db-d2/primevul-codebert-embeddings huggingface dataset:
Commit message: None
CVE: CVE-2011-3967
Vulnerability description: Unspecified vulnerability in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service (application crash) via a crafted certificate.

Project: Chrome

std::string ProcessRawBytesWithSeparators(const unsigned char* data,
                                          size_t data_length,
                                          char hex_separator,
                                          char line_separator) {
  static const char kHexChars[] = "0123456789ABCDEF";

   std::string ret;
   size_t kMin = 0U;

  if (!data_length)
    return "";

   ret.reserve(std::max(kMin, data_length * 3 - 1));
 
   for (size_t i = 0; i < data_length; ++i) {
    unsigned char b = data[i];
    ret.push_back(kHexChars[(b >> 4) & 0xf]);
    ret.push_back(kHexChars[b & 0xf]);
    if (i + 1 < data_length) {
      if ((i + 1) % 16 == 0)
        ret.push_back(line_separator);
      else
        ret.push_back(hex_separator);
    }
  }
  return ret;
}
Commit message: None
CVE: CVE-2013-2927
CWE: CWE-399
Vulnerability description: Use-after-free vulnerability in the HTMLFormElement::prepareForSubmission function in core/html/HTMLFormElement.cpp in Blink, as used in Google Chrome before 30.0.1599.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to submission for FORM elements.

Project: Chrome

 bool HTMLFormElement::prepareForSubmission(Event* event)
 {
    RefPtr<HTMLFormElement> protector(this);
     Frame* frame = document().frame();
     if (m_isSubmittingOrPreparingForSubmission || !frame)
         return m_isSubmittingOrPreparingForSubmission;

    m_isSubmittingOrPreparingForSubmission = true;
    m_shouldSubmit = false;

    if (!validateInteractively(event)) {
        m_isSubmittingOrPreparingForSubmission = false;
        return false;
    }

    StringPairVector controlNamesAndValues;
    getTextFieldValues(controlNamesAndValues);
    RefPtr<FormState> formState = FormState::create(this, controlNamesAndValues, &document(), NotSubmittedByJavaScript);
    frame->loader()->client()->dispatchWillSendSubmitEvent(formState.release());

    if (dispatchEvent(Event::createCancelableBubble(eventNames().submitEvent)))
        m_shouldSubmit = true;

    m_isSubmittingOrPreparingForSubmission = false;

    if (m_shouldSubmit)
        submit(event, true, true, NotSubmittedByJavaScript);

    return m_shouldSubmit;
}
Commit message: None
CVE: CVE-2013-2906
CWE: CWE-362
Vulnerability description: Multiple race conditions in the Web Audio implementation in Blink, as used in Google Chrome before 30.0.1599.66, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to threading in core/html/HTMLMediaElement.cpp, core/platform/audio/AudioDSPKernelProcessor.cpp, core/platform/audio/HRTFElevation.cpp, and modules/webaudio/ConvolverNode.cpp.

Project: Chrome

void RenderThreadImpl::Shutdown() {
  FOR_EACH_OBSERVER(
      RenderProcessObserver, observers_, OnRenderProcessShutdown());

  ChildThread::Shutdown();

  if (memory_observer_) {
    message_loop()->RemoveTaskObserver(memory_observer_.get());
    memory_observer_.reset();
  }
 
   if (webkit_platform_support_) {
    // WaitForAllDatabasesToClose might run a nested message loop. To avoid
    // processing timer events while we're already in the process of shutting
    // down blink, put a ScopePageLoadDeferrer on the stack.
    WebView::willEnterModalLoop();
     webkit_platform_support_->web_database_observer_impl()->
         WaitForAllDatabasesToClose();
    WebView::didExitModalLoop();
   }
 
  if (devtools_agent_message_filter_.get()) {
    RemoveFilter(devtools_agent_message_filter_.get());
    devtools_agent_message_filter_ = NULL;
  }

  RemoveFilter(audio_input_message_filter_.get());
  audio_input_message_filter_ = NULL;

  RemoveFilter(audio_message_filter_.get());
  audio_message_filter_ = NULL;

#if defined(ENABLE_WEBRTC)
  RTCPeerConnectionHandler::DestructAllHandlers();

  peer_connection_factory_.reset();
#endif
  RemoveFilter(vc_manager_->video_capture_message_filter());
  vc_manager_.reset();

  RemoveFilter(db_message_filter_.get());
  db_message_filter_ = NULL;

  if (file_thread_)
    file_thread_->Stop();

  if (compositor_output_surface_filter_.get()) {
    RemoveFilter(compositor_output_surface_filter_.get());
    compositor_output_surface_filter_ = NULL;
  }

  media_thread_.reset();
  compositor_thread_.reset();
  input_handler_manager_.reset();
  if (input_event_filter_.get()) {
    RemoveFilter(input_event_filter_.get());
    input_event_filter_ = NULL;
  }

  embedded_worker_dispatcher_.reset();

  main_thread_indexed_db_dispatcher_.reset();

  if (webkit_platform_support_)
    blink::shutdown();

  lazy_tls.Pointer()->Set(NULL);

#if defined(OS_WIN)
  NPChannelBase::CleanupChannels();
#endif
}
Commit message: None
CVE: CVE-2013-2913
CWE: CWE-399
Vulnerability description: Use-after-free vulnerability in the XMLDocumentParser::append function in core/xml/parser/XMLDocumentParser.cpp in Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving an XML document.

Project: Chrome

   ExtensionBookmarksTest()
Commit message: None
CVE: CVE-2013-2877
CWE: CWE-119
Vulnerability description: parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state.

Project: Chrome
File: parser.c

xmlStopParser(xmlParserCtxtPtr ctxt) {
     if (ctxt == NULL)
         return;
     ctxt->instate = XML_PARSER_EOF;
    ctxt->errNo = XML_ERR_USER_STOP;
     ctxt->disableSAX = 1;
     if (ctxt->input != NULL) {
 	ctxt->input->cur = BAD_CAST"";
	ctxt->input->base = ctxt->input->cur;
    }
}
Commit message: None
CVE: None
Vulnerability description: None

Project: Chrome

void ChangeListLoader::LoadAfterGetAboutResource(
    const DirectoryFetchInfo& directory_fetch_info,
    bool is_initial_load,
    int64 local_changestamp,
    google_apis::GDataErrorCode status,
    scoped_ptr<google_apis::AboutResource> about_resource) {
  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
 
   FileError error = GDataToFileError(status);
   if (error != FILE_ERROR_OK) {
    if (directory_fetch_info.empty() || is_initial_load)
      OnChangeListLoadComplete(error);
    else
      OnDirectoryLoadComplete(directory_fetch_info, error);
     return;
   }
 
   DCHECK(about_resource);
 
   int64 remote_changestamp = about_resource->largest_change_id();
   int64 start_changestamp = local_changestamp > 0 ? local_changestamp + 1 : 0;
   if (directory_fetch_info.empty()) {
    if (local_changestamp >= remote_changestamp) {
      if (local_changestamp > remote_changestamp) {
        LOG(WARNING) << "Local resource metadata is fresher than server, "
                     << "local = " << local_changestamp
                     << ", server = " << remote_changestamp;
      }

      // No changes detected, tell the client that the loading was successful.
      OnChangeListLoadComplete(FILE_ERROR_OK);
      return;
    }

     LoadChangeListFromServer(start_changestamp);
  } else {
    int64 directory_changestamp = std::max(directory_fetch_info.changestamp(),
                                           local_changestamp);

    util::Log(logging::LOG_INFO,
              "Fast-fetch start: %s; Server changestamp: %s",
              directory_fetch_info.ToString().c_str(),
              base::Int64ToString(remote_changestamp).c_str());

    if (directory_changestamp >= remote_changestamp) {
      LoadAfterLoadDirectory(directory_fetch_info, is_initial_load,
                             start_changestamp, FILE_ERROR_OK);
      return;
    }

    DirectoryFetchInfo new_directory_fetch_info(
        directory_fetch_info.local_id(), directory_fetch_info.resource_id(),
        remote_changestamp);
    LoadDirectoryFromServer(
        new_directory_fetch_info,
        base::Bind(&ChangeListLoader::LoadAfterLoadDirectory,
                   weak_ptr_factory_.GetWeakPtr(),
                   directory_fetch_info,
                   is_initial_load,
                   start_changestamp));
  }
}
Commit message: None
CVE: CVE-2013-0841
CWE: CWE-20
Vulnerability description: Array index error in the content-blocking functionality in Google Chrome before 24.0.1312.56 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

Project: Chrome

void TabSpecificContentSettings::OnContentBlocked(
    ContentSettingsType type,
     const std::string& resource_identifier) {
   DCHECK(type != CONTENT_SETTINGS_TYPE_GEOLOCATION)
       << "Geolocation settings handled by OnGeolocationPermissionSet";
  if (type < 0 || type >= CONTENT_SETTINGS_NUM_TYPES)
    return;
   content_accessed_[type] = true;
  std::string identifier;
  if (CommandLine::ForCurrentProcess()->HasSwitch(
      switches::kEnableResourceContentSettings)) {
    identifier = resource_identifier;
  }
  if (!identifier.empty())
    AddBlockedResource(type, identifier);

#if defined (OS_ANDROID)
  if (type == CONTENT_SETTINGS_TYPE_POPUPS) {
    content_blocked_[type] = false;
    content_blockage_indicated_to_user_[type] = false;
  }
#endif

  if (!content_blocked_[type]) {
    content_blocked_[type] = true;
    content::NotificationService::current()->Notify(
        chrome::NOTIFICATION_WEB_CONTENT_SETTINGS_CHANGED,
        content::Source<WebContents>(web_contents()),
        content::NotificationService::NoDetails());
  }
}
Commit message: None
CVE: CVE-2013-0843
CWE: CWE-119
Vulnerability description: content/renderer/media/webrtc_audio_renderer.cc in Google Chrome before 24.0.1312.56 on Mac OS X does not use an appropriate buffer size for the 96 kHz sampling rate, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a web site that provides WebRTC audio.

Project: Chrome

bool WebRtcAudioRenderer::Initialize(WebRtcAudioRendererSource* source) {
  base::AutoLock auto_lock(lock_);
  DCHECK_EQ(state_, UNINITIALIZED);
  DCHECK(source);
  DCHECK(!sink_);
  DCHECK(!source_);

  sink_ = AudioDeviceFactory::NewOutputDevice();
  DCHECK(sink_);

  int sample_rate = GetAudioOutputSampleRate();
  DVLOG(1) << "Audio output hardware sample rate: " << sample_rate;
  UMA_HISTOGRAM_ENUMERATION("WebRTC.AudioOutputSampleRate",
                            sample_rate, media::kUnexpectedAudioSampleRate);

  if (std::find(&kValidOutputRates[0],
                &kValidOutputRates[0] + arraysize(kValidOutputRates),
                sample_rate) ==
                    &kValidOutputRates[arraysize(kValidOutputRates)]) {
    DLOG(ERROR) << sample_rate << " is not a supported output rate.";
    return false;
  }

  media::ChannelLayout channel_layout = media::CHANNEL_LAYOUT_STEREO;

  int buffer_size = 0;

#if defined(OS_WIN)
  channel_layout = media::CHANNEL_LAYOUT_STEREO;


  if (sample_rate == 96000 || sample_rate == 48000) {
    buffer_size = (sample_rate / 100);
  } else {
    buffer_size = 2 * 440;
  }

  if (base::win::GetVersion() < base::win::VERSION_VISTA) {
    buffer_size = 3 * buffer_size;
    DLOG(WARNING) << "Extending the output buffer size by a factor of three "
                  << "since Windows XP has been detected.";
  }
#elif defined(OS_MACOSX)
  channel_layout = media::CHANNEL_LAYOUT_MONO;
 
  // frame size to use for 96kHz, 48kHz and 44.1kHz.
 
  if (sample_rate == 96000 || sample_rate == 48000) {
    buffer_size = (sample_rate / 100);
   } else {
    buffer_size = 440;
  }
#elif defined(OS_LINUX) || defined(OS_OPENBSD)
  channel_layout = media::CHANNEL_LAYOUT_MONO;

  buffer_size = 480;
#else
  DLOG(ERROR) << "Unsupported platform";
  return false;
#endif

  params_.Reset(media::AudioParameters::AUDIO_PCM_LOW_LATENCY, channel_layout,
                sample_rate, 16, buffer_size);

  buffer_.reset(new int16[params_.frames_per_buffer() * params_.channels()]);

  source_ = source;
  source->SetRenderFormat(params_);

  sink_->Initialize(params_, this);
  sink_->SetSourceRenderView(source_render_view_id_);
  sink_->Start();

  state_ = PAUSED;

  UMA_HISTOGRAM_ENUMERATION("WebRTC.AudioOutputChannelLayout",
                            channel_layout, media::CHANNEL_LAYOUT_MAX);
  UMA_HISTOGRAM_ENUMERATION("WebRTC.AudioOutputFramesPerBuffer",
                            buffer_size, kUnexpectedAudioBufferSize);
  AddHistogramFramesPerBuffer(buffer_size);

  return true;
}
Commit message: None
CVE: CVE-2014-7903
CWE: CWE-119
Vulnerability description: Buffer overflow in OpenJPEG before r2911 in PDFium, as used in Google Chrome before 39.0.2171.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JPEG image.

Project: Chrome

  bool DoTouchScroll(const gfx::Point& point,
                     const gfx::Vector2d& distance,
                     bool wait_until_scrolled) {
    EXPECT_EQ(0, GetScrollTop());

    int scrollHeight = ExecuteScriptAndExtractInt(
        "document.documentElement.scrollHeight");
    EXPECT_EQ(1200, scrollHeight);

    scoped_refptr<FrameWatcher> frame_watcher(new FrameWatcher());
    frame_watcher->AttachTo(shell()->web_contents());

    SyntheticSmoothScrollGestureParams params;
    params.gesture_source_type = SyntheticGestureParams::TOUCH_INPUT;
    params.anchor = gfx::PointF(point);
    params.distances.push_back(-distance);

    runner_ = new MessageLoopRunner();

    std::unique_ptr<SyntheticSmoothScrollGesture> gesture(
        new SyntheticSmoothScrollGesture(params));
    GetWidgetHost()->QueueSyntheticGesture(
        std::move(gesture),
        base::Bind(&TouchActionBrowserTest::OnSyntheticGestureCompleted,
                   base::Unretained(this)));

    runner_->Run();
    runner_ = NULL;

     while (wait_until_scrolled &&
           frame_watcher->LastMetadata().root_scroll_offset.y() <
               distance.y()) {
       frame_watcher->WaitFrames(1);
     }
 
    int scrollTop = GetScrollTop();
    if (scrollTop == 0)
      return false;

    EXPECT_EQ(distance.y(), scrollTop);
    return true;
  }
Commit message: None
CVE: CVE-2014-7908
CWE: CWE-189
Vulnerability description: Multiple integer overflows in the CheckMov function in media/base/container_names.cc in Google Chrome before 39.0.2171.65 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a large atom in (1) MPEG-4 or (2) QuickTime .mov data.

Project: Chrome

static bool CheckMov(const uint8* buffer, int buffer_size) {
  RCHECK(buffer_size > 8);
 
   int offset = 0;
   while (offset + 8 < buffer_size) {
    uint32 atomsize = Read32(buffer + offset);
     uint32 atomtype = Read32(buffer + offset + 4);
     switch (atomtype) {
      case TAG('f','t','y','p'):
      case TAG('p','d','i','n'):
      case TAG('m','o','o','v'):
      case TAG('m','o','o','f'):
      case TAG('m','f','r','a'):
      case TAG('m','d','a','t'):
      case TAG('f','r','e','e'):
      case TAG('s','k','i','p'):
      case TAG('m','e','t','a'):
      case TAG('m','e','c','o'):
      case TAG('s','t','y','p'):
      case TAG('s','i','d','x'):
      case TAG('s','s','i','x'):
      case TAG('p','r','f','t'):
      case TAG('b','l','o','c'):
        break;
      default:
        return false;
    }
    if (atomsize == 1) {
      if (offset + 16 > buffer_size)
        break;
      if (Read32(buffer + offset + 8) != 0)
         break;  // Offset is way past buffer size.
       atomsize = Read32(buffer + offset + 12);
     }
    if (atomsize == 0 || atomsize > static_cast<size_t>(buffer_size))
       break;  // Indicates the last atom or length too big.
     offset += atomsize;
   }
  return true;
}
Commit message: None
CVE: CVE-2014-1748
Vulnerability description: The ScrollView::paint function in platform/scroll/ScrollView.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to spoof the UI by extending scrollbar painting into the parent frame.

Project: Chrome

  void InitOnIOThread(const std::string& mime_type) {
    PluginServiceImpl* plugin_service = PluginServiceImpl::GetInstance();

     std::vector<WebPluginInfo> plugins;
     plugin_service->GetPluginInfoArray(
         GURL(), mime_type, false, &plugins, NULL);

    if (plugins.empty()) {
      // May be empty for some tests and on the CrOS login OOBE screen.
      event_->Signal();
      return;
    }

    base::FilePath plugin_path = plugins[0].path;
 
     DCHECK_CURRENTLY_ON(BrowserThread::IO);
     remove_start_time_ = base::Time::Now();
    is_removing_ = true;
    AddRef();

    PepperPluginInfo* pepper_info =
        plugin_service->GetRegisteredPpapiPluginInfo(plugin_path);
    if (pepper_info) {
      plugin_name_ = pepper_info->name;
      plugin_service->OpenChannelToPpapiBroker(0, plugin_path, this);
    } else {
      plugin_service->OpenChannelToNpapiPlugin(
          0, 0, GURL(), GURL(), mime_type, this);
    }
  }
Commit message: None
CVE: CVE-2014-3156
CWE: CWE-119
Vulnerability description: Buffer overflow in the clipboard implementation in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger unexpected bitmap data, related to content/renderer/renderer_clipboard_client.cc and content/renderer/webclipboard_impl.cc.

Project: Chrome

void SystemClipboard::WriteImage(Image* image,
                                 const KURL& url,
                                 const String& title) {
  DCHECK(image);

  PaintImage paint_image = image->PaintImageForCurrentFrame();
  SkBitmap bitmap;
  if (sk_sp<SkImage> sk_image = paint_image.GetSkImage())
    sk_image->asLegacyBitmap(&bitmap);
   if (bitmap.isNull())
     return;
 
  // TODO(crbug.com/918717): Remove CHECK if no crashes occur on it in canary.
  CHECK(bitmap.getPixels());
 
   clipboard_->WriteImage(mojom::ClipboardBuffer::kStandard, bitmap);
 
  if (url.IsValid() && !url.IsEmpty()) {
#if !defined(OS_MACOSX)
    clipboard_->WriteBookmark(mojom::ClipboardBuffer::kStandard,
                              url.GetString(), NonNullString(title));
#endif

    clipboard_->WriteHtml(mojom::ClipboardBuffer::kStandard,
                          URLToImageMarkup(url, title), KURL());
  }
  clipboard_->CommitWrite(mojom::ClipboardBuffer::kStandard);
}
Commit message: None
CVE: None
Vulnerability description: None

Project: Chrome

bool CanRendererHandleEvent(const ui::MouseEvent* event) {
  if (event->type() == ui::ET_MOUSE_CAPTURE_CHANGED)
    return false;

#if defined(OS_WIN)
  switch (event->native_event().message) {
    case WM_XBUTTONDOWN:
    case WM_XBUTTONUP:
     case WM_XBUTTONDBLCLK:
     case WM_NCMOUSELEAVE:
     case WM_NCMOUSEMOVE:
    case WM_NCLBUTTONDOWN:
    case WM_NCLBUTTONUP:
    case WM_NCLBUTTONDBLCLK:
    case WM_NCRBUTTONDOWN:
    case WM_NCRBUTTONUP:
    case WM_NCRBUTTONDBLCLK:
    case WM_NCMBUTTONDOWN:
    case WM_NCMBUTTONUP:
    case WM_NCMBUTTONDBLCLK:
     case WM_NCXBUTTONDOWN:
     case WM_NCXBUTTONUP:
     case WM_NCXBUTTONDBLCLK:
      return false;
    default:
      break;
  }
#endif
  return true;
}
Commit message: None
CVE: CVE-2015-6764
CWE: CWE-119
Vulnerability description: The BasicJsonStringifier::SerializeJSArray function in json-stringifier.h in the JSON stringifier in Google V8, as used in Google Chrome before 47.0.2526.73, improperly loads array elements, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted JavaScript code.

Project: Chrome

bool GetNetworkList(NetworkInterfaceList* networks, int policy) {
IPAddress NetAddressToIPAddress(const netstack::NetAddress& addr) {
  if (addr.ipv4) {
    return IPAddress(addr.ipv4->addr.data(), addr.ipv4->addr.count());
   }
  if (addr.ipv6) {
    return IPAddress(addr.ipv6->addr.data(), addr.ipv6->addr.count());
   }
  return IPAddress();
}
 
bool GetNetworkList(NetworkInterfaceList* networks, int policy) {
  netstack::NetstackSyncPtr netstack =
      base::fuchsia::ComponentContext::GetDefault()
          ->ConnectToServiceSync<netstack::Netstack>();
 
  fidl::VectorPtr<netstack::NetInterface> interfaces;
  if (!netstack->GetInterfaces(&interfaces))
    return false;
 
  for (auto& interface : interfaces.get()) {
    // Check if the interface is up.
    if (!(interface.flags & netstack::NetInterfaceFlagUp))
       continue;
 
    // Skip loopback.
    if (interface.features & netstack::interfaceFeatureLoopback)
       continue;
 
    NetworkChangeNotifier::ConnectionType connection_type =
        (interface.features & netstack::interfaceFeatureWlan)
            ? NetworkChangeNotifier::CONNECTION_WIFI
            : NetworkChangeNotifier::CONNECTION_UNKNOWN;
 
    // addresses. Currently Netstack doesn't provide this information.
     int attributes = 0;
 
    networks->push_back(NetworkInterface(
        *interface.name, *interface.name, interface.id, connection_type,
        NetAddressToIPAddress(interface.addr),
        MaskPrefixLength(NetAddressToIPAddress(interface.netmask)),
        attributes));
   }
 
   return true;
 }
Commit message: None
CVE: CVE-2015-6782
CWE: CWE-20
Vulnerability description: The Document::open function in WebKit/Source/core/dom/Document.cpp in Google Chrome before 47.0.2526.73 does not ensure that page-dismissal event handling is compatible with modal-dialog blocking, which makes it easier for remote attackers to spoof Omnibox content via a crafted web site.

Project: Chrome

void Document::open()
{
    ASSERT(!importLoader());

    if (m_frame) {
        if (ScriptableDocumentParser* parser = scriptableDocumentParser()) {
            if (parser->isParsing()) {
                if (parser->isExecutingScript())
                    return;

                if (!parser->wasCreatedByScript() && parser->hasInsertionPoint())
                    return;
            }
        }

        if (m_frame->loader().provisionalDocumentLoader())
            m_frame->loader().stopAllLoaders();
    }

    removeAllEventListenersRecursively();
    implicitOpen(ForceSynchronousParsing);
    if (ScriptableDocumentParser* parser = scriptableDocumentParser())
        parser->setWasCreatedByScript(true);
 
     if (m_frame)
         m_frame->loader().didExplicitOpen();
    if (m_loadEventProgress != LoadEventInProgress && pageDismissalEventBeingDispatched() == NoDismissal)
         m_loadEventProgress = LoadEventNotRun;
 }