db-d2/primevul-codebert-embeddings huggingface dataset:
Commit message: None
CVE: CVE-2017-0819
CWE: CWE-682
Vulnerability description: A vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63045918.

Project: Android

static UWORD32 ihevcd_map_error(IHEVCD_ERROR_T e_error)
{
    UWORD32 error_code = 0;
    error_code = e_error;
 switch(error_code)
 {
 case IHEVCD_SUCCESS :
 break;
 case IHEVCD_INIT_NOT_DONE:
 case IHEVCD_LEVEL_UNSUPPORTED:
 case IHEVCD_NUM_REF_UNSUPPORTED:
 case IHEVCD_NUM_REORDER_UNSUPPORTED:
 case IHEVCD_NUM_EXTRA_DISP_UNSUPPORTED:
 case IHEVCD_INSUFFICIENT_MEM_MVBANK:
 case IHEVCD_INSUFFICIENT_MEM_PICBUF:
            error_code |= 1 << IVD_FATALERROR;
 break;
 case IHEVCD_INVALID_DISP_STRD:
 case IHEVCD_CXA_VERS_BUF_INSUFFICIENT:
 case IHEVCD_UNSUPPORTED_VPS_ID:
 case IHEVCD_UNSUPPORTED_SPS_ID:
 case IHEVCD_UNSUPPORTED_PPS_ID:
 case IHEVCD_UNSUPPORTED_CHROMA_FMT_IDC:
 case IHEVCD_UNSUPPORTED_BIT_DEPTH:
 case IHEVCD_BUF_MGR_ERROR:
 case IHEVCD_NO_FREE_MVBANK:
 case IHEVCD_NO_FREE_PICBUF:
 case IHEVCD_SLICE_IN_HEADER_MODE:
 case IHEVCD_END_OF_SEQUENCE:
 break;
 default:
 break;
 }
 return error_code;
}
Commit message: None
CVE: CVE-2017-0809
CWE: CWE-119
Vulnerability description: A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62673128.

Project: Android

static char encode6Bit(unsigned x) {
 if (x <= 25) {
 return 'A' + x;
 } else if (x <= 51) {
 return 'a' + x - 26;
 } else if (x <= 61) {
 return '0' + x - 52;
 } else if (x == 62) {
 return '+';
 } else {
 return '/';
 }
}

Project: Android

void encodeBase64(
 const void *_data, size_t size, AString *out) {
    out->clear();

 const uint8_t *data = (const uint8_t *)_data;

 size_t i;
 for (i = 0; i < (size / 3) * 3; i += 3) {
 uint8_t x1 = data[i];
 uint8_t x2 = data[i + 1];
 uint8_t x3 = data[i + 2];

        out->append(encode6Bit(x1 >> 2));
        out->append(encode6Bit((x1 << 4 | x2 >> 4) & 0x3f));
        out->append(encode6Bit((x2 << 2 | x3 >> 6) & 0x3f));
        out->append(encode6Bit(x3 & 0x3f));
 }
 switch (size % 3) {
 case 0:
 break;
 case 2:
 {
 uint8_t x1 = data[i];
 uint8_t x2 = data[i + 1];
            out->append(encode6Bit(x1 >> 2));
            out->append(encode6Bit((x1 << 4 | x2 >> 4) & 0x3f));
            out->append(encode6Bit((x2 << 2) & 0x3f));
            out->append('=');
 break;
 }
 default:
 {
 uint8_t x1 = data[i];
            out->append(encode6Bit(x1 >> 2));
            out->append(encode6Bit((x1 << 4) & 0x3f));
            out->append("==");
 break;
 }
 }
}
Commit message: None
CVE: CVE-2017-0539
CWE: CWE-119
Vulnerability description: A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33864300.

Project: Android

void ihevcd_copy_pps(codec_t *ps_codec, WORD32 pps_id, WORD32 pps_id_ref)
{
 pps_t *ps_pps, *ps_pps_ref;
    WORD16 *pi2_scaling_mat_backup;
    WORD32 scaling_mat_size;
 tile_t *ps_tile_backup;
    WORD32 max_tile_cols, max_tile_rows;

    SCALING_MAT_SIZE(scaling_mat_size);
    max_tile_cols = (ps_codec->i4_max_wd + MIN_TILE_WD - 1) / MIN_TILE_WD;
    max_tile_rows = (ps_codec->i4_max_ht + MIN_TILE_HT - 1) / MIN_TILE_HT;

    ps_pps_ref = ps_codec->ps_pps_base + pps_id_ref;
    ps_pps = ps_codec->ps_pps_base + pps_id;

    pi2_scaling_mat_backup = ps_pps->pi2_scaling_mat;
    ps_tile_backup = ps_pps->ps_tile;

    memcpy(ps_pps, ps_pps_ref, sizeof(pps_t));
    ps_pps->pi2_scaling_mat = pi2_scaling_mat_backup;
    ps_pps->ps_tile = ps_tile_backup;
    memcpy(ps_pps->pi2_scaling_mat, ps_pps_ref->pi2_scaling_mat, scaling_mat_size * sizeof(WORD16));
    memcpy(ps_pps->ps_tile, ps_pps_ref->ps_tile, max_tile_cols * max_tile_rows * sizeof(tile_t));

    ps_pps->i1_pps_valid = 1;

    ps_codec->s_parse.ps_pps = ps_pps;
}
Commit message: None
CVE: CVE-2017-0392
Vulnerability description: A denial of service vulnerability in VBRISeeker.cpp in libstagefright in Mediaserver could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32577290.

Project: Android

static uint32_t U24_AT(const uint8_t *ptr) {
 return ptr[0] << 16 | ptr[1] << 8 | ptr[2];
}

Project: Android

VBRISeeker::VBRISeeker()
 : mDurationUs(-1) {
}

Project: Android

bool VBRISeeker::getDuration(int64_t *durationUs) {
 if (mDurationUs < 0) {
 return false;
 }

 *durationUs = mDurationUs;

 return true;
}

Project: Android

bool VBRISeeker::getOffsetForTime(int64_t *timeUs, off64_t *pos) {
 if (mDurationUs < 0 || mSegments.size() == 0) {
 return false;
 }

 int64_t segmentDurationUs = mDurationUs / mSegments.size();

 int64_t nowUs = 0;
 *pos = mBasePos;
 size_t segmentIndex = 0;
 while (segmentIndex < mSegments.size() && nowUs < *timeUs) {
        nowUs += segmentDurationUs;
 *pos += mSegments.itemAt(segmentIndex++);
 }

    ALOGV("getOffsetForTime %lld us => 0x%016llx", (long long)*timeUs, (long long)*pos);

 *timeUs = nowUs;

 return true;
}
Commit message: None
CVE: CVE-2015-1529
CWE: CWE-190
Vulnerability description: Integer overflow in soundtrigger/ISoundTriggerHwService.cpp in Android allows attacks to cause a denial of service via unspecified vectors.

Project: Android

 BpSoundTriggerHwService(const sp<IBinder>& impl)
 : BpInterface<ISoundTriggerHwService>(impl)
 {
 }

Project: Android

 virtual status_t attach(const sound_trigger_module_handle_t handle,
 const sp<ISoundTriggerClient>& client,
                            sp<ISoundTrigger>& module)
 {
 Parcel data, reply;
        data.writeInterfaceToken(ISoundTriggerHwService::getInterfaceDescriptor());
        data.write(&handle, sizeof(sound_trigger_module_handle_t));
        data.writeStrongBinder(IInterface::asBinder(client));
        remote()->transact(ATTACH, data, &reply);
 status_t status = reply.readInt32();
 if (reply.readInt32() != 0) {
            module = interface_cast<ISoundTrigger>(reply.readStrongBinder());
 }
 return status;
 }

Project: Android

 virtual status_t listModules(struct sound_trigger_module_descriptor *modules,
 uint32_t *numModules)
 {
 if (numModules == NULL || (*numModules != 0 && modules == NULL)) {
 return BAD_VALUE;
 }
 Parcel data, reply;
        data.writeInterfaceToken(ISoundTriggerHwService::getInterfaceDescriptor());
 unsigned int numModulesReq = (modules == NULL) ? 0 : *numModules;
        data.writeInt32(numModulesReq);
 status_t status = remote()->transact(LIST_MODULES, data, &reply);
 if (status == NO_ERROR) {
            status = (status_t)reply.readInt32();
 *numModules = (unsigned int)reply.readInt32();
 }
        ALOGV("listModules() status %d got *numModules %d", status, *numModules);
 if (status == NO_ERROR) {
 if (numModulesReq > *numModules) {
                numModulesReq = *numModules;
 }
 if (numModulesReq > 0) {
                reply.read(modules, numModulesReq * sizeof(struct sound_trigger_module_descriptor));
 }
 }
 return status;
 }

Project: Android

 virtual status_t setCaptureState(bool active)
 {
 Parcel data, reply;
        data.writeInterfaceToken(ISoundTriggerHwService::getInterfaceDescriptor());
        data.writeInt32(active);
 status_t status = remote()->transact(SET_CAPTURE_STATE, data, &reply);
 if (status == NO_ERROR) {
            status = reply.readInt32();
 }
 return status;
 }
Commit message: None
CVE: CVE-2018-9499
CWE: CWE-200
Vulnerability description: In readVector of iCrypto.cpp, there is a possible invalid read due to uninitialized data. This could lead to local information disclosure from the DRM server with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-79218474

Project: Android

 explicit BpCrypto(const sp<IBinder> &impl)
 : BpInterface<ICrypto>(impl) {
 }

Project: Android

 virtual ssize_t decrypt(const uint8_t key[16], const uint8_t iv[16],
 CryptoPlugin::Mode mode, const CryptoPlugin::Pattern &pattern,
 const SourceBuffer &source, size_t offset,
 const CryptoPlugin::SubSample *subSamples, size_t numSubSamples,
 const DestinationBuffer &destination, AString *errorDetailMsg) {
 Parcel data, reply;
        data.writeInterfaceToken(ICrypto::getInterfaceDescriptor());
        data.writeInt32(mode);
        data.writeInt32(pattern.mEncryptBlocks);
        data.writeInt32(pattern.mSkipBlocks);

 static const uint8_t kDummy[16] = { 0 };

 if (key == NULL) {
            key = kDummy;
 }

 if (iv == NULL) {
            iv = kDummy;
 }

        data.write(key, 16);
        data.write(iv, 16);

 size_t totalSize = 0;
 for (size_t i = 0; i < numSubSamples; ++i) {
            totalSize += subSamples[i].mNumBytesOfEncryptedData;
            totalSize += subSamples[i].mNumBytesOfClearData;
 }

        data.writeInt32(totalSize);
        data.writeStrongBinder(IInterface::asBinder(source.mSharedMemory));
        data.writeInt32(source.mHeapSeqNum);
        data.writeInt32(offset);

        data.writeInt32(numSubSamples);
        data.write(subSamples, sizeof(CryptoPlugin::SubSample) * numSubSamples);

        data.writeInt32((int32_t)destination.mType);
 if (destination.mType == kDestinationTypeNativeHandle) {
 if (destination.mHandle == NULL) {
 return BAD_VALUE;
 }
            data.writeNativeHandle(destination.mHandle);
 } else {
 if (destination.mSharedMemory == NULL) {
 return BAD_VALUE;
 }
            data.writeStrongBinder(IInterface::asBinder(destination.mSharedMemory));
 }

        remote()->transact(DECRYPT, data, &reply);

 ssize_t result = reply.readInt32();

 if (isCryptoError(result)) {
 AString msg = reply.readCString();
 if (errorDetailMsg) {
 *errorDetailMsg = msg;
 }
 }

 return result;
 }

Project: Android

 virtual int32_t setHeap(const sp<IMemoryHeap> &heap) {
 Parcel data, reply;
        data.writeInterfaceToken(ICrypto::getInterfaceDescriptor());
        data.writeStrongBinder(IInterface::asBinder(heap));
 status_t err = remote()->transact(SET_HEAP, data, &reply);
 if (err != NO_ERROR) {
 return -1;
 }
 int32_t seqNum;
 if (reply.readInt32(&seqNum) != NO_ERROR) {
 return -1;
 }
 return seqNum;
 }

Project: Android

 virtual void unsetHeap(int32_t seqNum) {
 Parcel data, reply;
        data.writeInterfaceToken(ICrypto::getInterfaceDescriptor());
        data.writeInt32(seqNum);
        remote()->transact(UNSET_HEAP, data, &reply);
 return;
 }
Commit message: None
CVE: CVE-2017-13200
CWE: CWE-200
Vulnerability description: An information disclosure vulnerability in the Android media framework (av) related to id3 unsynchronization. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-63100526.

Project: Android

void ID3::Iterator::getstring(String8 *id, bool otherdata) const {
    id->setTo("");

 const uint8_t *frameData = mFrameData;
 if (frameData == NULL) {
 return;
 }

 uint8_t encoding = *frameData;

 if (mParent.mVersion == ID3_V1 || mParent.mVersion == ID3_V1_1) {
 if (mOffset == 126 || mOffset == 127) {
 char tmp[16];
            snprintf(tmp, sizeof(tmp), "%d", (int)*frameData);

            id->setTo(tmp);
 return;
 }

        id->setTo((const char*)frameData, mFrameSize);
 return;
 }

 if (mFrameSize < getHeaderLength() + 1) {
 return;
 }
 size_t n = mFrameSize - getHeaderLength() - 1;
 if (otherdata) {
 if (n < 5) {
 return;
 }
        frameData += 4;
 int32_t i = n - 4;
 while(--i >= 0 && *++frameData != 0) ;
 int skipped = (frameData - mFrameData);
 if (skipped >= (int)n) {
 return;
 }
        n -= skipped;
 }

 if (n <= 0) {
 return;
 }

 if (encoding == 0x00) {
        id->setTo((const char*)frameData + 1, n);
 } else if (encoding == 0x03) {
        id->setTo((const char *)(frameData + 1), n);
 } else if (encoding == 0x02) {
 int len = n / 2;
 const char16_t *framedata = (const char16_t *) (frameData + 1);
 char16_t *framedatacopy = NULL;
#if BYTE_ORDER == LITTLE_ENDIAN
 if (len > 0) {
            framedatacopy = new (std::nothrow) char16_t[len];
 if (framedatacopy == NULL) {
 return;
 }
 for (int i = 0; i < len; i++) {
                framedatacopy[i] = bswap_16(framedata[i]);
 }
            framedata = framedatacopy;
 }
#endif
        id->setTo(framedata, len);
 if (framedatacopy != NULL) {
 delete[] framedatacopy;
 }
 } else if (encoding == 0x01) {
 int len = n / 2;
 const char16_t *framedata = (const char16_t *) (frameData + 1);
 char16_t *framedatacopy = NULL;
 if (*framedata == 0xfffe) {
 if (len <= 1) {
 return; // nothing after the marker
 }
            framedatacopy = new (std::nothrow) char16_t[len];
 if (framedatacopy == NULL) {
 return;
 }
 for (int i = 0; i < len; i++) {
                framedatacopy[i] = bswap_16(framedata[i]);
 }
            framedata = framedatacopy;
            framedata++;
            len--;
 } else if (*framedata == 0xfeff) {
 if (len <= 1) {
 return; // nothing after the marker
 }
            framedata++;
            len--;
 }

 bool eightBit = true;
 for (int i = 0; i < len; i++) {
 if (framedata[i] > 0xff) {
                eightBit = false;
 break;
 }
 }
 if (eightBit) {
 char *frame8 = new (std::nothrow) char[len];
 if (frame8 != NULL) {
 for (int i = 0; i < len; i++) {
                    frame8[i] = framedata[i];
 }
                id->setTo(frame8, len);
 delete [] frame8;
 } else {
                id->setTo(framedata, len);
 }
 } else {
            id->setTo(framedata, len);
 }

 if (framedatacopy != NULL) {
 delete[] framedatacopy;
 }
 }
}
Commit message: None
CVE: CVE-2015-1528
CWE: CWE-189
Vulnerability description: Integer overflow in the native_handle_create function in libcutils/native_handle.c in Android before 5.1.1 LMY48M allows attackers to obtain a different application's privileges or cause a denial of service (Binder heap memory corruption) via a crafted application, aka internal bug 19334482.

Project: Android

int native_handle_close(const native_handle_t* h)
{
 if (h->version != sizeof(native_handle_t))
 return -EINVAL;

 const int numFds = h->numFds;
 int i;
 for (i=0 ; i<numFds ; i++) {
        close(h->data[i]);
 }
 return 0;
}

Project: Android

int native_handle_delete(native_handle_t* h)
{
 if (h) {
 if (h->version != sizeof(native_handle_t))
 return -EINVAL;
        free(h);
 }
 return 0;
}
Commit message: None
CVE: CVE-2016-6720
CWE: CWE-200
Vulnerability description: An information disclosure vulnerability in libstagefright in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7.0 before 2016-11-01 could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Android ID: A-29422020.

Project: Android

void OMXNodeInstance::onEvent(
        OMX_EVENTTYPE event, OMX_U32 arg1, OMX_U32 arg2) {
 const char *arg1String = "??";
 const char *arg2String = "??";
 ADebug::Level level = ADebug::kDebugInternalState;

 switch (event) {
 case OMX_EventCmdComplete:
            arg1String = asString((OMX_COMMANDTYPE)arg1);
 switch (arg1) {
 case OMX_CommandStateSet:
                    arg2String = asString((OMX_STATETYPE)arg2);
                    level = ADebug::kDebugState;
 break;
 case OMX_CommandFlush:
 case OMX_CommandPortEnable:
 {
 Mutex::Autolock _l(mDebugLock);
                    bumpDebugLevel_l(2 /* numInputBuffers */, 2 /* numOutputBuffers */);
 }
 default:
                    arg2String = portString(arg2);
 }
 break;
 case OMX_EventError:
            arg1String = asString((OMX_ERRORTYPE)arg1);
            level = ADebug::kDebugLifeCycle;
 break;
 case OMX_EventPortSettingsChanged:
            arg2String = asString((OMX_INDEXEXTTYPE)arg2);
 default:
            arg1String = portString(arg1);
 }

    CLOGI_(level, onEvent, "%s(%x), %s(%x), %s(%x)",
            asString(event), event, arg1String, arg1, arg2String, arg2);
 const sp<GraphicBufferSource>& bufferSource(getGraphicBufferSource());

 if (bufferSource != NULL
 && event == OMX_EventCmdComplete
 && arg1 == OMX_CommandStateSet
 && arg2 == OMX_StateExecuting) {
        bufferSource->omxExecuting();
 }

 if (event == OMX_EventCmdComplete
 && arg1 == OMX_CommandStateSet
 && arg2 == OMX_StateLoaded) {
        mSailed = false;
 }
}
Commit message: None
CVE: CVE-2016-2416
CWE: CWE-264
Vulnerability description: libs/gui/BufferQueueConsumer.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check for the android.permission.DUMP permission, which allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via a dump request, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27046057.

Project: Android

 BufferQueueConsumer::BufferQueueConsumer(const sp<BufferQueueCore>& core) :
    mCore(core),
    mSlots(core->mSlots),
    mConsumerName() {}

Project: Android

sp<NativeHandle> BufferQueueConsumer::getSidebandStream() const {
 return mCore->mSidebandStream;

 }
Commit message: Use version in SSL_METHOD not SSL structure.

When deciding whether to use TLS 1.2 PRF and record hash algorithms
use the version number in the corresponding SSL_METHOD structure
instead of the SSL structure. The SSL structure version is sometimes
inaccurate. Note: OpenSSL 1.0.2 and later effectively do this already.
(CVE-2013-6449)
CVE: CVE-2013-6449
CWE: CWE-310
Vulnerability description: The ssl_get_algorithm2 function in ssl/s3_lib.c in OpenSSL before 1.0.2 obtains a certain version number from an incorrect data structure, which allows remote attackers to cause a denial of service (daemon crash) via crafted traffic from a TLS 1.2 client.

Project: openssl

 long ssl_get_algorithm2(SSL *s)
        {
        long alg2 = s->s3->tmp.new_cipher->algorithm2;
       if (s->method->version == TLS1_2_VERSION &&
            alg2 == (SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF))
                return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256;
        return alg2;
	}
Commit message: None
CVE: CVE-2011-4128
CWE: CWE-119
Vulnerability description: Buffer overflow in the gnutls_session_get_data function in lib/gnutls_session.c in GnuTLS 2.12.x before 2.12.14 and 3.x before 3.0.7, when used on a client that performs nonstandard session resumption, allows remote TLS servers to cause a denial of service (application crash) via a large SessionTicket.

Project: savannah
File: gnutls_session.c

gnutls_session_get_data (gnutls_session_t session,
                         void *session_data, size_t * session_data_size)
{

  gnutls_datum_t psession;
  int ret;

  if (session->internals.resumable == RESUME_FALSE)
    return GNUTLS_E_INVALID_SESSION;

  psession.data = session_data;

  ret = _gnutls_session_pack (session, &psession);
  if (ret < 0)
    {
       gnutls_assert ();
       return ret;
     }
 
   if (psession.size > *session_data_size)
     {
       ret = GNUTLS_E_SHORT_MEMORY_BUFFER;
       goto error;
     }
  *session_data_size = psession.size;
 
   if (session_data != NULL)
     memcpy (session_data, psession.data, psession.size);

  ret = 0;

error:
  _gnutls_free_datum (&psession);
  return ret;
}
Commit message: None
CVE: CVE-2011-4128
CWE: CWE-119
Vulnerability description: Buffer overflow in the gnutls_session_get_data function in lib/gnutls_session.c in GnuTLS 2.12.x before 2.12.14 and 3.x before 3.0.7, when used on a client that performs nonstandard session resumption, allows remote TLS servers to cause a denial of service (application crash) via a large SessionTicket.

Project: savannah

gnutls_session_get_data (gnutls_session_t session,
                         void *session_data, size_t * session_data_size)
{

  gnutls_datum_t psession;
  int ret;

  if (session->internals.resumable == RESUME_FALSE)
    return GNUTLS_E_INVALID_SESSION;

  psession.data = session_data;

  ret = _gnutls_session_pack (session, &psession);
  if (ret < 0)
    {
      gnutls_assert ();
      return ret;
    }
 
   if (psession.size > *session_data_size)
     {
      *session_data_size = psession.size;
       ret = GNUTLS_E_SHORT_MEMORY_BUFFER;
       goto error;
     }

  if (session_data != NULL)
    memcpy (session_data, psession.data, psession.size);

  ret = 0;

error:
  _gnutls_free_datum (&psession);
  return ret;
}
Commit message: BUG: dns: Prevent stack-exhaustion via recursion loop in dns_read_name

When a compressed pointer is encountered, dns_read_name() will call
itself with the pointed-to offset in the packet.
With a specially crafted packet, it was possible to trigger an
infinite-loop recursion by making the pointer points to itself.
While it would be possible to handle that particular case differently
by making sure that the target is different from the current offset,
it would still be possible to craft a packet with a very long chain
of valid pointers, always pointing backwards. To prevent a stack
exhaustion in that case, this patch restricts the number of recursive
calls to 100, which should be more than enough.

To be backported to 1.8, probably also 1.7.
CVE: CVE-2018-20103
CWE: CWE-835
Vulnerability description: An issue was discovered in dns.c in HAProxy through 1.8.14. In the case of a compressed pointer, a crafted packet can trigger infinite recursion by making the pointer point to itself, or create a long chain of valid pointers resulting in stack exhaustion.

Project: haproxy

 int dns_read_name(unsigned char *buffer, unsigned char *bufend,
                  unsigned char *name, char *destination, int dest_len,
                 int *offset, unsigned int depth)
 {
        int nb_bytes = 0, n = 0;
        int label_len;
	unsigned char *reader = name;
	char *dest = destination;

	while (1) {
		/* Name compression is in use */
		if ((*reader & 0xc0) == 0xc0) {
			/* Must point BEFORE current position */
                        if ((buffer + reader[1]) > reader)
                                goto err;
 
                       if (depth++ > 100)
                               goto err;

                        n = dns_read_name(buffer, bufend, buffer + reader[1],
                                         dest, dest_len - nb_bytes, offset, depth);
                        if (n == 0)
                                goto err;
 
		}

		label_len = *reader;
		if (label_len == 0)
			goto out;

		/* Check if:
		 *  - we won't read outside the buffer
		 *  - there is enough place in the destination
		 */
		if ((reader + label_len >= bufend) || (nb_bytes + label_len >= dest_len))
			goto err;

		/* +1 to take label len + label string */
		label_len++;

		memcpy(dest, reader, label_len);

		dest     += label_len;
		nb_bytes += label_len;
		reader   += label_len;
	}

  out:
	/* offset computation:
	 * parse from <name> until finding either NULL or a pointer "c0xx"
	 */
	reader  = name;
	*offset = 0;
	while (reader < bufend) {
		if ((reader[0] & 0xc0) == 0xc0) {
			*offset += 2;
			break;
		}
		else if (*reader == 0) {
			*offset += 1;
			break;
		}
		*offset += 1;
		++reader;
	}
	return nb_bytes;

  err:
	return 0;
}