db-d2/primevul-codebert-embeddings huggingface dataset:
Commit message: None
CVE: CVE-2018-16074
CWE: CWE-285
Vulnerability description: Insufficient policy enforcement in site isolation in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass site isolation via a crafted HTML page.

Project: Chrome

GURL SiteInstance::GetSiteForURL(BrowserContext* browser_context,
                                 const GURL& real_url) {
  if (real_url.SchemeIs(kGuestScheme))
    return real_url;

  GURL url = SiteInstanceImpl::GetEffectiveURL(browser_context, real_url);
  url::Origin origin = url::Origin::Create(url);

  auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
  url::Origin isolated_origin;
  if (policy->GetMatchingIsolatedOrigin(origin, &isolated_origin))
    return isolated_origin.GetURL();

  if (!origin.host().empty() && origin.scheme() != url::kFileScheme) {
    std::string domain = net::registry_controlled_domains::GetDomainAndRegistry(
        origin.host(),
        net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES);
    std::string site = origin.scheme();
    site += url::kStandardSchemeSeparator;
    site += domain.empty() ? origin.host() : domain;
    return GURL(site);
  }

   if (!origin.unique()) {
     DCHECK(!origin.scheme().empty());
     return GURL(origin.scheme() + ":");
   } else if (url.has_scheme()) {
     DCHECK(!url.scheme().empty());
     return GURL(url.scheme() + ":");
   }

  DCHECK(!url.is_valid()) << url;
  return GURL();
}
Commit message: None
CVE: CVE-2018-16081
CWE: CWE-862
Vulnerability description: Allowing the chrome.debugger API to run on file:// URLs in DevTools in Google Chrome prior to 69.0.3497.81 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system without file access permission via a crafted Chrome Extension.

Project: Chrome

bool PlatformFontSkia::InitDefaultFont() {
  if (g_default_font.Get())
    return true;
 
   bool success = false;
   std::string family = kFallbackFontFamilyName;
  int size_pixels = 12;
   int style = Font::NORMAL;
   Font::Weight weight = Font::Weight::NORMAL;
   FontRenderParams params;

  const SkiaFontDelegate* delegate = SkiaFontDelegate::instance();
  if (delegate) {
    delegate->GetDefaultFontDescription(&family, &size_pixels, &style, &weight,
                                        &params);
  } else if (default_font_description_) {
#if defined(OS_CHROMEOS)
    FontRenderParamsQuery query;
    CHECK(FontList::ParseDescription(*default_font_description_,
                                     &query.families, &query.style,
                                     &query.pixel_size, &query.weight))
        << "Failed to parse font description " << *default_font_description_;
    params = gfx::GetFontRenderParams(query, &family);
    size_pixels = query.pixel_size;
    style = query.style;
    weight = query.weight;
#else
    NOTREACHED();
#endif
  }

  sk_sp<SkTypeface> typeface =
      CreateSkTypeface(style & Font::ITALIC, weight, &family, &success);
  if (!success)
    return false;
  g_default_font.Get() = new PlatformFontSkia(
      std::move(typeface), family, size_pixels, style, weight, params);
  return true;
}
Commit message: None
CVE: CVE-2018-16086
CWE: CWE-285
Vulnerability description: Insufficient policy enforcement in extensions API in Google Chrome prior to 69.0.3497.81 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.

Project: Chrome

bool RendererPermissionsPolicyDelegate::IsRestrictedUrl(
    const GURL& document_url,
    std::string* error) {
  if (dispatcher_->IsExtensionActive(kWebStoreAppId)) {
    if (error)
      *error = errors::kCannotScriptGallery;
     return true;
   }
 
  if (SearchBouncer::GetInstance()->IsNewTabPage(document_url)) {
     if (error)
       *error = errors::kCannotScriptNtp;
     return true;
  }

  return false;
}
Commit message: None
CVE: CVE-2018-6134
CWE: CWE-200
Vulnerability description: Information leak in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to bypass no-referrer policy via a crafted HTML page.

Project: Chrome

PerformanceNavigationTiming::PerformanceNavigationTiming(
    LocalFrame* frame,
     ResourceTimingInfo* info,
     TimeTicks time_origin,
     const WebVector<WebServerTimingInfo>& server_timing)
    : PerformanceResourceTiming(info ? info->InitialURL().GetString() : "",
                                "navigation",
                                time_origin,
                                server_timing),
       ContextClient(frame),
       resource_timing_info_(info) {
   DCHECK(frame);
  DCHECK(info);
}
Commit message: None
CVE: CVE-2018-6137
CWE: CWE-200
Vulnerability description: CSS Paint API in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

Project: Chrome

 scoped_refptr<Image> CSSPaintValue::GetImage(
     const ImageResourceObserver& client,
     const Document& document,
    const ComputedStyle&,
     const FloatSize& target_size) {
   if (!generator_) {
     generator_ = CSSPaintImageGenerator::Create(
         GetName(), document, paint_image_generator_observer_);
  }

  if (!ParseInputArguments(document))
    return nullptr;

  return generator_->Paint(client, RoundedIntSize(target_size),
                           parsed_input_arguments_);
}
Commit message: None
CVE: CVE-2018-6139
CWE: CWE-20
Vulnerability description: Insufficient target checks on the chrome.debugger API in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension.

Project: Chrome

bool RenderFrameDevToolsAgentHost::AttachSession(DevToolsSession* session) {
  if (session->restricted() && !IsFrameHostAllowedForRestrictedSessions())
    return false;
  session->SetRenderer(frame_host_ ? frame_host_->GetProcess()->GetID()
                                   : ChildProcessHost::kInvalidUniqueID,
                       frame_host_);

  protocol::EmulationHandler* emulation_handler =
      new protocol::EmulationHandler();
  session->AddHandler(base::WrapUnique(new protocol::BrowserHandler()));
  session->AddHandler(base::WrapUnique(new protocol::DOMHandler()));
  session->AddHandler(base::WrapUnique(emulation_handler));
  session->AddHandler(base::WrapUnique(new protocol::InputHandler()));
  session->AddHandler(base::WrapUnique(new protocol::InspectorHandler()));
  session->AddHandler(base::WrapUnique(new protocol::IOHandler(
      GetIOContext())));
  session->AddHandler(base::WrapUnique(new protocol::MemoryHandler()));
  session->AddHandler(base::WrapUnique(new protocol::NetworkHandler(GetId())));
   session->AddHandler(base::WrapUnique(new protocol::SchemaHandler()));
   session->AddHandler(base::WrapUnique(new protocol::ServiceWorkerHandler()));
   session->AddHandler(base::WrapUnique(new protocol::StorageHandler()));
  session->AddHandler(
      base::WrapUnique(new protocol::TargetHandler(false /* browser_only */)));
   session->AddHandler(base::WrapUnique(new protocol::TracingHandler(
       protocol::TracingHandler::Renderer,
       frame_tree_node_ ? frame_tree_node_->frame_tree_node_id() : 0,
      GetIOContext())));
  session->AddHandler(
      base::WrapUnique(new protocol::PageHandler(emulation_handler)));
  session->AddHandler(base::WrapUnique(new protocol::SecurityHandler()));

  if (EnsureAgent())
    session->AttachToAgent(agent_ptr_);

  if (sessions().size() == 1) {
    if (!base::FeatureList::IsEnabled(features::kVizDisplayCompositor) &&
        !base::FeatureList::IsEnabled(
            features::kUseVideoCaptureApiForDevToolsSnapshots)) {
      frame_trace_recorder_.reset(new DevToolsFrameTraceRecorder());
    }
    GrantPolicy();
#if defined(OS_ANDROID)
    GetWakeLock()->RequestWakeLock();
#endif
  }
  return true;
}
Commit message: None
CVE: CVE-2018-6143
CWE: CWE-125
Vulnerability description: Insufficient validation in V8 in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

Project: Chrome

void CredentialManagerImpl::OnProvisionalSaveComplete() {
  DCHECK(form_manager_);
  DCHECK(client_->IsSavingAndFillingEnabledForCurrentPage());
  const autofill::PasswordForm& form = form_manager_->pending_credentials();

  if (form_manager_->IsPendingCredentialsPublicSuffixMatch()) {
    form_manager_->Save();
    return;
  }

  if (!form.federation_origin.unique()) {
    for (auto* match : form_manager_->form_fetcher()->GetFederatedMatches()) {
      if (match->username_value == form.username_value &&
          match->federation_origin.IsSameOriginWith(form.federation_origin)) {
        form_manager_->Update(*match);
        return;
      }
    }
  } else if (!form_manager_->IsNewLogin()) {
    form_manager_->Update(*form_manager_->preferred_match());
     return;
   }
 
  client_->PromptUserToSaveOrUpdatePassword(std::move(form_manager_), false);
}
Commit message: None
CVE: CVE-2016-1672
CWE: CWE-284
Vulnerability description: The ModuleSystem::RequireForJsInner function in extensions/renderer/module_system.cc in the extension bindings in Google Chrome before 51.0.2704.63 mishandles properties, which allows remote attackers to conduct bindings-interception attacks and bypass the Same Origin Policy via unspecified vectors.

Project: Chrome

v8::Local<v8::Value> ModuleSystem::RequireForJsInner(
    v8::Local<v8::String> module_name) {
  v8::EscapableHandleScope handle_scope(GetIsolate());
  v8::Local<v8::Context> v8_context = context()->v8_context();
  v8::Context::Scope context_scope(v8_context);

  v8::Local<v8::Object> global(context()->v8_context()->Global());

  v8::Local<v8::Value> modules_value;
  if (!GetPrivate(global, kModulesField, &modules_value) ||
      modules_value->IsUndefined()) {
    Warn(GetIsolate(), "Extension view no longer exists");
    return v8::Undefined(GetIsolate());
  }
 
   v8::Local<v8::Object> modules(v8::Local<v8::Object>::Cast(modules_value));
   v8::Local<v8::Value> exports;
  if (!GetProperty(v8_context, modules, module_name, &exports) ||
       !exports->IsUndefined())
     return handle_scope.Escape(exports);
 
   exports = LoadModule(*v8::String::Utf8Value(module_name));
  SetProperty(v8_context, modules, module_name, exports);
   return handle_scope.Escape(exports);
 }
Commit message: None
CVE: CVE-2016-1686
CWE: CWE-119
Vulnerability description: The CPDF_DIBSource::CreateDecoder function in core/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp in PDFium, as used in Google Chrome before 51.0.2704.63, mishandles decoder-initialization failure, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document.

Project: Chrome

void InputConnectionImpl::CommitText(const base::string16& text,
                                     int new_cursor_pos) {
  StartStateUpdateTimer();

  std::string error;
  if (!ime_engine_->ClearComposition(input_context_id_, &error))
    LOG(ERROR) << "ClearComposition failed: error=\"" << error << "\"";

  if (IsControlChar(text)) {
    SendControlKeyEvent(text);
    return;
  }

   if (!ime_engine_->CommitText(input_context_id_,
                                base::UTF16ToUTF8(text).c_str(), &error))
     LOG(ERROR) << "CommitText failed: error=\"" << error << "\"";
 }
Commit message: None
CVE: CVE-2015-3845
CWE: CWE-264
Vulnerability description: The Parcel::appendFrom function in libs/binder/Parcel.cpp in Binder in Android before 5.1.1 LMY48M does not consider parcel boundaries during identification of binder objects in an append operation, which allows attackers to obtain a different application's privileges via a crafted application, aka internal bug 17312693.

Project: Android

status_t Parcel::appendFrom(const Parcel *parcel, size_t offset, size_t len)
{
 const sp<ProcessState> proc(ProcessState::self());
 status_t err;
 const uint8_t *data = parcel->mData;
 const binder_size_t *objects = parcel->mObjects;
 size_t size = parcel->mObjectsSize;
 int startPos = mDataPos;
 int firstIndex = -1, lastIndex = -2;

 if (len == 0) {
 return NO_ERROR;
 }

 if ((offset > parcel->mDataSize)
 || (len > parcel->mDataSize)
 || (offset + len > parcel->mDataSize)) {
 return BAD_VALUE;
 }


     for (int i = 0; i < (int) size; i++) {
         size_t off = objects[i];
        if ((off >= offset) && (off < offset + len)) {
             if (firstIndex == -1) {
                 firstIndex = i;
             }
            lastIndex = i;
 }
 }
 int numObjects = lastIndex - firstIndex + 1;

 if ((mDataSize+len) > mDataCapacity) {
        err = growData(len);
 if (err != NO_ERROR) {
 return err;
 }
 }

    memcpy(mData + mDataPos, data + offset, len);
    mDataPos += len;
    mDataSize += len;

    err = NO_ERROR;

 if (numObjects > 0) {
 if (mObjectsCapacity < mObjectsSize + numObjects) {
 int newSize = ((mObjectsSize + numObjects)*3)/2;
 binder_size_t *objects =
 (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));
 if (objects == (binder_size_t*)0) {
 return NO_MEMORY;
 }
            mObjects = objects;
            mObjectsCapacity = newSize;
 }

 int idx = mObjectsSize;
 for (int i = firstIndex; i <= lastIndex; i++) {
 size_t off = objects[i] - offset + startPos;
            mObjects[idx++] = off;
            mObjectsSize++;

            flat_binder_object* flat
 = reinterpret_cast<flat_binder_object*>(mData + off);
            acquire_object(proc, *flat, this);

 if (flat->type == BINDER_TYPE_FD) {
                flat->handle = dup(flat->handle);
                flat->cookie = 1;
                mHasFds = mFdsKnown = true;
 if (!mAllowFds) {
                    err = FDS_NOT_ALLOWED;
 }
 }
 }
 }

 return err;
}
Commit message: None
CVE: CVE-2015-3834
CWE: CWE-189
Vulnerability description: Multiple integer overflows in the BnHDCP::onTransact function in media/libmedia/IHDCP.cpp in libstagefright in Android before 5.1.1 LMY48I allow attackers to execute arbitrary code via a crafted application that uses HDCP encryption, leading to a heap-based buffer overflow, aka internal bug 20222489.

Project: Android

status_t BnHDCP::onTransact(
 uint32_t code, const Parcel &data, Parcel *reply, uint32_t flags) {
 switch (code) {
 case HDCP_SET_OBSERVER:
 {
            CHECK_INTERFACE(IHDCP, data, reply);

            sp<IHDCPObserver> observer =
                interface_cast<IHDCPObserver>(data.readStrongBinder());

            reply->writeInt32(setObserver(observer));
 return OK;
 }

 case HDCP_INIT_ASYNC:
 {
            CHECK_INTERFACE(IHDCP, data, reply);

 const char *host = data.readCString();
 unsigned port = data.readInt32();

            reply->writeInt32(initAsync(host, port));
 return OK;
 }

 case HDCP_SHUTDOWN_ASYNC:
 {
            CHECK_INTERFACE(IHDCP, data, reply);

            reply->writeInt32(shutdownAsync());
 return OK;
 }

 case HDCP_GET_CAPS:
 {
            CHECK_INTERFACE(IHDCP, data, reply);

            reply->writeInt32(getCaps());
 return OK;
 }


         case HDCP_ENCRYPT:
         {
             size_t size = data.readInt32();
 
            void *inData = malloc(2 * size);
             void *outData = (uint8_t *)inData + size;
 
             data.read(inData, size);

 uint32_t streamCTR = data.readInt32();
 uint64_t inputCTR;
 status_t err = encrypt(inData, size, streamCTR, &inputCTR, outData);

            reply->writeInt32(err);

 if (err == OK) {
                reply->writeInt64(inputCTR);
                reply->write(outData, size);
 }

            free(inData);
            inData = outData = NULL;

 return OK;
 }

 case HDCP_ENCRYPT_NATIVE:
 {
            CHECK_INTERFACE(IHDCP, data, reply);

            sp<GraphicBuffer> graphicBuffer = new GraphicBuffer();
            data.read(*graphicBuffer);
 size_t offset = data.readInt32();
 size_t size = data.readInt32();
 uint32_t streamCTR = data.readInt32();
 void *outData = malloc(size);
 uint64_t inputCTR;

 status_t err = encryptNative(graphicBuffer, offset, size,
                                         streamCTR, &inputCTR, outData);

            reply->writeInt32(err);

 if (err == OK) {
                reply->writeInt64(inputCTR);
                reply->write(outData, size);
 }

            free(outData);
            outData = NULL;

 return OK;
 }


         case HDCP_DECRYPT:
         {
             size_t size = data.readInt32();
 
            void *inData = malloc(2 * size);
             void *outData = (uint8_t *)inData + size;
 
             data.read(inData, size);

 uint32_t streamCTR = data.readInt32();
 uint64_t inputCTR = data.readInt64();
 status_t err = decrypt(inData, size, streamCTR, inputCTR, outData);

            reply->writeInt32(err);

 if (err == OK) {
                reply->write(outData, size);
 }

            free(inData);
            inData = outData = NULL;

 return OK;
 }

 default:
 return BBinder::onTransact(code, data, reply, flags);
 }
}
Commit message: None
CVE: CVE-2015-3831
CWE: CWE-119
Vulnerability description: Buffer overflow in the readAt function in BpMediaHTTPConnection in media/libmedia/IMediaHTTPConnection.cpp in the mediaserver service in Android before 5.1.1 LMY48I allows attackers to execute arbitrary code via a crafted application, aka internal bug 19400722.

Project: Android

 virtual ssize_t readAt(off64_t offset, void *buffer, size_t size) {
 Parcel data, reply;
        data.writeInterfaceToken(
 IMediaHTTPConnection::getInterfaceDescriptor());

        data.writeInt64(offset);
        data.writeInt32(size);

 status_t err = remote()->transact(READ_AT, data, &reply);
 if (err != OK) {
            ALOGE("remote readAt failed");
 return UNKNOWN_ERROR;
 }

 int32_t exceptionCode = reply.readExceptionCode();

 if (exceptionCode) {

             return UNKNOWN_ERROR;
         }
 
        int32_t len = reply.readInt32();
 
        if (len > 0) {
            memcpy(buffer, mMemory->pointer(), len);
         }
 
         return len;
     }
Commit message: None
CVE: CVE-2015-3828
CWE: CWE-119
Vulnerability description: The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM), which allows remote attackers to execute arbitrary code or cause a denial of service (integer underflow and memory corruption) via crafted 3GPP metadata, aka internal bug 20923261, a related issue to CVE-2015-3826.

Project: Android

status_t MPEG4Extractor::parse3GPPMetaData(off64_t offset, size_t size, int depth) {
 if (size < 4 || size == SIZE_MAX) {
 return ERROR_MALFORMED;
 }

 uint8_t *buffer = new (std::nothrow) uint8_t[size + 1];
 if (buffer == NULL) {
 return ERROR_MALFORMED;
 }
 if (mDataSource->readAt(
                offset, buffer, size) != (ssize_t)size) {
 delete[] buffer;
        buffer = NULL;

 return ERROR_IO;
 }

 uint32_t metadataKey = 0;
 switch (mPath[depth]) {
 case FOURCC('t', 'i', 't', 'l'):
 {
            metadataKey = kKeyTitle;
 break;
 }
 case FOURCC('p', 'e', 'r', 'f'):
 {
            metadataKey = kKeyArtist;
 break;
 }
 case FOURCC('a', 'u', 't', 'h'):
 {
            metadataKey = kKeyWriter;
 break;
 }
 case FOURCC('g', 'n', 'r', 'e'):
 {
            metadataKey = kKeyGenre;
 break;
 }
 case FOURCC('a', 'l', 'b', 'm'):
 {
 if (buffer[size - 1] != '\0') {
 char tmp[4];
              sprintf(tmp, "%u", buffer[size - 1]);

              mFileMetaData->setCString(kKeyCDTrackNumber, tmp);
 }

            metadataKey = kKeyAlbum;
 break;
 }
 case FOURCC('y', 'r', 'r', 'c'):
 {
 char tmp[5];
 uint16_t year = U16_AT(&buffer[4]);

 if (year < 10000) {
                sprintf(tmp, "%u", year);

                mFileMetaData->setCString(kKeyYear, tmp);
 }
 break;
 }

 default:
 break;
 }

 if (metadataKey > 0) {
 bool isUTF8 = true; // Common case
 char16_t *framedata = NULL;

         int len16 = 0; // Number of UTF-16 characters
 
         if (size - 6 >= 4) {
             len16 = ((size - 6) / 2) - 1; // don't include 0x0000 terminator
             framedata = (char16_t *)(buffer + 6);
 if (0xfffe == *framedata) {
 for (int i = 0; i < len16; i++) {
                    framedata[i] = bswap_16(framedata[i]);
 }
 }

 if (0xfeff == *framedata) {
                framedata++;
                len16--;
                isUTF8 = false;
 }
 }

 if (isUTF8) {
            buffer[size] = 0;
            mFileMetaData->setCString(metadataKey, (const char *)buffer + 6);
 } else {
 String8 tmpUTF8str(framedata, len16);
            mFileMetaData->setCString(metadataKey, tmpUTF8str.string());
 }
 }

 delete[] buffer;
    buffer = NULL;

 return OK;
}
Commit message: None
CVE: CVE-2015-1539
CWE: CWE-189
Vulnerability description: Multiple integer underflows in the ESDS::parseESDescriptor function in ESDS.cpp in libstagefright in Android before 5.1.1 LMY48I allow remote attackers to execute arbitrary code via crafted ESDS atoms, aka internal bug 20139950, a related issue to CVE-2015-4493.

Project: Android

status_t ESDS::parseESDescriptor(size_t offset, size_t size) {
 if (size < 3) {
 return ERROR_MALFORMED;
 }

    offset += 2; // skip ES_ID
    size -= 2;

 unsigned streamDependenceFlag = mData[offset] & 0x80;
 unsigned URL_Flag = mData[offset] & 0x40;
 unsigned OCRstreamFlag = mData[offset] & 0x20;

 ++offset;

     --size;
 
     if (streamDependenceFlag) {
         offset += 2;
         size -= 2;
     }

 if (URL_Flag) {
 if (offset >= size) {

             return ERROR_MALFORMED;
         }
         unsigned URLlength = mData[offset];
         offset += URLlength + 1;
         size -= URLlength + 1;
     }
 
     if (OCRstreamFlag) {
         offset += 2;
         size -= 2;
 
 if ((offset >= size || mData[offset] != kTag_DecoderConfigDescriptor)
 && offset - 2 < size
 && mData[offset - 2] == kTag_DecoderConfigDescriptor) {
            offset -= 2;
            size += 2;

            ALOGW("Found malformed 'esds' atom, ignoring missing OCR_ES_Id.");
 }
 }

 if (offset >= size) {
 return ERROR_MALFORMED;
 }

 uint8_t tag;
 size_t sub_offset, sub_size;
 status_t err = skipDescriptorHeader(
            offset, size, &tag, &sub_offset, &sub_size);

 if (err != OK) {
 return err;
 }

 if (tag != kTag_DecoderConfigDescriptor) {
 return ERROR_MALFORMED;
 }

    err = parseDecoderConfigDescriptor(sub_offset, sub_size);

 return err;
}