (Elf_(Verdaux)) > end) {
			if (vstart > end || vstart + sizeof(Elf_(Verdaux)) > end) {
Fixed code: 	for (cnt = 0, i = 0; i >= 0 && cnt < shdr->sh_info && (end - (char *)defs > i); ++cnt) {
		if (vdaux < 1 || (char *)UINTPTR_MAX - vstart < vdaux) {
		if (vstart > end || end - vstart < sizeof (Elf_(Verdaux))) {
			if (vstart > end || end - vstart < sizeof (Elf_(Verdaux))) {
CVE-2017-6194: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The relocs function in libr/bin/p/bin_bflt.c in radare2 1.2.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2017-04-03T05:59Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/bin/p/bin_bflt.c
Commit date: 2017-02-21 21:55:12 +0100
Commit message: Fix #6829 oob write because of using wrong struct

Diff: diff --git a/libr/bin/p/bin_bflt.c b/libr/bin/p/bin_bflt.c
index b539b2b4133..833bbba8652 100644
--- a/libr/bin/p/bin_bflt.c
+++ b/libr/bin/p/bin_bflt.c
@@ -10,10 +10,13 @@
 static void *load_bytes(RBinFile *arch, const ut8 *buf, ut64 sz, ut64 loaddr, Sdb *sdb) {
 	if (!buf || !sz || sz == UT64_MAX) {
 		return NULL;
 	}
 	RBuffer *tbuf = r_buf_new ();
+	if (!tbuf) {
+		return NULL;
+	}
 	r_buf_set_bytes (tbuf, buf, sz);
 	struct r_bin_bflt_obj *res = r_bin_bflt_new_buf (tbuf);
 	r_buf_free (tbuf);
 	return res ? res : NULL;
 }
@@ -45,11 +48,12 @@ static void __patch_reloc(RBuffer *buf, ut32 addr_to_patch, ut32 data_offset) {
 	ut8 val[4] = { 0 };
 	r_write_le32 (val, data_offset);
 	r_buf_write_at (buf, addr_to_patch, (void *)val, sizeof (val));
 }
 
-static int search_old_relocation(struct reloc_struct_t *reloc_table, ut32 addr_to_patch, int n_reloc) {
+static int search_old_relocation (struct reloc_struct_t *reloc_table,
+				  ut32 addr_to_patch, int n_reloc) {
 	int i;
 	for (i = 0; i < n_reloc; i++) {
 		if (addr_to_patch == reloc_table[i].data_offset) {
 			return i;
 		}
@@ -161,11 +165,12 @@ static RList *relocs(RBinFile *arch) {
 		if (n_got) {
 			amount = n_got *  sizeof (ut32);
 			if (amount < n_got || amount > UT32_MAX) {
 				goto out_error;
 			}
-			struct reloc_struct_t *got_table = calloc (1, n_got * sizeof (ut32));
+			struct reloc_struct_t *got_table = calloc (
+				1, n_got * sizeof (struct reloc_struct_t));
 			if (got_table) {
 				ut32 offset = 0;
 				for (i = 0; i < n_got ; offset += 4, i++) {
 					ut32 got_entry;
 					if (obj->hdr->data_start + offset + 4 > obj->size ||

Vulnerable code: static int search_old_relocation(struct reloc_struct_t *reloc_table, ut32 addr_to_patch, int n_reloc) {
			struct reloc_struct_t *got_table = calloc (1, n_got * sizeof (ut32));
Fixed code: 	if (!tbuf) {
		return NULL;
	}
static int search_old_relocation (struct reloc_struct_t *reloc_table,
				  ut32 addr_to_patch, int n_reloc) {
			struct reloc_struct_t *got_table = calloc (
				1, n_got * sizeof (struct reloc_struct_t));
CVE-2017-6319: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted DEX file.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2017-03-02T01:59Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/bin/p/bin_dex.c
Commit date: 2017-02-23 19:17:28 +0100
Commit message: Fix #6836 - oob write in dex

Diff: diff --git a/libr/bin/p/bin_dex.c b/libr/bin/p/bin_dex.c
index 601b28a5d71..9a91dae9c69 100644
--- a/libr/bin/p/bin_dex.c
+++ b/libr/bin/p/bin_dex.c
@@ -307,12 +307,12 @@ static void dex_parse_debug_item(RBinFile *binfile, RBinDexObj *bin,
 	ut64 param_type_idx;
 	ut16 argReg = regsz - ins_size;
 	ut64 source_file_idx = c->source_file;
 	RList *params, *debug_positions, *emitted_debug_locals = NULL; 
 	bool keep = true;
-	if (argReg >= regsz) {
-		//return; // this return breaks tests
+	if (argReg > regsz) {
+		return; // this return breaks tests
 	}
 	p4 = r_uleb128 (p4, p4_end - p4, &line_start);
 	p4 = r_uleb128 (p4, p4_end - p4, &parameters_size);
 	// TODO: check when we should use source_file
 	// The state machine consists of five registers

Vulnerable code: 	if (argReg >= regsz) {
		//return; // this return breaks tests
Fixed code: 	if (argReg > regsz) {
		return; // this return breaks tests
CVE-2017-6387: Out-of-bounds Read (CWE-125)
value: The dex_loadcode function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted DEX file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2017-03-02T01:59Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/bin/p/bin_dex.c, sys/asan.sh
Commit date: 2017-02-27 23:55:39 +0100
Commit message: fix #6857

Diff: diff --git a/libr/bin/p/bin_dex.c b/libr/bin/p/bin_dex.c
index 74b6df706b5..be0c0d320d6 100644
--- a/libr/bin/p/bin_dex.c
+++ b/libr/bin/p/bin_dex.c
@@ -1494,11 +1494,11 @@ static int dex_loadcode(RBinFile *arch, RBinDexObj *bin) {
 			int len = 0;
 			if (methods[i]) {
 				continue;
 			}
 
-			if (bin->methods[i].class_id > bin->header.types_size - 1) {
+			if (bin->methods[i].class_id > bin->header.types_size) {
 				continue;
 			}
 
 			if (is_class_idx_in_code_classes(bin, bin->methods[i].class_id)) {
 				continue;
diff --git a/sys/asan.sh b/sys/asan.sh
index 3773f1abf83..0772fd57600 100755
--- a/sys/asan.sh
+++ b/sys/asan.sh
@@ -20,16 +20,16 @@ echo "Current value:"
 echo "  ASAN=${ASAN}"
 printf "\033[32m"
 echo "========================================================================="
 printf "\033[0m"
 sleep 1
-export LDFLAGS="-lasan"
+#export LDFLAGS="-lasan"
 
 for a in $ASAN ; do
 	export CFLAGS="${CFLAGS} -fsanitize=$a"
 done
-export CFLAGS="${CFLAGS} -lasan"
+#export CFLAGS="${CFLAGS} -lasan"
 
 echo 'int main(){return 0;}' > .a.c
 [ -z "${CC}" ] && CC=gcc
 ${CC} ${CFLAGS} ${LDFLAGS} -o .a.out .a.c
 RET=$?

Vulnerable code: 			if (bin->methods[i].class_id > bin->header.types_size - 1) {
export LDFLAGS="-lasan"
export CFLAGS="${CFLAGS} -lasan"
Fixed code: 			if (bin->methods[i].class_id > bin->header.types_size) {
#export LDFLAGS="-lasan"
#export CFLAGS="${CFLAGS} -lasan"
CVE-2017-7274: NULL Pointer Dereference (CWE-476)
value: The r_pkcs7_parse_cms function in libr/util/r_pkcs7.c in radare2 1.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PE file.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2017-03-27T17:59Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/util/r_pkcs7.c
Commit date: 2017-03-27 12:55:16 +0200
Commit message: Fix #7152 - Null deref in cms


Diff: diff --git a/libr/util/r_pkcs7.c b/libr/util/r_pkcs7.c
index 765fe6f0e2a..467f58fa729 100644
--- a/libr/util/r_pkcs7.c
+++ b/libr/util/r_pkcs7.c
@@ -282,11 +282,13 @@ RCMS *r_pkcs7_parse_cms (const ut8 *buffer, ut32 length) {
 	container = R_NEW0 (RCMS);
 	if (!container) {
 		return NULL;
 	}
 	object = r_asn1_create_object (buffer, length);
-	if (!object || object->list.length != 2 || !object->list.objects[0] || object->list.objects[1]->list.length != 1) {
+	if (!object || object->list.length != 2 || !object->list.objects ||
+		!object->list.objects[0] || !object->list.objects[1] ||
+		object->list.objects[1]->list.length != 1) {
 		r_asn1_free_object (object);
 		free (container);
 		return NULL;
 	}
 	container->contentType = r_asn1_stringify_oid (object->list.objects[0]->sector, object->list.objects[0]->length);

Vulnerable code: 	if (!object || object->list.length != 2 || !object->list.objects[0] || object->list.objects[1]->list.length != 1) {
Fixed code: 	if (!object || object->list.length != 2 || !object->list.objects ||
		!object->list.objects[0] || !object->list.objects[1] ||
		object->list.objects[1]->list.length != 1) {
CVE-2018-11375: Out-of-bounds Read (CWE-125)
value: The _inst__lds() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2018-05-22T19:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/anal/p/anal_avr.c
Commit date: 2018-04-20 20:07:00 +0200
Commit message: Fix crash in anal.avr

Diff: diff --git a/libr/anal/p/anal_avr.c b/libr/anal/p/anal_avr.c
index e7717beb7ca..1da1ab05515 100644
--- a/libr/anal/p/anal_avr.c
+++ b/libr/anal/p/anal_avr.c
@@ -910,10 +910,13 @@ INST_HANDLER (ldi) {	// LDI Rd, K
 	op->val = k;
 	ESIL_A ("0x%x,r%d,=,", k, d);
 }
 
 INST_HANDLER (lds) {	// LDS Rd, k
+	if (len < 4) {
+		return;
+	}
 	int d = ((buf[0] >> 4) & 0xf) | ((buf[1] & 0x1) << 4);
 	int k = (buf[3] << 8) | buf[2];
 	op->ptr = k;
 
 	// load value from RAMPD:k

Fixed code: 	if (len < 4) {
		return;
	}
CVE-2018-11376: Out-of-bounds Read (CWE-125)
value: The r_read_le32() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted ELF file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2018-05-22T19:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/bin/p/bin_elf.c, libr/core/cbin.c
Commit date: 2018-04-18 13:38:22 +0200
Commit message: Fix #9904 - crash in r2_hoobr_r_read_le32 (over 9000 entrypoints) and read_le oobread (#9923)


Diff: diff --git a/libr/bin/p/bin_elf.c b/libr/bin/p/bin_elf.c
index c766d5b9001..f2043dbc8cd 100644
--- a/libr/bin/p/bin_elf.c
+++ b/libr/bin/p/bin_elf.c
@@ -346,19 +346,19 @@ static void process_constructors (RBinFile *bf, RList *ret, int bits) {
 			if (!buf) {
 				continue;
 			}
 			(void)r_buf_read_at (bf->buf, sec->paddr, buf, sec->size);
 			if (bits == 32) {
-				for (i = 0; i < sec->size; i += 4) {
+				for (i = 0; (i + 3) < sec->size; i += 4) {
 					ut32 addr32 = r_read_le32 (buf + i);
 					if (addr32) {
 						RBinAddr *ba = newEntry (sec->paddr + i, (ut64)addr32, type, bits);
 						r_list_append (ret, ba);
 					}
 				}
 			} else {
-				for (i = 0; i < sec->size; i += 8) {
+				for (i = 0; (i + 7) < sec->size; i += 8) {
 					ut64 addr64 = r_read_le64 (buf + i);
 					if (addr64) {
 						RBinAddr *ba = newEntry (sec->paddr + i, addr64, type, bits);
 						r_list_append (ret, ba);
 					}
diff --git a/libr/core/cbin.c b/libr/core/cbin.c
index b8c9d554d13..523ddcad486 100644
--- a/libr/core/cbin.c
+++ b/libr/core/cbin.c
@@ -1042,10 +1042,14 @@ static int bin_entry(RCore *r, int mode, ut64 laddr, int va, bool inifin) {
 			r_cons_printf ("[Constructors]\n");
 		} else {
 			r_cons_printf ("[Entrypoints]\n");
 		}
 	}
+	if (r_list_length (entries) > 1024) {
+		eprintf ("Too many entrypoints (%d)\n", r_list_length (entries));
+		return false;
+	}
 
 	r_list_foreach (entries, iter, entry) {
 		ut64 paddr = entry->paddr;
 		ut64 haddr = UT64_MAX;
 		if (mode != R_CORE_BIN_SET) {

Vulnerable code: 				for (i = 0; i < sec->size; i += 4) {
				for (i = 0; i < sec->size; i += 8) {
Fixed code: 				for (i = 0; (i + 3) < sec->size; i += 4) {
				for (i = 0; (i + 7) < sec->size; i += 8) {
	if (r_list_length (entries) > 1024) {
		eprintf ("Too many entrypoints (%d)\n", r_list_length (entries));
		return false;
	}
CVE-2018-11377: Out-of-bounds Read (CWE-125)
value: The avr_op_analyze() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2018-05-22T19:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/anal/p/anal_avr.c
Commit date: 2018-04-18 13:15:11 +0200
Commit message: Fix oobread in avr

Diff: diff --git a/libr/anal/p/anal_avr.c b/libr/anal/p/anal_avr.c
index 9361b404a7e..4e62158513c 100644
--- a/libr/anal/p/anal_avr.c
+++ b/libr/anal/p/anal_avr.c
@@ -1524,10 +1524,13 @@ OPCODE_DESC opcodes[] = {
 	INST_LAST
 };
 
 static OPCODE_DESC* avr_op_analyze(RAnal *anal, RAnalOp *op, ut64 addr, const ut8 *buf, int len, CPU_MODEL *cpu) {
 	OPCODE_DESC *opcode_desc;
+	if (len < 2) {
+		return NULL;
+	}
 	ut16 ins = (buf[1] << 8) | buf[0];
 	int fail;
 	char *t;
 
 	// initialize op struct

Fixed code: 	if (len < 2) {
		return NULL;
	}
CVE-2018-11377: Out-of-bounds Read (CWE-125)
value: The avr_op_analyze() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2018-05-22T19:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/anal/p/anal_avr.c
Commit date: 2018-04-18 13:16:04 +0200
Commit message: Fix invalid free in RAnal.avr

Diff: diff --git a/libr/anal/p/anal_avr.c b/libr/anal/p/anal_avr.c
index 4e62158513c..e7717beb7ca 100644
--- a/libr/anal/p/anal_avr.c
+++ b/libr/anal/p/anal_avr.c
@@ -1285,11 +1285,11 @@ INST_HANDLER (sbiw) {	// SBIW Rd+1:Rd, K
 
 INST_HANDLER (sbrx) {	// SBRC Rr, b
 			// SBRS Rr, b
 	int b = buf[0] & 0x7;
 	int r = ((buf[0] >> 4) & 0xf) | ((buf[1] & 0x01) << 4);
-	RAnalOp next_op;
+	RAnalOp next_op = {0};
 
 	// calculate next instruction size (call recursively avr_op_analyze)
 	// and free next_op's esil string (we dont need it now)
 	avr_op_analyze (anal,
 			&next_op,

Vulnerable code: 	RAnalOp next_op;
Fixed code: 	RAnalOp next_op = {0};
CVE-2018-11378: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The wasm_dis() function in libr/asm/arch/wasm/wasm.c in or possibly have unspecified other impact via a crafted WASM file.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2018-05-22T19:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/asm/arch/wasm/wasm.c
Commit date: 2018-05-06 15:26:26 +0200
Commit message: Fix #9969 - Stack overflow in wasm disassembler

Diff: diff --git a/libr/asm/arch/wasm/wasm.c b/libr/asm/arch/wasm/wasm.c
index 277289b6de0..0d620981cfe 100644
--- a/libr/asm/arch/wasm/wasm.c
+++ b/libr/asm/arch/wasm/wasm.c
@@ -412,18 +412,24 @@ int wasm_dis(WasmOp *op, const unsigned char *buf, int buf_len) {
 			if (!(n > 0 && n + op->len < buf_len)) {
 				goto beach;
 			}
 			op->len += n;
 			snprintf (op->txt, R_ASM_BUFSIZE, "%s %d ", opdef->txt, count);
-			for (i = 0; i < count && strlen (op->txt) + 10 < R_ASM_BUFSIZE; i++) {
-				int optxtlen = strlen (op->txt);
-				snprintf (op->txt + optxtlen, R_ASM_BUFSIZE - optxtlen, "%d ", table[i]);
+			char *txt = op->txt;
+			int txtLen = strlen (op->txt);
+			int txtLeft = R_ASM_BUFSIZE - txtLen;
+			txt += txtLen;
+			for (i = 0; i < count && txtLen + 10 < R_ASM_BUFSIZE; i++) {
+				snprintf (txt, txtLeft, "%d ", table[i]);
+				txtLen = strlen (txt);
+				txt += txtLen;
+				txtLeft -= txtLen;
 			}
-			snprintf (op->txt + strlen (op->txt), R_ASM_BUFSIZE, "%d", def);
+			snprintf (txt, txtLeft - 1, "%d", def);
 			free (table);
 			break;
-			beach:
+		beach:
 			free (table);
 			goto err;
 		}
 		break;
 	case WASM_OP_CALLINDIRECT:

Vulnerable code: 			for (i = 0; i < count && strlen (op->txt) + 10 < R_ASM_BUFSIZE; i++) {
				int optxtlen = strlen (op->txt);
				snprintf (op->txt + optxtlen, R_ASM_BUFSIZE - optxtlen, "%d ", table[i]);
			snprintf (op->txt + strlen (op->txt), R_ASM_BUFSIZE, "%d", def);
			beach:
Fixed code: 			char *txt = op->txt;
			int txtLen = strlen (op->txt);
			int txtLeft = R_ASM_BUFSIZE - txtLen;
			txt += txtLen;
			for (i = 0; i < count && txtLen + 10 < R_ASM_BUFSIZE; i++) {
				snprintf (txt, txtLeft, "%d ", table[i]);
				txtLen = strlen (txt);
				txt += txtLen;
				txtLeft -= txtLen;
			snprintf (txt, txtLeft - 1, "%d", def);
		beach:
CVE-2018-11379: Out-of-bounds Read (CWE-125)
value: The get_debug_info() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted PE file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2018-05-22T19:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/bin/format/pe/pe.c
Commit date: 2018-04-20 20:07:03 +0200
Commit message: Fix crash in pe

Diff: diff --git a/libr/bin/format/pe/pe.c b/libr/bin/format/pe/pe.c
index 16314ca4a92..761ac0a7e13 100644
--- a/libr/bin/format/pe/pe.c
+++ b/libr/bin/format/pe/pe.c
@@ -2730,12 +2730,12 @@ static bool get_rsds(ut8* dbg_data, int dbg_data_len, SCV_RSDS_HEADER* res) {
 	return true;
 }
 
 static void get_nb10(ut8* dbg_data, SCV_NB10_HEADER* res) {
 	const int nb10sz = 16;
-	memcpy (res, dbg_data, nb10sz);
-	res->file_name = (ut8*) strdup ((const char*) dbg_data + nb10sz);
+	// memcpy (res, dbg_data, nb10sz);
+	// res->file_name = (ut8*) strdup ((const char*) dbg_data + nb10sz);
 }
 
 static int get_debug_info(struct PE_(r_bin_pe_obj_t)* bin, PE_(image_debug_directory_entry)* dbg_dir_entry, ut8* dbg_data, int dbg_data_len, SDebugInfo* res) {
 	#define SIZEOF_FILE_NAME 255
 	int i = 0;
@@ -2770,17 +2770,24 @@ static int get_debug_info(struct PE_(r_bin_pe_obj_t)* bin, PE_(image_debug_direc
 			strncpy (res->file_name, (const char*)
 				basename, sizeof (res->file_name));
 			res->file_name[sizeof (res->file_name) - 1] = 0;
 			rsds_hdr.free ((struct SCV_RSDS_HEADER*) &rsds_hdr);
 		} else if (strncmp ((const char*) dbg_data, "NB10", 4) == 0) {
-			SCV_NB10_HEADER nb10_hdr;
+			if (dbg_data_len < 20) {
+				eprintf ("Truncated NB10 entry, not enough data to parse\n");
+				return 0;
+			}
+			SCV_NB10_HEADER nb10_hdr = {{0}};
 			init_cv_nb10_header (&nb10_hdr);
 			get_nb10 (dbg_data, &nb10_hdr);
 			snprintf (res->guidstr, sizeof (res->guidstr),
 				"%x%x", nb10_hdr.timestamp, nb10_hdr.age);
-			strncpy (res->file_name, (const char*)
-				nb10_hdr.file_name, sizeof(res->file_name) - 1);
+			res->file_name[0] = 0;
+			if (nb10_hdr.file_name) {
+				strncpy (res->file_name, (const char*)
+						nb10_hdr.file_name, sizeof (res->file_name) - 1);
+			}
 			res->file_name[sizeof (res->file_name) - 1] = 0;
 			nb10_hdr.free ((struct SCV_NB10_HEADER*) &nb10_hdr);
 		} else {
 			bprintf ("CodeView section not NB10 or RSDS\n");
 			return 0;

Vulnerable code: 	memcpy (res, dbg_data, nb10sz);
	res->file_name = (ut8*) strdup ((const char*) dbg_data + nb10sz);
			SCV_NB10_HEADER nb10_hdr;
			strncpy (res->file_name, (const char*)
				nb10_hdr.file_name, sizeof(res->file_name) - 1);
Fixed code: 	// memcpy (res, dbg_data, nb10sz);
	// res->file_name = (ut8*) strdup ((const char*) dbg_data + nb10sz);
			if (dbg_data_len < 20) {
				eprintf ("Truncated NB10 entry, not enough data to parse\n");
				return 0;
			}
			SCV_NB10_HEADER nb10_hdr = {{0}};
			res->file_name[0] = 0;
			if (nb10_hdr.file_name) {
				strncpy (res->file_name, (const char*)
						nb10_hdr.file_name, sizeof (res->file_name) - 1);
			}
CVE-2018-11381: Out-of-bounds Read (CWE-125)
value: The string_scan_range() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2018-05-22T19:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/bin/file.c
Commit date: 2018-04-18 13:36:45 +0200
Commit message: Fix #9902 - Fix oobread in RBin.string_scan_range

Diff: diff --git a/libr/bin/file.c b/libr/bin/file.c
index 990338699a6..8538600657e 100644
--- a/libr/bin/file.c
+++ b/libr/bin/file.c
@@ -74,26 +74,27 @@ static int string_scan_range(RList *list, RBinFile *bf, int min,
 	}
 	if (from >= to) {
 		eprintf ("Invalid range to find strings 0x%llx .. 0x%llx\n", from, to);
 		return -1;
 	}
-	ut8 *buf = calloc (to - from, 1);
+	int len = to - from;
+	ut8 *buf = calloc (len, 1);
 	if (!buf || !min) {
 		return -1;
 	}
-	r_buf_read_at (bf->buf, from, buf, to - from);
+	r_buf_read_at (bf->buf, from, buf, len);
 	// may oobread
 	while (needle < to) {
 		rc = r_utf8_decode (buf + needle - from, to - needle, NULL);
 		if (!rc) {
 			needle++;
 			continue;
 		}
 		if (type == R_STRING_TYPE_DETECT) {
 			char *w = (char *)buf + needle + rc - from;
-			if ((to - needle) > 5) {
-				bool is_wide32 = needle + rc + 2 < to && !w[0] && !w[1] && !w[2] && w[3] && !w[4];
+			if ((to - needle) > 5 + rc) {
+				bool is_wide32 = (needle + rc + 2 < to) && (!w[0] && !w[1] && !w[2] && w[3] && !w[4]);
 				if (is_wide32) {
 					str_type = R_STRING_TYPE_WIDE32;
 				} else {
 					bool is_wide = needle + rc + 2 < to && !w[0] && w[1] && !w[2];
 					str_type = is_wide? R_STRING_TYPE_WIDE: R_STRING_TYPE_ASCII;

Vulnerable code: 	ut8 *buf = calloc (to - from, 1);
	r_buf_read_at (bf->buf, from, buf, to - from);
			if ((to - needle) > 5) {
				bool is_wide32 = needle + rc + 2 < to && !w[0] && !w[1] && !w[2] && w[3] && !w[4];
Fixed code: 	int len = to - from;
	ut8 *buf = calloc (len, 1);
	r_buf_read_at (bf->buf, from, buf, len);
			if ((to - needle) > 5 + rc) {
				bool is_wide32 = (needle + rc + 2 < to) && (!w[0] && !w[1] && !w[2] && w[3] && !w[4]);
CVE-2018-11382: Out-of-bounds Read (CWE-125)
value: The _inst__sts() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2018-05-22T19:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/anal/p/anal_avr.c
Commit date: 2018-05-15 14:44:47 +0200
Commit message: Fix #10091 - crash in AVR analysis

Diff: diff --git a/libr/anal/p/anal_avr.c b/libr/anal/p/anal_avr.c
index 93d72ce52ad..3b453f14a1f 100644
--- a/libr/anal/p/anal_avr.c
+++ b/libr/anal/p/anal_avr.c
@@ -923,10 +923,13 @@ INST_HANDLER (lds) {	// LDS Rd, k
 	__generic_ld_st (op, "ram", 0, 1, 0, k, 0);
 	ESIL_A ("r%d,=,", d);
 }
 
 INST_HANDLER (sts) {	// STS k, Rr
+	if (len < 4) {
+		return;
+	}
 	int r = ((buf[0] >> 4) & 0xf) | ((buf[1] & 0x1) << 4);
 	int k = (buf[3] << 8) | buf[2];
 	op->ptr = k;
 
 	ESIL_A ("r%d,", r);

Fixed code: 	if (len < 4) {
		return;
	}
CVE-2018-11383: Use of Uninitialized Resource (CWE-908)
value: The r_strbuf_fini() function in radare2 2.5.0 allows remote attackers to cause a denial of service (invalid free and application crash) via a crafted ELF file because of an uninitialized variable in the CPSE handler in libr/anal/p/anal_avr.c.
CWE description: The product uses or accesses a resource that has not been initialized.
CVSS v3 base score: 5.5
Published: 2018-05-22T19:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/anal/p/anal_avr.c, libr/core/cmd_anal.c
Commit date: 2018-04-24 09:55:19 +0200
Commit message: Fix #9943 - Invalid free on RAnal.avr

Diff: diff --git a/libr/anal/p/anal_avr.c b/libr/anal/p/anal_avr.c
index 1da1ab05515..93d72ce52ad 100644
--- a/libr/anal/p/anal_avr.c
+++ b/libr/anal/p/anal_avr.c
@@ -617,11 +617,11 @@ INST_HANDLER (cpi) { // CPI Rd, K
 }
 
 INST_HANDLER (cpse) {	// CPSE Rd, Rr
 	int r = (buf[0] & 0xf) | ((buf[1] & 0x2) << 3);
 	int d = ((buf[0] >> 4) & 0xf) | ((buf[1] & 0x1) << 4);
-	RAnalOp next_op;
+	RAnalOp next_op = {0};
 
 	// calculate next instruction size (call recursively avr_op_analyze)
 	// and free next_op's esil string (we dont need it now)
 	avr_op_analyze (anal,
 			&next_op,
diff --git a/libr/core/cmd_anal.c b/libr/core/cmd_anal.c
index ed079135c1d..969cf32a33d 100644
--- a/libr/core/cmd_anal.c
+++ b/libr/core/cmd_anal.c
@@ -4348,12 +4348,13 @@ static void cmd_anal_esil(RCore *core, const char *input) {
 		switch (input[1]) {
 		case 'r': // "aetr"
 		{
 			// anal ESIL to REIL.
 			RAnalEsil *esil = r_anal_esil_new (stacksize, iotrap, addrsize);
-			if (!esil)
+			if (!esil) {
 				return;
+			}
 			r_anal_esil_to_reil_setup (esil, core->anal, romem, stats);
 			r_anal_esil_set_pc (esil, core->offset);
 			r_anal_esil_parse (esil, input + 2);
 			r_anal_esil_dumpstack (esil);
 			r_anal_esil_free (esil);

Vulnerable code: 	RAnalOp next_op;
			if (!esil)
Fixed code: 	RAnalOp next_op = {0};
			if (!esil) {
			}
CVE-2018-11384: Out-of-bounds Read (CWE-125)
value: The sh_op() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted ELF file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2018-05-22T19:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/anal/p/anal_sh.c
Commit date: 2018-04-18 13:26:49 +0200
Commit message: Fix #9903 - oobread in RAnal.sh

Diff: diff --git a/libr/anal/p/anal_sh.c b/libr/anal/p/anal_sh.c
index d0326210135..ee2b34133fa 100644
--- a/libr/anal/p/anal_sh.c
+++ b/libr/anal/p/anal_sh.c
@@ -761,12 +761,13 @@ static int (*first_nibble_decode[])(RAnal*,RAnalOp*,ut16) = {
  * routines defined in first_nibble_decode table
  */
 static int sh_op(RAnal *anal, RAnalOp *op, ut64 addr, const ut8 *data, int len) {
 	ut8 op_MSB,op_LSB;
 	int ret;
-	if (!data)
+	if (!data || len < 2) {
 		return 0;
+	}
 	memset (op, '\0', sizeof (RAnalOp));
 	op->addr = addr;
 	op->type = R_ANAL_OP_TYPE_UNK;
 	op->jump = op->fail = -1;
 	op->ptr = op->val = -1;

Vulnerable code: 	if (!data)
Fixed code: 	if (!data || len < 2) {
	}
CVE-2018-12320: Use After Free (CWE-416)
value: There is a use after free in radare2 2.6.0 in r_anal_bb_free() in libr/anal/bb.c via a crafted Java binary file.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.8
Published: 2018-06-13T16:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/anal/bb.c
Commit date: 2018-06-11 03:28:35 +0200
Commit message: Fix #10293 - Use-after-free in r_anal_bb_free()

Diff: diff --git a/libr/anal/bb.c b/libr/anal/bb.c
index 81c5fab1432..a693c55856d 100644
--- a/libr/anal/bb.c
+++ b/libr/anal/bb.c
@@ -60,11 +60,15 @@ R_API void r_anal_bb_free(RAnalBlock *bb) {
 	}
 	if (bb->failbb) {
 		bb->failbb->prev = NULL;
 		bb->failbb = NULL;
 	}
-	R_FREE (bb);
+	if (bb->next) {
+		// avoid double free
+		bb->next->prev = NULL;
+	}
+	R_FREE (bb); // double free
 }
 
 R_API RList *r_anal_bb_list_new() {
 	RList *list = r_list_newf ((RListFree)r_anal_bb_free);
 	if (!list) {

Vulnerable code: 	R_FREE (bb);
Fixed code: 	if (bb->next) {
		// avoid double free
		bb->next->prev = NULL;
	}
	R_FREE (bb); // double free
CVE-2018-12321: Out-of-bounds Read (CWE-125)
value: There is a heap out of bounds read in radare2 2.6.0 in java_switch_op() in libr/anal/p/anal_java.c via a crafted Java binary file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2018-06-13T16:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/anal/p/anal_java.c
Commit date: 2018-06-11 03:15:07 +0200
Commit message: Fix #10296 - Heap out of bounds read in java_switch_op()

Diff: diff --git a/libr/anal/p/anal_java.c b/libr/anal/p/anal_java.c
index 6bffb867c08..62f54240db5 100644
--- a/libr/anal/p/anal_java.c
+++ b/libr/anal/p/anal_java.c
@@ -677,15 +677,15 @@ static int java_switch_op(RAnal *anal, RAnalOp *op, ut64 addr, const ut8 *data,
 	ut64 offset = addr - java_get_method_start ();
 	ut8 pos = (offset+1)%4 ? 1 + 4 - (offset+1)%4 : 1;
 
 	if (op_byte == 0xaa) {
 		// handle a table switch condition
-		if (pos + 8 > len) {
+		if (pos + 8 + 8 > len) {
 			return op->size;
 		}
-		int min_val = (ut32)(UINT (data, pos + 4)),
-			max_val = (ut32)(UINT (data, pos + 8));
+		const int min_val = (ut32)(UINT (data, pos + 4));
+		const int max_val = (ut32)(UINT (data, pos + 8));
 
 		ut32 default_loc = (ut32) (UINT (data, pos)), cur_case = 0;
 		op->switch_op = r_anal_switch_op_new (addr, min_val, default_loc);
 		RAnalCaseOp *caseop = NULL;
 		pos += 12;

Vulnerable code: 		if (pos + 8 > len) {
		int min_val = (ut32)(UINT (data, pos + 4)),
			max_val = (ut32)(UINT (data, pos + 8));
Fixed code: 		if (pos + 8 + 8 > len) {
		const int min_val = (ut32)(UINT (data, pos + 4));
		const int max_val = (ut32)(UINT (data, pos + 8));
CVE-2018-12322: Out-of-bounds Read (CWE-125)
value: There is a heap out of bounds read in radare2 2.6.0 in _6502_op() in libr/anal/p/anal_6502.c via a crafted iNES ROM binary file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2018-06-13T16:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/anal/p/anal_6502.c
Commit date: 2018-06-11 03:03:25 +0200
Commit message: Fix #10294 - crash in r2_hoobr__6502_op

Diff: diff --git a/libr/anal/p/anal_6502.c b/libr/anal/p/anal_6502.c
index 6d002447722..770980f2f2b 100644
--- a/libr/anal/p/anal_6502.c
+++ b/libr/anal/p/anal_6502.c
@@ -680,13 +680,19 @@ static int _6502_op(RAnal *anal, RAnalOp *op, ut64 addr, const ut8 *data, int le
 		// FIXME: Add 1 if branch occurs to same page.
 		// FIXME: Add 2 if branch occurs to different page
 		op->cycles = 2;
 		op->failcycles = 3;
 		op->type = R_ANAL_OP_TYPE_CJMP;
-		if (data[1] <= 127)
-			op->jump = addr + data[1] + op->size;
-		else	op->jump = addr - (256 - data[1]) + op->size;
+		if (len > 1) {
+			if (data[1] <= 127) {
+				op->jump = addr + data[1] + op->size;
+			} else {
+				op->jump = addr - (256 - data[1]) + op->size;
+			}
+		} else {
+			op->jump = addr;
+		}
 		op->fail = addr + op->size;
 		// FIXME: add a type of conditional
 		// op->cond = R_ANAL_COND_LE;
 		_6502_anal_esil_ccall (op, data[0]);
 		break;

Vulnerable code: 		if (data[1] <= 127)
			op->jump = addr + data[1] + op->size;
		else	op->jump = addr - (256 - data[1]) + op->size;
Fixed code: 		if (len > 1) {
			if (data[1] <= 127) {
				op->jump = addr + data[1] + op->size;
			} else {
				op->jump = addr - (256 - data[1]) + op->size;
			}
		} else {
			op->jump = addr;
		}
CVE-2018-19842: Out-of-bounds Read (CWE-125)
value: getToken in libr/asm/p/asm_x86_nz.c in radare2 before 3.1.0 allows attackers to cause a denial of service (stack-based buffer over-read) via crafted x86 assembly data, as demonstrated by rasm2.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2018-12-04T09:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/asm/p/asm_x86_nz.c
Commit date: 2018-11-21 17:50:58 +0100
Commit message: Fix #12239 - crash in the x86.nz assembler ##asm (#12252)


Diff: diff --git a/libr/asm/p/asm_x86_nz.c b/libr/asm/p/asm_x86_nz.c
index 4a23062ee6c..42e079932c4 100644
--- a/libr/asm/p/asm_x86_nz.c
+++ b/libr/asm/p/asm_x86_nz.c
@@ -4293,25 +4293,30 @@ LookupTable oplookup[] = {
 	{"test", 0, &optest, 0},
 	{"null", 0, NULL, 0, 0}
 };
 
 static x86newTokenType getToken(const char *str, size_t *begin, size_t *end) {
+	if (*begin > strlen (str)) {
+		return TT_EOF;
+	}
 	// Skip whitespace
-	while (begin && isspace ((ut8)str[*begin])) {
+	while (begin && str[*begin] && isspace ((ut8)str[*begin])) {
 		++(*begin);
 	}
 
 	if (!str[*begin]) {                // null byte
 		*end = *begin;
 		return TT_EOF;
-	} else if (isalpha ((ut8)str[*begin])) {   // word token
+	}
+	if (isalpha ((ut8)str[*begin])) {   // word token
 		*end = *begin;
-		while (end && isalnum ((ut8)str[*end])) {
+		while (end && str[*end] && isalnum ((ut8)str[*end])) {
 			++(*end);
 		}
 		return TT_WORD;
-	} else if (isdigit ((ut8)str[*begin])) {   // number token
+	}
+	if (isdigit ((ut8)str[*begin])) {   // number token
 		*end = *begin;
 		while (end && isalnum ((ut8)str[*end])) {     // accept alphanumeric characters, because hex.
 			++(*end);
 		}
 		return TT_NUMBER;

Vulnerable code: 	while (begin && isspace ((ut8)str[*begin])) {
	} else if (isalpha ((ut8)str[*begin])) {   // word token
		while (end && isalnum ((ut8)str[*end])) {
	} else if (isdigit ((ut8)str[*begin])) {   // number token
Fixed code: 	if (*begin > strlen (str)) {
		return TT_EOF;
	}
	while (begin && str[*begin] && isspace ((ut8)str[*begin])) {
	}
	if (isalpha ((ut8)str[*begin])) {   // word token
		while (end && str[*end] && isalnum ((ut8)str[*end])) {
	}
	if (isdigit ((ut8)str[*begin])) {   // number token
CVE-2018-19843: Out-of-bounds Read (CWE-125)
value: opmov in libr/asm/p/asm_x86_nz.c in radare2 before 3.1.0 allows attackers to cause a denial of service (buffer over-read) via crafted x86 assembly data, as demonstrated by rasm2.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2018-12-04T09:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/asm/p/asm_x86_nz.c
Commit date: 2018-11-22 10:48:39 +0100
Commit message: Fix #12242 - Crash in x86.nz assembler (#12266)


Diff: diff --git a/libr/asm/p/asm_x86_nz.c b/libr/asm/p/asm_x86_nz.c
index 8d4e28941f4..812d13d3691 100644
--- a/libr/asm/p/asm_x86_nz.c
+++ b/libr/asm/p/asm_x86_nz.c
@@ -2021,13 +2021,13 @@ static int opmov(RAsm *a, ut8 *data, const Opcode *op) {
 
 		if (op->operands[1].type & OT_REGTYPE & OT_SEGMENTREG) {
 			if (op->operands[1].scale[0] == 0) {
 				return -1;
 			}
-			data[l++] = SEG_REG_PREFIXES[op->operands[1].regs[0]];
+			data[l++] = SEG_REG_PREFIXES[op->operands[1].regs[0] % 6];
 			data[l++] = 0x8b;
-			data[l++] = op->operands[0].reg << 3 | 0x5;
+			data[l++] = (((ut32)op->operands[0].reg) << 3) | 0x5;
 			data[l++] = offset;
 			data[l++] = offset >> 8;
 			data[l++] = offset >> 16;
 			data[l++] = offset >> 24;
 			return l;

Vulnerable code: 			data[l++] = SEG_REG_PREFIXES[op->operands[1].regs[0]];
			data[l++] = op->operands[0].reg << 3 | 0x5;
Fixed code: 			data[l++] = SEG_REG_PREFIXES[op->operands[1].regs[0] % 6];
			data[l++] = (((ut32)op->operands[0].reg) << 3) | 0x5;
CVE-2018-20455: Out-of-bounds Write (CWE-787)
value: In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asm_x86_nz.c may allow attackers to cause a denial of service (application crash via a stack-based buffer overflow) by crafting an input file, a related issue to CVE-2018-20456.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2018-12-25T19:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/asm/p/asm_x86_nz.c
Commit date: 2018-12-03 01:46:58 +0100
Commit message: Fix #12372 and #12373 - Crash in x86 assembler (#12380)

0 ,0,[bP-bL-bP-bL-bL-r-bL-bP-bL-bL-
mov ,0,[ax+Bx-ax+Bx-ax+ax+Bx-ax+Bx--
leA ,0,[bP-bL-bL-bP-bL-bP-bL-60@bL-
leA ,0,[bP-bL-r-bP-bL-bP-bL-60@bL-
mov ,0,[ax+Bx-ax+Bx-ax+ax+Bx-ax+Bx--
Diff: diff --git a/libr/asm/p/asm_x86_nz.c b/libr/asm/p/asm_x86_nz.c
index 623892b6d7c..79abc9d60d3 100644
--- a/libr/asm/p/asm_x86_nz.c
+++ b/libr/asm/p/asm_x86_nz.c
@@ -4573,18 +4573,21 @@ static int parseOperand(RAsm *a, const char *str, Operand *op, bool isrepop) {
 			last_type = getToken (str, &pos, &nextpos);
 
 			if (last_type == TT_SPECIAL) {
 				if (str[pos] == '+' || str[pos] == '-' || str[pos] == ']') {
 					if (reg != X86R_UNDEFINED) {
-						op->regs[reg_index] = reg;
-						op->scale[reg_index] = temp;
+						if (reg_index < 2) {
+							op->regs[reg_index] = reg;
+							op->scale[reg_index] = temp;
+						}
 						++reg_index;
 					} else {
 						op->offset += temp;
-						op->regs[reg_index] = X86R_UNDEFINED;
+						if (reg_index < 2) {
+							op->regs[reg_index] = X86R_UNDEFINED;
+						}
 					}
-
 					temp = 1;
 					reg = X86R_UNDEFINED;
 				} else if (str[pos] == '*') {
 					// go to ], + or - to get scale
 

Vulnerable code: 						op->regs[reg_index] = reg;
						op->scale[reg_index] = temp;
						op->regs[reg_index] = X86R_UNDEFINED;

Fixed code: 						if (reg_index < 2) {
							op->regs[reg_index] = reg;
							op->scale[reg_index] = temp;
						}
						if (reg_index < 2) {
							op->regs[reg_index] = X86R_UNDEFINED;
						}
CVE-2018-20456: Out-of-bounds Read (CWE-125)
value: In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asm_x86_nz.c may allow attackers to cause a denial of service (application crash in libr/util/strbuf.c via a stack-based buffer over-read) by crafting an input file, a related issue to CVE-2018-20455.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2018-12-25T19:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/asm/p/asm_x86_nz.c
Commit date: 2018-12-03 01:46:58 +0100
Commit message: Fix #12372 and #12373 - Crash in x86 assembler (#12380)

0 ,0,[bP-bL-bP-bL-bL-r-bL-bP-bL-bL-
mov ,0,[ax+Bx-ax+Bx-ax+ax+Bx-ax+Bx--
leA ,0,[bP-bL-bL-bP-bL-bP-bL-60@bL-
leA ,0,[bP-bL-r-bP-bL-bP-bL-60@bL-
mov ,0,[ax+Bx-ax+Bx-ax+ax+Bx-ax+Bx--
Diff: diff --git a/libr/asm/p/asm_x86_nz.c b/libr/asm/p/asm_x86_nz.c
index 623892b6d7c..79abc9d60d3 100644
--- a/libr/asm/p/asm_x86_nz.c
+++ b/libr/asm/p/asm_x86_nz.c
@@ -4573,18 +4573,21 @@ static int parseOperand(RAsm *a, const char *str, Operand *op, bool isrepop) {
 			last_type = getToken (str, &pos, &nextpos);
 
 			if (last_type == TT_SPECIAL) {
 				if (str[pos] == '+' || str[pos] == '-' || str[pos] == ']') {
 					if (reg != X86R_UNDEFINED) {
-						op->regs[reg_index] = reg;
-						op->scale[reg_index] = temp;
+						if (reg_index < 2) {
+							op->regs[reg_index] = reg;
+							op->scale[reg_index] = temp;
+						}
 						++reg_index;
 					} else {
 						op->offset += temp;
-						op->regs[reg_index] = X86R_UNDEFINED;
+						if (reg_index < 2) {
+							op->regs[reg_index] = X86R_UNDEFINED;
+						}
 					}
-
 					temp = 1;
 					reg = X86R_UNDEFINED;
 				} else if (str[pos] == '*') {
 					// go to ], + or - to get scale
 

Vulnerable code: 						op->regs[reg_index] = reg;
						op->scale[reg_index] = temp;
						op->regs[reg_index] = X86R_UNDEFINED;

Fixed code: 						if (reg_index < 2) {
							op->regs[reg_index] = reg;
							op->scale[reg_index] = temp;
						}
						if (reg_index < 2) {
							op->regs[reg_index] = X86R_UNDEFINED;
						}
CVE-2018-20460: Out-of-bounds Write (CWE-787)
value: In radare2 prior to 3.1.2, the parseOperands function in libr/asm/arch/arm/armass64.c allows attackers to cause a denial-of-service (application crash caused by stack-based buffer overflow) by crafting an input file.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2018-12-25T19:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/asm/arch/arm/armass64.c
Commit date: 2018-12-03 15:29:26 +0100
Commit message: Fix #12376 - crash in: rasm2 -a arm -b 64 '0 ,0,0,0,0,0,0,'

Diff: diff --git a/libr/asm/arch/arm/armass64.c b/libr/asm/arch/arm/armass64.c
index b8f61b79803..91bd4282a77 100644
--- a/libr/asm/arch/arm/armass64.c
+++ b/libr/asm/arch/arm/armass64.c
@@ -735,10 +735,14 @@ static bool parseOperands(char* str, ArmOp *op) {
 			*next++ = 0;
 		}
 		while (token[0] == ' ') {
 			token++;
 		}
+		if (operand >= MAX_OPERANDS) {
+			eprintf ("Too many operands\n");
+			return false;
+		}
 		op->operands[operand].type = ARM_NOTYPE;
 		op->operands[operand].reg_type = ARM_UNDEFINED;
 		op->operands[operand].shift = ARM_NO_SHIFT;
 
 		while (token[0] == ' ' || token[0] == '[' || token[0] == ']') {

Fixed code: 		if (operand >= MAX_OPERANDS) {
			eprintf ("Too many operands\n");
			return false;
		}
CVE-2018-20461: Out-of-bounds Read (CWE-125)
value: In radare2 prior to 3.1.1, core_anal_bytes in libr/core/cmd_anal.c allows attackers to cause a denial-of-service (application crash caused by out-of-bounds read) by crafting a binary file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2018-12-25T19:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/core/cmd_anal.c
Commit date: 2018-12-03 02:54:37 +0100
Commit message: Fix #12375 - Crash in bd+ao (#12382)


Diff: diff --git a/libr/core/cmd_anal.c b/libr/core/cmd_anal.c
index 4b6613ecc69..af060f27678 100644
--- a/libr/core/cmd_anal.c
+++ b/libr/core/cmd_anal.c
@@ -1566,20 +1566,26 @@ static void core_anal_bytes(RCore *core, const ut8 *buf, int len, int nops, int
 			if (opexstr && *opexstr) {
 				printline ("opex", "%s\n", opexstr);
 			}
 #endif
 			printline ("bytes", NULL, 0);
-			for (j = 0; j < size; j++) {
-				r_cons_printf ("%02x", buf[j + idx]);
+			int minsz = R_MIN (len, size);
+			minsz = R_MAX (minsz, 0);
+			for (j = 0; j < minsz; j++) {
+				ut8 ch = ((j + idx - 1) > minsz)? 0xff: buf[j + idx];
+				r_cons_printf ("%02x", ch);
 			}
 			r_cons_newline ();
-			if (op.val != UT64_MAX)
+			if (op.val != UT64_MAX) {
 				printline ("val", "0x%08" PFMT64x "\n", op.val);
-			if (op.ptr != UT64_MAX)
+			}
+			if (op.ptr != UT64_MAX) {
 				printline ("ptr", "0x%08" PFMT64x "\n", op.ptr);
-			if (op.refptr != -1)
+			}
+			if (op.refptr != -1) {
 				printline ("refptr", "%d\n", op.refptr);
+			}
 			printline ("size", "%d\n", size);
 			printline ("sign", "%s\n", r_str_bool (op.sign));
 			printline ("type", "%s\n", r_anal_optype_to_string (op.type));
 			printline ("cycles", "%d\n", op.cycles);
 			if (op.failcycles) {

Vulnerable code: 			for (j = 0; j < size; j++) {
				r_cons_printf ("%02x", buf[j + idx]);
			if (op.val != UT64_MAX)
			if (op.ptr != UT64_MAX)
			if (op.refptr != -1)
Fixed code: 			int minsz = R_MIN (len, size);
			minsz = R_MAX (minsz, 0);
			for (j = 0; j < minsz; j++) {
				ut8 ch = ((j + idx - 1) > minsz)? 0xff: buf[j + idx];
				r_cons_printf ("%02x", ch);
			if (op.val != UT64_MAX) {
			}
			if (op.ptr != UT64_MAX) {
			}
			if (op.refptr != -1) {
			}
CVE-2019-19954: Uncontrolled Search Path Element (CWE-427)
value: Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating a Trojan horse %SYSTEMDRIVE%\node_modules\.bin\wmic.exe file.
CWE description: The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
CVSS v3 base score: 7.3
Published: 2019-12-24T15:15Z
Repository: https://github.com/signalapp/Signal-Desktop
Language: Unknown
Commit date: 2019-12-16 15:00:24 -0800
Commit message: os-locale: Include 'preferLocal: false' option when using execa

Thanks to Rich Mirch for pointing this out.

Diff: diff --git a/patches/os-locale+2.1.0.patch b/patches/os-locale+2.1.0.patch
new file mode 100644
index 00000000..1cb2fb12
Binary files /dev/null and b/patches/os-locale+2.1.0.patch differ
CVE-2021-4266: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic has been found in Webdetails cpf up to 9.5.0.0-80. Affected is an unknown function of the file core/src/main/java/pt/webdetails/cpf/packager/DependenciesPackage.java. The manipulation of the argument baseUrl leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 9.5.0.0-81 is able to address this issue. The name of the patch is 3bff900d228e8cae3af256b447c5d15bdb03c174. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216468.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-21T19:15Z
Repository: https://github.com/webdetails/cpf
Language: Unknown
Commit date: 2021-10-07 17:32:07 +0100
Commit message: Merge pull request #165 from dcleao/PPP-4690

[PPP-4690] XSS on pentaho-cdf-dd/api/renderer/render?root parameter