SEC-bench/Seed huggingface dataset:
Project: frr (frrouting/frr), language: c++
Vulnerability instance: frr.cve-2022-26127
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/FRRouting/frr/issues/10487
## Description:
Issue: FRRouting/frr#10487
Title: Miss a check on length in Babel
State: closed
Created by: whichbug
Created at: 2022-02-03 02:44:29+00:00

Issue Body:
The code below misses a check on the relationship between `packetlen` and `bodylen` before Line 298, which may lead to buffer overflows when accessing the memory at Line 300 and Line 309.

https://github.com/FRRouting/frr/blob/3d1ff4bfdb159583a62e72ccb359a8508c4cbb2e/babeld/message.c#L289-L309

To fix, we may put the code below before the while loop:

```
if (packetlen < bodylen + 4) {
    debugf(BABEL_DEBUG_COMMON,"Received truncated message."); 
    return 1; 
}
```

The output of the address sanitizer:
```
==271648==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000114 at pc 0x00000059301a bp 0x7fff3f7301f0 sp 0x7fff3f7301e8
READ of size 1 at 0x603000000114 thread T0
    #0 0x593019 in babel_packet_examin /home/parallels/myfrr/babeld/message.c:300:16
    #1 0x593019 in parse_packet /home/parallels/myfrr/babeld/message.c:354:9
```



Comments:
Comment by qlyoung on 2022-02-03 18:08:26+00:00:
Awesome! Since you already have a fix, would you be willing to submit the patch as a PR? That would be super helpful.

---

Comment by whichbug on 2022-02-03 21:32:44+00:00:
> Awesome! Since you already have a fix, would you be willing to submit the patch as a PR? That would be super helpful.

Thanks for your reply. I have created the pull request.

---

Comment by qlyoung on 2022-03-28 18:23:05+00:00:
This has been assigned [CVE-2022-26127](https://nvd.nist.gov/vuln/detail/CVE-2022-26127) with a severity score of 7.8.

No assessment of exploitability has been made.

Please see my comment [here](https://github.com/FRRouting/frr/issues/10507#issuecomment-1080985102)

Commit References:
3d1ff4bfdb159583a62e72ccb359a8508c4cbb2e

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
cd $SRC/libyang
mkdir -p build; cd build
cmake -DBUILD_SHARED_LIBS=OFF -DENABLE_LYD_PRIV=ON -DCMAKE_INSTALL_PREFIX:PATH=/usr \
    -D CMAKE_BUILD_TYPE:String="Release" ..
make -j$(nproc)
make install -j$(nproc)
export ASAN_OPTIONS=detect_leaks=0
./bootstrap.sh
./configure --enable-libfuzzer --enable-static --enable-static-bin --sbindir=$SRC/bin
cd $SRC/corpi

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y git autoconf automake libtool make libreadline-dev texinfo libjson-c-dev pkg-config bison flex python3-pip libc-ares-dev python3-dev python3-sphinx build-essential libsystemd-dev libsnmp-dev libcap-dev libelf-dev libpcre3-dev libpcre2-dev
RUN git clone https://github.com/frrouting/frr frr
RUN git -C frr checkout 11d557869cc790c36dd421da61bf9a194fa7e219
WORKDIR $SRC/frr
COPY build.sh $SRC/

Additional files:
Project: memcached (memcached/memcached), language: c++
Vulnerability instance: memcached.cve-2019-11596
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/memcached/memcached/issues/474
## Description:
Issue: memcached/memcached#474
Title: segfault (null pointer dereference) during lru command handling
State: closed
Created by: stze
Created at: 2019-04-10 10:38:46+00:00
Labels: merged/fixed for next

Issue Body:
Dear memcached team —

I have detected a SIGSEGV during the lru command handling.

#### Version
bb0980fbbafd4eb723f76918e7ca364360315c1b

#### How to reproduce
Start memcached
`$ memcached`
Send malicious payload via nc:
`$ echo -n "bHJ1IG1vZGUKb7G0AGxydWRl6gdtTk9UXw==" | base64 -d | nc 127.0.0.1 11211`

#### ASAN
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==14929==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000582a7e bp 0x7f6082dfa8d0 sp 0x7f6082dfa780 T4)
==14929==The signal is caused by a READ memory access.
==14929==Hint: address points to the zero page.
    #0 0x582a7d in __wrap_strcmp (/home/stze/Documents/repositories/memcached/memcached+0x582a7d)
    #1 0x547ac4 in process_lru_command /home/stze/Documents/repositories/memcached/memcached.c:4543:13
    #2 0x54055d in process_command /home/stze/Documents/repositories/memcached/memcached.c:4920:9
    #3 0x53b30c in try_read_command /home/stze/Documents/repositories/memcached/memcached.c:5064:9
    #4 0x52a48e in drive_machine /home/stze/Documents/repositories/memcached/memcached.c:5500:17
    #5 0x52c76a in event_handler /home/stze/Documents/repositories/memcached/memcached.c:5782:5
    #6 0x7f6088099030  (/lib64/libevent-2.1.so.6+0x24030)
    #7 0x7f60880997c6 in event_base_loop (/lib64/libevent-2.1.so.6+0x247c6)
    #8 0x56f7ff in worker_libevent /home/stze/Documents/repositories/memcached/thread.c:387:5
    #9 0x7f608805b58d in start_thread (/lib64/libpthread.so.0+0x858d)
    #10 0x7f6087dd9682 in __GI___clone (/lib64/libc.so.6+0xfd682)
```

Please let me know what additional information I can provide to successfully reproduce the issue.



Comments:
Comment by dormando on 2019-04-10 21:45:22+00:00:
thanks! Looks like I got lazy while writing that handler :(

---

Comment by dormando on 2019-04-27 08:19:28+00:00:
bug was also in `lru temp_ttl`.

---

Comment by carnil on 2019-05-05 11:39:44+00:00:
CVE-2019-11596 was assigned for this issue.

Commit References:
bb0980fbbafd4eb723f76918e7ca364360315c1b

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./autogen.sh
./configure --enable-proxy
make -j$(nproc)
cd $SRC/memcached

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool pkgconf libevent-dev
RUN git clone https://github.com/memcached/memcached memcached
RUN git -C memcached checkout 46270955d52eb16a46e37fbd12eb3232d15513a0
WORKDIR $SRC/memcached
COPY build.sh $SRC/

Additional files:
Project: espeak-ng (espeak-ng/espeak-ng), language: c++
Vulnerability instance: espeak-ng.cve-2023-49994
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/espeak-ng/espeak-ng/issues/1823
## Description:
Issue: espeak-ng/espeak-ng#1823
Title: Floating Point Exception exists in the function PeaksToHarmspect in wavegen.c
State: closed
Created by: SEU-SSL
Created at: 2023-11-13 03:23:53+00:00

Issue Body:
**System info**
Ubuntu x86_64, clang 12.0
version: espeak-ng(1.52-dev)

**Command line**
./espeak-ng -f poc -w /dev/null

**Poc**
poc:[poc](https://github.com/SEU-SSL/Poc/blob/main/espeak-ng/id_000000%2Csig_08%2Csrc_003156%2B002428%2Cop_splice%2Crep_32)

**AddressSanitizer output**
==4069818==ERROR: AddressSanitizer: FPE on unknown address 0x0000005aeced (pc 0x0000005aeced bp 0x000000fe792a sp 0x7fff82149c60 T0)
 #0 0x5aeced in PeaksToHarmspect /src/espeak-ng/src/libespeak-ng/wavegen.c:456:87
 #1 0x5b3639 in Wavegen /src/espeak-ng/src/libespeak-ng/wavegen.c:723:13
 #2 0x5b3639 in WavegenFill2 /src/espeak-ng/src/libespeak-ng/wavegen.c:1331:13
 #3 0x5b3639 in WavegenFill /src/espeak-ng/src/libespeak-ng/wavegen.c:1420:13
 #4 0x54317c in Synthesize /src/espeak-ng/src/libespeak-ng/speech.c:461:3
 #5 0x544552 in sync_espeak_Synth /src/espeak-ng/src/libespeak-ng/speech.c:571:29
 #6 0x544552 in espeak_ng_Synthesize /src/espeak-ng/src/libespeak-ng/speech.c:669:10
 #7 0x51fa9e in espeak_Synth /src/espeak-ng/src/libespeak-ng/espeak_api.c:90:32
 #8 0x4cde94 in main /src/espeak-ng/src/espeak-ng.c:779:3
 #9 0x7fd834ba0082 in __libc_start_main /build/glibc-BHL3KM/glibc-2.31/csu/../csu/libc-start.c:308:16
 #10 0x41d64d in _start (/src/espeak-ng/src/espeak-ng+0x41d64d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE /src/espeak-ng/src/libespeak-ng/wavegen.c:456:87 in PeaksToHarmspect
==4069818==ABORTING


Comments:
Comment by StayPirate on 2023-12-13 08:38:06+00:00:
FYI, MITRE assigned CVE-2023-49994 to this bug.

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
export ASAN_OPTIONS=detect_leaks=0
./autogen.sh
./configure --with-libfuzzer=yes --disable-shared --with-speechplayer=no
make check || true -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt install -y automake autoconf libtool pkg-config
RUN git clone https://github.com/espeak-ng/espeak-ng espeak-ng
RUN git -C espeak-ng checkout 4870adfa25b1a32b4361592f1be8a40337c58d6c
WORKDIR $SRC/espeak-ng
COPY build.sh $SRC/

Additional files:
Project: faad2 (knik0/faad2), language: c++
Vulnerability instance: faad2.cve-2023-38858
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/knik0/faad2/issues/173
## Description:
Issue: knik0/faad2#173
Title: A SEGV vulnerability found in faad2
State: closed
Created by: mondaylord
Created at: 2023-07-24 02:37:19+00:00

Issue Body:
Hi, developers of faad2:
In the test of the binary faad([1d53978](https://github.com/knik0/faad2/commit/1d539788397713968d9660fe9f4e68af526bab73)) instrumented with ASAN. There is a SEGV vulnerability in `faad`, `/faad2/frontend/mp4read.c:1039:67` in `mp4info`. Here is the ASAN mode output:

=================================================================
==58059==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000004 (pc 0x0000004d332f bp 0x7fff0e2f79b0 sp 0x7fff0e2f7900 T0)
==58059==The signal is caused by a READ memory access.
==58059==Hint: address points to the zero page.
    #0 0x4d332f in mp4info /faad2/frontend/mp4read.c:1039:67
    #1 0x4d2361 in mp4read_open /faad2/frontend/mp4read.c:1085:9
    #2 0x4cc166 in decodeMP4file /faad2/frontend/main.c:820:9
    #3 0x4cc166 in faad_main /faad2/frontend/main.c:1318:18
    #4 0x4cc166 in main /faad2/frontend/main.c:1376:12
    #5 0x7f99902d9c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    #6 0x41c419 in _start (/faad2/build/faad+0x41c419)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /faad2/frontend/mp4read.c:1039:67 in mp4info
==58059==ABORTING

### Crash input
https://github.com/17ssDP/fuzzer_crashes/blob/main/faad2/segv

### Command Line
./faad -o /dev/null @@

### Environment
Ubuntu 16.04
Clang 10.0.1
gcc 5.5


Comments:
Comment by carnil on 2023-08-17 17:46:27+00:00:
This appears to be CVE-2023-38858.

---

Comment by fabiangreffrath on 2023-08-21 10:19:32+00:00:
Should be sufficient to check if `mp4config.frame.info` has been allocated at all.

---

Comment by eustas on 2023-08-21 10:30:16+00:00:
@mondaylord thanks for reporting.

May I ask what harness you use for fuzzing CLI?

---

Comment by mondaylord on 2023-08-22 00:09:52+00:00:
> @mondaylord thanks for reporting.
> 
> May I ask what harness you use for fuzzing CLI?

I used a custom-designed fuzzer. If everything goes as planned, I intend to open-source it soon.


Commit References:
1d539788397713968d9660fe9f4e68af526bab73

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./bootstrap
./configure
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool
RUN git clone https://github.com/knik0/faad2 faad2
RUN git -C faad2 checkout 3918dee56063500d0aa23d6c3c94b211ac471a8c
WORKDIR $SRC/faad2
COPY build.sh $SRC/

Additional files:
Project: libredwg (libredwg/libredwg), language: c++
Vulnerability instance: libredwg.cve-2020-21839
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/LibreDWG/libredwg/issues/188#issuecomment-574492707
## Description:
Issue: LibreDWG/libredwg#188
Title: Several bugs found by fuzzing
Referenced comment by linhlhq on 2020-01-15 04:39:38+00:00:

**4.Memory leaks in dwg_decode_eed ../../src/decode.c:3638**
POC: https://github.com/linhlhq/research/blob/master/PoCs/libreDWG_4c26d37/id:000171%2Csig:06%2Csrc:004378%2B003724%2Cop:splice%2Crep:2

```
=================================================================
==6139==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 80 byte(s) in 2 object(s) allocated from:
    #0 0x7f50ca2edd38 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded38)
    #1 0x561a721a5b36 in dwg_decode_eed ../../src/decode.c:3638

SUMMARY: AddressSanitizer: 80 byte(s) leaked in 2 allocation(s).
```

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
sh ./autogen.sh
./configure --disable-shared
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y autoconf libtool texinfo
RUN git clone https://github.com/libredwg/libredwg libredwg
RUN git -C libredwg checkout d5a51c01023d5585ddf3dd17c83dbb3c81efc97e
WORKDIR $SRC/libredwg
COPY build.sh $SRC/

Additional files:
filename: fuzz_dwg_decode.options
content: [libfuzzer]
detect_leaks=0
Project: gpac (gpac/gpac), language: c++
Vulnerability instance: gpac.cve-2022-46490
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/gpac/gpac/issues/2327
## Description:
Issue: gpac/gpac#2327
Title: Memory leak in afrt_box_read function of box_code_adobe.c:706:35
State: closed
Created by: HotSpurzzZ
Created at: 2022-11-28 06:30:26+00:00

Issue Body:
A memory leak has occurred when running program MP4Box, this can reproduce on the lattest commit.
### Version
```
$ ./MP4Box -version                              
MP4Box - GPAC version 2.1-DEV-rev505-gb9577e6ad-master
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
	GPAC Filters: https://doi.org/10.1145/3339825.3394929
	GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --static-build --extra-cflags=-fsanitize=address -g --extra-ldflags=-fsanitize=address -g
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_FREETYPE GPAC_HAS_JPEG GPAC_HAS_PNG GPAC_HAS_LINUX_DVB
```
git log 
```
commit b9577e6ad91ef96decbcd369227ab02b2842c77f (HEAD -> master, origin/master, origin/HEAD)
Author: jeanlf <jeanlf@gpac.io>
Date:   Fri Nov 25 16:53:55 2022 +0100
```
### Verification steps
```
export CFLAGS='-fsanitize=address -g'
export CC=/usr/bin/clang
export CXX=/usr/bin/clang++ 
git clone https://github.com/gpac/gpac.git
cd gpac
./configure --static-build --extra-cflags="${CFLAGS}" --extra-ldflags="${CFLAGS}"
make
cd bin/gcc
./MP4Box -info $poc
```
### POC file
https://github.com/HotSpurzzZ/testcases/blob/main/gpac/gpac_Direct_leak_afrt_box_read.mp4
### AddressSanitizer output
```
$ ./MP4Box -info gpac_Direct_leak_afrt_box_read.mp4       
[isom] not enough bytes in box afrt: 0 left, reading 1 (file isomedia/box_code_adobe.c, line 713)
[iso file] Read Box "afrt" (start 0) failed (Invalid IsoMedia File) - skipping
Error opening file gpac_Direct_leak_afrt_box_read.mp4: Invalid IsoMedia File

=================================================================
==10525==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 24 byte(s) in 1 object(s) allocated from:
    #0 0x4a186d in malloc (/root/Desktop/gpac/bin/gcc/MP4Box+0x4a186d)
    #1 0x902c18 in afrt_box_read /root/Desktop/gpac/src/isomedia/box_code_adobe.c:706:35

SUMMARY: AddressSanitizer: 24 byte(s) leaked in 1 allocation(s).
```




Commit References:
b9577e6ad91ef96decbcd369227ab02b2842c77f

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure --static-build --extra-cflags="${CFLAGS}" --extra-ldflags="${CFLAGS}"
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y build-essential pkg-config libz-dev
RUN git clone https://github.com/gpac/gpac gpac
RUN git -C gpac checkout 65430e30593bb04579445e77df0a1207adfad357
WORKDIR $SRC/gpac
COPY build.sh $SRC/

Additional files:
Project: libiec61850 (mz-automation/libiec61850), language: c++
Vulnerability instance: libiec61850.cve-2018-19093
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/mz-automation/libiec61850/issues/84
## Description:
Issue: mz-automation/libiec61850#84
Title: SEGV in function ControlObjectClient_setCommandTerminationHandler
State: closed
Created by: fouzhe
Created at: 2018-11-07 16:41:29+00:00

Issue Body:
I used **gcc 5.4 and AddressSanitizer**(`export CFLAGS="-g -fsanitize=address" CXXFLAGS="-g -fsanitize=address" LDFLAGS="-fsanitize=address"` before `make`)  to build **[libiec61850](https://github.com/mz-automation/libiec61850)**. 

First, I run the `server_example_basic_io` in directory `libiec61850/examples/server_example_basic_io` by command `sudo ./server_example_basic_io` so that the server is set up. Then I tested `iec61850_client_example_control` in directory `libiec61850/examples/iec61850_client_example_control` by command `sudo ./client_example_control`. But I got `SEGV` in function  `ControlObjectClient_setCommandTerminationHandler` in `client_control.c`.



This is the ASAN information:

```
=================================================================
==16582==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000050 (pc 0x00000044a3d4 bp 0x60800000bfa0 sp 0x7ffd097d60c0 T0)
    #0 0x44a3d3 in ControlObjectClient_setCommandTerminationHandler src/iec61850/client/client_control.c:267
    #1 0x405af2 in main /home/fouzhe/my_fuzz/libiec61850/examples/iec61850_client_example_control/client_example_control.c:191
    #2 0x7f557490f82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #3 0x4093b8 in _start (/home/fouzhe/my_fuzz/libiec61850/examples/iec61850_client_example_control/client_example_control+0x4093b8)
```



Comments:
Comment by mzillgith on 2018-11-07 17:21:11+00:00:
The example cannot run with server_example_basic_io. It is intended to be run with server_example_control that has the required data model to show the usage of advanced control models.

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
mkdir -p build && cd build
cmake ../
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN git clone https://github.com/mz-automation/libiec61850 libiec61850
RUN git -C libiec61850 checkout 6ba363bd4a4803dfb194733a9729ad421d6b49f0
WORKDIR $SRC/libiec61850
COPY build.sh $SRC/

Additional files:
filename: fuzz_decode.options
content: [libfuzzer]
detect_leaks=0
Project: mruby (mruby/mruby), language: c++
Vulnerability instance: mruby.cve-2021-4110
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: Huntr
## URL: https://huntr.dev/bounties/4ce5dc47-2512-4c87-8609-453adc8cad20
## Description:
Description
NULL Pointer Dereference in mrb_full_gc
Proof of Concept
( *a = () )
a.<<.take_while{ a.drop_while {Enumerable ; a<<lambda {}}}
Result
./master/asan_mruby/bin/mirb ./crash.rb
mirb - Embeddable Interactive Ruby Shell

 => nil
AddressSanitizer:DEADLYSIGNAL
=================================================================
==21352==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000018 (pc 0x556b44382444 bp 0x7fff4e9961d0 sp 0x7fff4e9961b0 T0)
==21352==The signal is caused by a READ memory access.
==21352==Hint: address points to the zero page.
    #0 0x556b44382443 in mrb_full_gc /root/master/asan_mruby/src/gc.c:1317
    #1 0x556b4438276b in mrb_garbage_collect /root/master/asan_mruby/src/gc.c:1350
    #2 0x556b44386737 in mrb_irep_incref /root/master/asan_mruby/src/state.c:114
    #3 0x556b4444780a in mrb_proc_copy /root/master/asan_mruby/src/proc.c:213
    #4 0x556b44448162 in proc_lambda /root/master/asan_mruby/src/proc.c:284
    #5 0x556b4439f98c in mrb_vm_exec /root/master/asan_mruby/src/vm.c:1637
    #6 0x556b44391018 in mrb_vm_run /root/master/asan_mruby/src/vm.c:1091
    #7 0x556b443034eb in main /root/master/asan_mruby/mrbgems/mruby-bin-mirb/tools/mirb/mirb.c:670
    #8 0x7f192ee230b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #9 0x556b4430048d in _start (/root/master/asan_mruby/bin/mirb+0xbe48d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/master/asan_mruby/src/gc.c:1317 in mrb_full_gc
==21352==ABORTING

Relevant Links:
https://github.com/mruby/mruby

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
cd $SRC/mruby
export LD=$CC
export LDFLAGS="$CFLAGS"
rake -m

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y build-essential ruby bison ninja-build cmake zlib1g-dev libbz2-dev liblzma-dev
RUN git clone https://github.com/mruby/mruby mruby
RUN git -C mruby checkout 8a74b2a25d5a0b66326d9642567fef894ea90d10
WORKDIR $SRC/mruby
COPY build.sh $SRC/

Additional files:
Project: libiec61850 (mz-automation/libiec61850), language: c++
Vulnerability instance: libiec61850.cve-2018-18937
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/mz-automation/libiec61850/issues/82
## Description:
Issue: mz-automation/libiec61850#82
Title: SEGV in function ClientDataSet_getValues
State: closed
Created by: fouzhe
Created at: 2018-11-03 06:19:20+00:00

Issue Body:
I used **gcc 5.4 and AddressSanitizer**(`export CFLAGS="-g -fsanitize=address" CXXFLAGS="-g -fsanitize=address" LDFLAGS="-fsanitize=address"` before `make`)  to build **[libiec61850](https://github.com/mz-automation/libiec61850)**. 

First, I run the `server_example_basic_io` in directory `libiec61850/examples/server_example_basic_io` by command `sudo ./server_example_basic_io` so that the server is set up. Then I tested `iec61850_client_example4` in directory `libiec61850/examples/iec61850_client_example4` by command `sudo ./client_example4`. But I got `SEGV` in function  `ClientDataSet_getValues` in `ied_connection.c`.



This is the ASAN information:

```
=================================================================
==13178==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x000000412330 bp 0x7ffedff5df40 sp 0x7ffedff5df30 T0)
    #0 0x41232f in ClientDataSet_getValues src/iec61850/client/ied_connection.c:216
    #1 0x402a06 in main /home/fouzhe/libiec61850_pure/libiec61850/examples/iec61850_client_example4/client_example4.c:77
    #2 0x7f8f5eb6682f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #3 0x402658 in _start (/home/fouzhe/libiec61850_pure/libiec61850/examples/iec61850_client_example4/client_example4+0x402658)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV src/iec61850/client/ied_connection.c:216 ClientDataSet_getValues
==13178==ABORTING
```



Comments:
Comment by rfrohl on 2018-11-06 08:20:59+00:00:
[CVE-2018-18937](https://nvd.nist.gov/vuln/detail/CVE-2018-18937)

---

Comment by mzillgith on 2018-11-06 09:35:12+00:00:
I see. This is because the example code didn't check the result when creating the data set and then passing a NULL pointer to the next call. I fixed the example.

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
mkdir -p build && cd build
cmake ../
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN git clone https://github.com/mz-automation/libiec61850 libiec61850
RUN git -C libiec61850 checkout 6ba363bd4a4803dfb194733a9729ad421d6b49f0
WORKDIR $SRC/libiec61850
COPY build.sh $SRC/

Additional files:
filename: fuzz_decode.options
content: [libfuzzer]
detect_leaks=0
Project: openjpeg (uclouvain/openjpeg), language: c++
Vulnerability instance: openjpeg.cve-2016-9117
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/uclouvain/openjpeg/issues/860
## Description:
Issue: uclouvain/openjpeg#860
Title: NULL Pointer Access in function imagetopnm of convert.c(jp2):1289
State: closed
Created by: YangY-Xiao
Created at: 2016-10-29 09:30:52+00:00

Issue Body:
# **DESCRIPTION**

OPENJPEG null ptr dereference in convert.c(jp2):1289
# **VERSION**

OPENJPEG-2.1.2
# **Address Sanitizer Output**

==23861==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000 (pc 0x08143ca7 bp 0xbfd92248 sp 0xbfd92040 T0)
    #0 0x8143ca6  (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x8143ca6)
    #1 0x813727f  (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x813727f)
    #2 0xb73d8636  (/lib/i386-linux-gnu/libc.so.6+0x18636)
    #3 0x805f327  (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x805f327)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/home/yang/openjpeg/openjpeg-2.1.2/build-clang/bin/opj_decompress+0x8143ca6)
# **GDB Information**

(rr) p image->comps[0]
$1 = {dx = 1, dy = 1, w = 20, h = 50, x0 = 0, y0 = 0, prec = 16, bpp = 0, sgnd = 0, resno_decoded = 0, factor = 0, data = 0x0, alpha = 0}
# **Poc**

Contact me if you need Poc file at YangX92@hotmail.com



Comments:
Comment by 1ucian0 on 2016-12-03 04:53:24+00:00:
Please, refer to this issue as CVE-2016-9117

---

Comment by rouault on 2017-08-09 08:06:44+00:00:
@Young-X Please verify if that occurs still with latest master. If so, please attach the reproducer to the ticket

---

Comment by carnil on 2017-09-23 07:08:44+00:00:
@Young-X can you please provide the reproducer?

---

Comment by YangY-Xiao on 2017-10-24 01:28:51+00:00:
There is no crash with latest version and PoC that triggered #860.
Sorry for replying late.

---

Comment by YangY-Xiao on 2017-10-24 01:47:21+00:00:
wrong operation

---

Comment by carnil on 2017-10-29 09:32:12+00:00:
On Tue, Oct 24, 2017 at 01:46:47AM +0000, Young-X wrote:
> There is no crash with latest version and PoC that triggered #860.
> Sorry for replying late.

Thanks for confirming.

Can you please provide the reproducer?


Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
mkdir -p build
cd build
cmake ..
make clean -s -j$(nproc)
make -j$(nproc) -s

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make cmake g++
RUN git clone https://github.com/uclouvain/openjpeg openjpeg
RUN git -C openjpeg checkout 1f1e968269bbd7eaade7955892a6d8c281b91df2
WORKDIR $SRC/openjpeg
COPY build.sh $SRC/

Additional files:
Project: libheif (strukturag/libheif), language: c++
Vulnerability instance: libheif.cve-2020-19499
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/strukturag/libheif/issues/138
## Description:
Issue: strukturag/libheif#138
Title: SEGV in box.cc:2408
State: closed
Created by: strongcourage
Created at: 2019-07-28 00:11:00+00:00

Issue Body:
Hi,

I found a bug on the latest commit fd0c01d on master.
PoC: https://github.com/strongcourage/PoCs/blob/master/libheif_fd0c01d/PoC_segv_box.cc:2408
Command: examples/heif-convert $PoC /tmp/out.png
ASAN says:
~~~
==16874==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000050 (pc 0x00000048143c bp 0x7ffc1ade73a0 sp 0x7ffc1ade7370 T0)
    #0 0x48143b in std::vector<heif::Box_iref::Reference, std::allocator<heif::Box_iref::Reference> >::begin() const /usr/include/c++/5/bits/stl_vector.h:557
    #1 0x475604 in heif::Box_iref::get_references(unsigned int, unsigned int) const ../../libheif/box.cc:2408
    #2 0x4293b6 in heif::HeifContext::get_id_of_non_virtual_child_image(unsigned int, unsigned int&) const ../../libheif/heif_context.cc:816
    #3 0x42979a in heif::HeifContext::Image::get_luma_bits_per_pixel() const ../../libheif/heif_context.cc:839
    #4 0x40c1a4 in heif_image_handle_get_luma_bits_per_pixel ../../libheif/heif.cc:455
    #5 0x4060fc in main ../../examples/heif_convert.cc:209
    #6 0x7f1ac522d82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #7 0x404f68 in _start (/home/dungnguyen/PoCs/libheif_fd0c01d/heif-convert-asan+0x404f68)
~~~
Thanks, 
Manh Dung


Comments:
Comment by fancycode on 2019-08-02 12:55:00+00:00:
Thanks for reporting!

---

Comment by fgeek on 2021-07-26 15:04:36+00:00:
CVE-2020-19499 has been assigned for this issue.

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
export DEPS_PATH=$SRC/deps
mkdir -p $DEPS_PATH
cd $SRC/x265/build/linux
cmake -G "Unix Makefiles" \
    -DCMAKE_C_COMPILER=$CC -DCMAKE_CXX_COMPILER=$CXX \
    -DCMAKE_C_FLAGS="$CFLAGS" -DCMAKE_CXX_FLAGS="$CXXFLAGS" \
    -DCMAKE_INSTALL_PREFIX="$DEPS_PATH" \
    -DENABLE_SHARED:bool=off \
    ../../source
make clean -j$(nproc)
make -j$(nproc) x265-static
make install -j$(nproc)
cd $SRC/libde265
./autogen.sh
./configure \
    --prefix="$DEPS_PATH" \
    --disable-shared \
    --enable-static \
    --disable-dec265 \
    --disable-sherlock265 \
    --disable-hdrcopy \
    --disable-enc265 \
    --disable-acceleration_speed
make -j$(nproc)
cd $SRC/libheif
PKG_CONFIG="pkg-config --static" PKG_CONFIG_PATH="$DEPS_PATH/lib/pkgconfig" ./configure \
    --disable-examples \
    --disable-go \
    --enable-libfuzzer

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y autoconf automake build-essential cmake libtool make mercurial pkg-config yasm
RUN git clone https://github.com/strukturag/libheif libheif
RUN git -C libheif checkout 34e984a9d7589d97202c3c45385866191c573a58
WORKDIR $SRC/libheif
COPY build.sh $SRC/

Additional files:
Project: njs (nginx/njs), language: c++
Vulnerability instance: njs.cve-2023-27729
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/nginx/njs/issues/619
## Description:
Issue: nginx/njs#619
Title: illegal memcpy during njs_vmcode_return in src/njs_vmcode.c
State: closed
Created by: ret2ddme
Created at: 2023-02-24 08:36:06+00:00
Labels: bug

Issue Body:
This is new one, different from another
Poc will be upload later
Asan
```
==20795==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fd4936f313f bp 0x7ffd1d582440 sp 0x7ffd1d581bf8 T0)
==20795==The signal is caused by a WRITE memory access.
==20795==Hint: address points to the zero page.
    #0 0x7fd4936f313f in memcpy (/lib/x86_64-linux-gnu/libc.so.6+0xbb13f)
    #1 0x4983f1 in __asan_memcpy (/root/njs/build/njs+0x4983f1)
    #2 0x4f7295 in njs_vmcode_return /root/njs/src/njs_vmcode.c:2690:29
    #3 0x4f8857 in njs_vmcode_await /root/njs/src/njs_vmcode.c:2843:12
    #4 0x4e425b in njs_vmcode_interpreter /root/njs/src/njs_vmcode.c:1645:15
    #5 0x53f50c in njs_function_lambda_call /root/njs/src/njs_function.c:608:11
    #6 0x5e89e6 in njs_async_function_frame_invoke /root/njs/src/njs_async.c:32:11
    #7 0x53ef25 in njs_function_frame_invoke /root/njs/src/njs_function.c:688:16
    #8 0x4e77c2 in njs_vmcode_interpreter /root/njs/src/njs_vmcode.c:1512:15
    #9 0x4de86a in njs_vm_start /root/njs/src/njs_vm.c:553:11
    #10 0x4cad73 in njs_process_script /root/njs/src/njs_shell.c:952:19
    #11 0x4cb556 in njs_process_file /root/njs/src/njs_shell.c:678:11
    #12 0x4c94be in main /root/njs/src/njs_shell.c:335:15
    #13 0x7fd493659c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
    #14 0x41f1d9 in _start (/root/njs/build/njs+0x41f1d9)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0xbb13f) in memcpy
```







Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./autogen.sh
CFLAGS="$CFLAGS -fno-use-cxa-atexit" CXXFLAGS="$CXXFLAGS -fno-use-cxa-atexit" ./configure
make -j$(nproc) clean
make -j$(nproc) all
make install -j$(nproc)
sed -i "s/\$libS\$libR \(-lpcre2-8$\)/\$libS\$libR -Wl,-Bstatic \1 -Wl,-Bdynamic/" /usr/local/bin/pcre2-config
./configure
make njs_fuzzer -j$(nproc)
mkdir -p $SEED_CORPUS_PATH

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool mercurial git libpcre2-dev
RUN git clone https://github.com/nginx/njs njs
RUN git -C njs checkout e946c8a942ead0ff6b56abc35cf3d5d5ede7f9c4
WORKDIR $SRC/njs
COPY build.sh $SRC/

Additional files:
Project: w3m (tats/w3m), language: c++
Vulnerability instance: w3m.cve-2016-9431
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/tats/w3m/issues/10
## Description:
Issue: tats/w3m#10
Title: stackoverflow in deleteFrameSet() on malform input
State: closed
Created by: kcwu
Created at: 2016-08-14 13:38:48+00:00

Issue Body:
How to reproduce:

```
echo '<U><frameset><frameset>0000000000000000000000000<button type=>000<i></button>00000000000000000000000000000000000000000000' | ./w3m -T text/html -dump
```

ASAN output:

```
ASAN:SIGSEGV
=================================================================
==3819287==ERROR: AddressSanitizer: stack-overflow on address 0x7ffd7abd6ff8 (pc 0x0000006331a5 bp 0x0000006b65e5 sp 0x7ffd7abd7000 T0)
    #0 0x6331a4  (/w3m/run/w3m.afl-asan+0x6331a4)
    #1 0x633330  (/w3m/run/w3m.afl-asan+0x633330)
    #2 0x633330  (/w3m/run/w3m.afl-asan+0x633330)
last line repeats....
```

This is found by afl-fuzz.



Comments:
Comment by tats on 2016-08-15 11:52:09+00:00:
Fixed, thank you.


Commit References:
0000000000000000000000000000000000000000

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure
make myctype.o -j$(nproc)
make Str.o -j$(nproc)
make libwc -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y libgc-dev
RUN git clone https://github.com/tats/w3m w3m
RUN git -C w3m checkout ce6fffae3d2b82eeef1cbec23a6f4849169f1211
WORKDIR $SRC/w3m
COPY build.sh $SRC/

Additional files:
Project: yara (virustotal/yara), language: c++
Vulnerability instance: yara.cve-2017-8294
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/VirusTotal/yara/issues/646
## Description:
Issue: VirusTotal/yara#646
Title: Out of bounds read in yr_re_exec()
State: closed
Created by: fumfel
Created at: 2017-04-26 05:33:55+00:00

Issue Body:
**Out of bounds read in yr_re_exec()**

Git HEAD: dac45955053e3650f9407e4bc50482bf025fb15e

[Payload](https://github.com/VirusTotal/yara/files/957305/yara_oobr_yr_re_exec.txt)

Command: `yara yara_oobr_yr_re_exec strings`

ASAN:

```
==2886==ERROR: AddressSanitizer: SEGV on unknown address 0x7fd0b5d63fff (pc 0x00000051eb38 bp 0x7ffc623d3ad0 sp 0x7ffc623d3900 T0)
==2886==The signal is caused by a READ memory access.
    #0 0x51eb37 in yr_re_exec XYZ/yara/libyara/re.c:2037:20
    #1 0x53da37 in _yr_scan_verify_re_match XYZ/yara/libyara/scan.c:580:23
    #2 0x53ed63 in yr_scan_verify_match XYZ/yara/libyara/scan.c:762:5
    #3 0x53678f in _yr_rules_scan_mem_block XYZ/yara/libyara/rules.c:276:9
    #4 0x538242 in yr_rules_scan_mem_blocks XYZ/yara/libyara/rules.c:452:5
    #5 0x53909b in yr_rules_scan_mem XYZ/yara/libyara/rules.c:586:10
    #6 0x53909b in yr_rules_scan_file XYZ/yara/libyara/rules.c:610
    #7 0x4f9143 in main XYZ/yara/yara.c:1229:14
    #8 0x7fd0b499d82f in __libc_start_main /build/glibc-9tT8Do/glibc-2.23/csu/../csu/libc-start.c:291
    #9 0x41a858 in _start (XYZ/yara/yara+0x41a858)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV XYZ/yara/libyara/re.c:2037:20 in yr_re_exec
==2886==ABORTING
```


Comments:
Comment by carnil on 2017-04-28 05:58:38+00:00:
This issue has been assigned [CVE-2017-8294](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8294)

Attachments:
https://github.com/VirusTotal/yara/files/957305/yara_oobr_yr_re_exec.txt

Commit References:
dac45955053e3650f9407e4bc50482bf025fb15e

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./bootstrap.sh
./configure --enable-macho --enable-debug --enable-dex --enable-dotnet --without-crypto
make clean -j$(nproc)
make -j$(nproc) all
make install -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y automake autoconf make libtool pkg-config bison flex
RUN git clone https://github.com/virustotal/yara yara
RUN git -C yara checkout f12262c21f0c98fec0647de0c3e76c0c55961d78
WORKDIR $SRC/yara
COPY build.sh $SRC/

Additional files:
Project: libredwg (libredwg/libredwg), language: c++
Vulnerability instance: libredwg.cve-2020-21835
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/LibreDWG/libredwg/issues/188#issuecomment-574493046
## Description:
Issue: LibreDWG/libredwg#188
Title: Several bugs found by fuzzing
Referenced comment by linhlhq on 2020-01-15 04:41:13+00:00:

**7.NULL pointer dereference in read_2004_compressed_section ../../src/decode.c:2337**
POC: https://github.com/linhlhq/research/blob/master/PoCs/libreDWG_4c26d37/id:000036%2Csig:06%2Csrc:004273%2Cop:havoc%2Crep:8

```
=================================================================
==15970==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x55e389e038c1 bp 0x000000000000 sp 0x7ffe410ebab0 T0)
==15970==The signal is caused by a READ memory access.
==15970==Hint: address points to the zero page.
    #0 0x55e389e038c0 in read_2004_compressed_section ../../src/decode.c:2337
    #1 0x55e38a3cb81f in read_2004_section_template ../../src/decode.c:3136
    #2 0x55e38a3cb81f in decode_R2004 ../../src/decode.c:3365
    #3 0x55e38a3d908d in dwg_decode ../../src/decode.c:246
    #4 0x55e389d6bfae in dwg_read_file ../../src/dwg.c:211
    #5 0x55e389d6a9d0 in get_bmp ../../programs/dwgbmp.c:111
    #6 0x55e389d6a066 in main ../../programs/dwgbmp.c:280
    #7 0x7f67aa354b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #8 0x55e389d6a6c9 in _start (/home/user/linhlhq/libredwg/asan_build/programs/dwgbmp+0x28f6c9)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ../../src/decode.c:2337 in read_2004_compressed_section
==15970==ABORTING
```

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
sh ./autogen.sh
./configure --disable-shared
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y autoconf libtool texinfo
RUN git clone https://github.com/libredwg/libredwg libredwg
RUN git -C libredwg checkout d5a51c01023d5585ddf3dd17c83dbb3c81efc97e
WORKDIR $SRC/libredwg
COPY build.sh $SRC/

Additional files:
filename: fuzz_dwg_decode.options
content: [libfuzzer]
detect_leaks=0
Project: gpac (gpac/gpac), language: c++
Vulnerability instance: gpac.cve-2023-42298
Sanitizer: undefined

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/gpac/gpac/issues/2567
## Description:
Issue: gpac/gpac#2567
Title: Integer overflow issue in bifs/unquantize.c:298
State: closed
Created by: xiaoxiaoafeifei
Created at: 2023-08-29 07:37:50+00:00

Issue Body:
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [Y] I looked for a similar issue and couldn't find any.
- [Y] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [Y] I give enough information for contributors to reproduce my issue

**Description**
There is a integer overflow issue in bifs/unquantize.c:298

**System info**
Ubuntu 22.04.2 LTS
GPAC-2.2.1

**Build command**
./configure --enable-sanitizer && make

**crash command**
/usr/local/bin/MP4Box -xmt poc

**poc_file:**
[poc.zip](https://github.com/gpac/gpac/files/12461532/poc.zip)

**Crash output:**
[iso file] Unknown box type vref in parent dinf
[iso file] Missing dref box in dinf
[iso file] Incomplete box - start 2637
[iso file] Incomplete file while reading for dump - aborting parsing
[iso file] Unknown box type vref in parent dinf
[iso file] Missing dref box in dinf
[iso file] Incomplete box - start 2637
[iso file] Incomplete file while reading for dump - aborting parsing
MPEG-4 BIFS Scene Parsing
bifs/unquantize.c:298:43: runtime error: shift exponent 4294967295 is too large for 32-bit type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior bifs/unquantize.c:298:43 in


Comments:
Comment by xiaoxiaoafeifei on 2023-10-11 01:29:17+00:00:
[AFFECTED AND/OR FIXED VERSION(S)]
AFFECTED VERSION: gpac - version <= 2.2.1
FIXED VERSION:  current master branch (patch: https://github.com/gpac/gpac/pull/2568)

[PROBLEM TYPE] – must contain at least one: Vulnerability Type, Root Cause, or Impact:
Vulnerability Type: Integer Overflow
Impact: Denial of Service

[DESCRIPTION]
An issue in GPAC GPAC v.2.2.1 and before allows a local attacker to cause a denial of service via the Q_DecCoordOnUnitSphere function of file src/bifs/unquantize.c 

This issue was assigned CVE-2023-42298

Attachments:
https://github.com/gpac/gpac/files/12461532/poc.zip

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure --static-build --extra-cflags="${CFLAGS}" --extra-ldflags="${CFLAGS}"
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y build-essential pkg-config libz-dev
RUN git clone https://github.com/gpac/gpac gpac
RUN git -C gpac checkout b34e3851670f4398a4e2efcb86b30a8b07743212
WORKDIR $SRC/gpac
COPY build.sh $SRC/

Additional files: