hitoshura25/cvefixes huggingface dataset:
CVE-2022-1297 (C, published 2022-04-11T12:15Z)
Description: value: Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability may allow attackers to read sensitive information or cause a crash.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/format/ne/ne.c
Commit message: Fix oobread and unaligned casts in the NE entrypoint logic ##crash

* Reported by @hmsec via huntr.dev
* Reproducer: nepocaligns
* BountyID: ec538fa4-06c6-4050-a141-f60153ddeaac


Vulnerable code:
				ut16 segoff = *(ut16 *)(bin->entry_table + off);
				if (segnum > 0) {
						* bin->alignment + *(ut16 *)(bin->entry_table + off);

Fixed code:
				if (off > bin->ne_header->EntryTableLength) {
					break;
				}
				ut16 segoff = r_read_le16 (bin->entry_table + off);
				if (segnum > 0 && segnum < bin->ne_header->SegCount) {
				if (off + 2 >= bin->ne_header->EntryTableLength) {
					break;
				}
				ut16 delta = r_read_le16 (bin->entry_table + off);
						* bin->alignment + delta;
CVE-2022-1382 (C, published 2022-04-18T01:15Z)
Description: value: NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of making the radare2 crash, thus affecting the availability of the system.
Severity: HIGH (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/format/ne/ne.c
Commit message: Fix null deref in ne parser ##crash

* Reported by @cnitlrt via huntr.dev
* BountyID: d8b6d239-6d7b-4783-b26b-5be848c01aa1/
* Reproducer: nenull


Vulnerable code:
	if (!bin) {

Fixed code:
	if (!bin || !bin->segment_entries) {
CVE-2022-1383 (C, published 2022-04-18T01:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.8. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/format/mach0/coresymbolication.c
Commit message: Fix oobread bug in NE parser ##crash

* Reported by @cnitlrt via huntrdev
* BountyID: 02b4b563-b946-4343-9092-38d1c5cd60c9
* Reproducer: neoobread

Vulnerable code:
			if (cursor >= end) {
			if (cursor >= end) {
			sect->name = str_dup_safe (b, string_origin + (size_t)sect_name_off, end);

Fixed code:
			if (cursor + word_size >= end) {
			if (cursor + word_size >= end) {
			if (sect_name_off < (ut64)(size_t)(end - string_origin)) {
				sect->name = str_dup_safe (b, string_origin + sect_name_off, end);
			} else {
				sect->name = strdup ("");
			}
CVE-2022-1437 (C, published 2022-04-22T15:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/format/mach0/coresymbolication.c
libr/bin/p/bin_symbols.c
Commit message: Fix oobread and null deref in symbols file parser ##crash

* Reported by @cnitlrt
* BountyID: af6c3e9e-b7df-4d80-b48f-77fdd17b4038/
* Reproducer: symoob


Vulnerable code:
	RList *res = r_list_newf ((RListFree)r_bin_symbol_free);
	r_return_val_if_fail (res && bf->o && bf->o->bin_obj, res);
		return res;
	for (i = 0; i < element->hdr->n_lined_symbols; i++) {
		RCoreSymCacheElementSymbol *sym = (RCoreSymCacheElementSymbol *)&element->lined_symbols[i];
		if (!sym) {
			break;
		}
		ht_uu_find (hash, sym->paddr, &found);
		if (found) {
			continue;
		}
		RBinSymbol *s = bin_symbol_from_symbol (element, sym);
		if (s) {
			r_list_append (res, s);
			ht_uu_insert (hash, sym->paddr, 1);

Fixed code:
			if (cursor + (word_size * 4) > end) {
				goto beach;
			}
			if (!string_origin) {
				cursor += R_CS_EL_SIZE_LSYM;
				continue;
			}
	r_return_val_if_fail (bf && bf->o && bf->o->bin_obj, NULL);
		return NULL;
	RList *res = r_list_newf ((RListFree)r_bin_symbol_free);
	if (element->lined_symbols) {
		for (i = 0; i < element->hdr->n_lined_symbols; i++) {
			RCoreSymCacheElementSymbol *sym = (RCoreSymCacheElementSymbol *)&element->lined_symbols[i];
			if (!sym) {
				break;
			}
			ht_uu_find (hash, sym->paddr, &found);
			if (found) {
				continue;
			}
			RBinSymbol *s = bin_symbol_from_symbol (element, sym);
			if (s) {
				r_list_append (res, s);
				ht_uu_insert (hash, sym->paddr, 1);
			}
CVE-2022-1444 (C, published 2022-04-23T22:15Z)
Description: value: heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.7.0. This vulnerability is capable of inducing denial of service.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/util/new_rbtree.c
Commit message: Redo minor cleanup in new_rbtree


Vulnerable code:
	if (tree->root == NULL) {
		if (tree->root == NULL) {

Fixed code:
	if (!tree->root) {
		if (!tree->root) {
CVE-2022-1451 (C, published 2022-04-24T21:15Z)
Description: value: Out-of-bounds Read in r_bin_java_constant_value_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. More details see [CWE-125: Out-of-bounds read](https://cwe.mitre.org/data/definitions/125.html).
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
shlr/java/class.c
Commit message: Fix oobread crash in java parser ##crash

* Reported by @bet4it via @huntrdev
* BountyID: 229a2e0d-9e5c-402f-9a24-57fa2eb1aaa7
* Reproducer: poc4java


Vulnerable code:
	ut8 *attr_buf = NULL;
	attr_buf = (ut8 *) calloc (pending + 1, 1);
		attr->info.constant_value_attr.constantvalue_idx = R_BIN_JAVA_USHORT (buffer, offset);
	RBinJavaAttrInfo *attr = NULL;
	attr = r_bin_java_default_attr_new (bin, buffer, sz, buf_offset);

Fixed code:
	// XXX this pending is wrong and too expensive
	ut8 *attr_buf = (ut8 *) calloc (pending + 1, 1);
		if (offset + 4 < sz) {
			attr->info.constant_value_attr.constantvalue_idx = R_BIN_JAVA_USHORT (buffer, offset);
		}
	if (buf_offset + 32 >= sz) {
		return NULL;
	}
	RBinJavaAttrInfo *attr = r_bin_java_default_attr_new (bin, buffer, sz, buf_offset);
CVE-2022-1452 (C, published 2022-04-24T21:15Z)
Description: value: Out-of-bounds Read in r_bin_java_bootstrap_methods_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. More details see [CWE-125: Out-of-bounds read](https://cwe.mitre.org/data/definitions/125.html).
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
shlr/java/class.c
Commit message: Fix oobread in java parser ##crash

* Reported by @bet4it via @huntrdev
* BountyID c8f4c2de-7d96-4ad4-857a-c099effca2d6
* Reproducer: bootstrap.class


Vulnerable code:

Fixed code:
		if (offset + 8 > sz)  {
			free (attr);
			return NULL;
		}
CVE-2022-1649 (C, published 2022-05-10T17:15Z)
Description: value: Null pointer dereference in libr/bin/format/mach0/mach0.c in radareorg/radare2 in GitHub repository radareorg/radare2 prior to 5.7.0. It is likely to be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/476.html).
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/format/mach0/mach0.c
Commit message: Fix null deref in macho parser ##crash

* Reported by Han0nly via huntrdev
* BountyID: c07e4918-cf86-4d2e-8969-5fb63575b449
* Reproducer: machonull


Vulnerable code:

Fixed code:
				if (!bin->chained_starts[i]->page_start) {
					break;
				}
CVE-2022-1714 (C, published 2022-05-13T15:15Z)
Description: value: Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
Severity: LOW (CVSS v3 base score: 7.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/anal/p/anal_msp430.c
libr/bin/format/elf/elf.c
Commit message: Fix 4 byte oobread in msp430 disassembler ##crash

* Only crashes with asan builds
* Add missing =SN register
* Reported by cnitlrt via huntrdev
* BountyID: 1c22055b-b015-47a8-a57b-4982978751d0


Vulnerable code:
	int ret;
	struct msp430_cmd cmd;

	memset (&cmd, 0, sizeof (cmd));
	//op->id = ???;
	ret = op->size = msp430_decode_command (buf, len, &cmd);
			op->jump = r_read_at_le16 (buf, 2);
		R_LOG_ERROR ("read (magic)");
		R_LOG_ERROR ("read (ehdr)");
			R_LOG_ERROR ("read (phdr)");
			R_LOG_ERROR ("read (shdr) at 0x%" PFMT64x, (ut64) bin->ehdr.e_shoff);
		R_LOG_ERROR ("read (shstrtab) at 0x%" PFMT64x, (ut64) bin->shstrtab_section->sh_offset);
		R_LOG_ERROR ("Cannot allocate memory (Check Elf_(Verdef))");
		R_LOG_ERROR ("read (init_offset)");

Fixed code:
	struct msp430_cmd cmd = {0};
	int ret = op->size = msp430_decode_command (buf, len, &cmd);
			if (len > 4) {
				op->jump = r_read_at_le16 (buf, 2);
			}
		"=SN	r0\n"
		R_LOG_DEBUG ("read (magic)");
		R_LOG_DEBUG ("read (ehdr)");
			R_LOG_DEBUG ("read (phdr)");
			R_LOG_DEBUG ("read (shdr) at 0x%" PFMT64x, (ut64) bin->ehdr.e_shoff);
		R_LOG_DEBUG ("read (shstrtab) at 0x%" PFMT64x, (ut64) bin->shstrtab_section->sh_offset);
		R_LOG_DEBUG ("Cannot allocate memory (Check Elf_(Verdef))");
		R_LOG_DEBUG ("read (init_offset)");
CVE-2022-1809 (C, published 2022-05-21T23:16Z)
Description: value: Access of Uninitialized Pointer in GitHub repository radareorg/radare2 prior to 5.7.0.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-824 \u2014 Access of Uninitialized Pointer
The product accesses or uses a pointer that has not been initialized.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/anal/vtable.c
Commit message: Fix crash in vtable analysis on UB ##crash

* Reported by @greatergoodest via huntrdev
* BountyID 0730a95e-c485-4ff2-9a5d-bb3abfda0b17
* Reproducer: minified_crash


Vulnerable code:
	ut64 curAddressValue;
			ut8 buf[VTABLE_BUFF_SIZE];
			context->anal->iob.read_at (context->anal->iob.io, xref->addr, buf, sizeof(buf));

			r_anal_op (context->anal, &analop, xref->addr, buf, sizeof(buf), R_ANAL_OP_MASK_BASIC);

			if (analop.type == R_ANAL_OP_TYPE_MOV
				|| analop.type == R_ANAL_OP_TYPE_LEA) {

	RVTableContext context;

Fixed code:
		// cant be null. assume 32bit "->read_addr = NULL;
		context->read_addr = be? vtable_read_addr_be32 : vtable_read_addr_le32;
	ut64 curAddressValue = UT64_MAX;
	ut8 buf[VTABLE_BUFF_SIZE];
			context->anal->iob.read_at (context->anal->iob.io, xref->addr, buf, sizeof (buf));
			r_anal_op (context->anal, &analop, xref->addr, buf, sizeof (buf), R_ANAL_OP_MASK_BASIC);
			if (analop.type == R_ANAL_OP_TYPE_MOV || analop.type == R_ANAL_OP_TYPE_LEA) {
	RVTableContext context = {0};
CVE-2022-1899 (C, published 2022-05-26T17:15Z)
Description: value: Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/bfile.c
Commit message: Fix integer overflow in string search causing oobread ##crash

* Reported by @greatergoodest via huntrdev
* BountyID: 8a3dc5cb-08b3-4807-82b2-77f08c137a04
* Reproducer bfileovf

Vulnerable code:
	while (needle < to) {
		if (needle + 4 < to) {
			ut32 n1 = r_read_le32 (buf + needle - from);
		rc = r_utf8_decode (buf + needle - from, to - needle, NULL);
			char *w = (char *)buf + needle + rc - from;
				rc = r_utf8_decode (buf + needle - from, to - needle, &r);

Fixed code:
	while (needle < to && needle < UT64_MAX - 4) {
		if (needle < to - 4) {
			ut32 n1 = r_read_le32 (buf + (needle - from));
		rc = r_utf8_decode (buf + (needle - from), to - needle, NULL);
			char *w = (char *)buf + (needle + rc - from);
				rc = r_utf8_decode (buf + (needle - from), to - needle, &r);
CVE-2022-28068 (C, published 2023-08-22T19:16Z)
Description: value: A heap buffer overflow in r_sleb128 function in radare2 5.4.2 and 5.4.0.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/anal/dwarf_process.c
libr/bin/dwarf.c
Commit message: Fix oobread crash in DWARF parser (tests_64924) ##crash

Reported by giantbranch of NSFOCUS TIANJI Lab


Vulnerable code:
		/* TODO sometimes CFA is referenced, but we don't parse that yet
		   just an offset involving framebase of a function*/
			const ut8 *dump = &block.data[++i];
			offset = r_sleb128 (&dump, &block.data[loc->block.length]);
				return NULL;
				return NULL;
			break;
		result = READ32 (*buf);
		case 2:
		result = READ16 (*buf); break;
		case 4:
		result = READ32 (*buf); break;
		case 8:
		result = READ64 (*buf); break;
		default:
static const ut8 *parse_die(const ut8 *buf, const ut8 *buf_end, RBinDwarfAbbrevDecl *abbrev,
		RBinDwarfCompUnitHdr *hdr, RBinDwarfDie *die, const ut8 *debug_str, size_t debug_str_len, Sdb *sdb) {
		bool is_valid_string_form = (attribute->attr_form == DW_FORM_strp ||
			attribute->attr_form == DW_FORM_string) &&
			attribute->string.content;


Fixed code:
			/* TODO sometimes CFA is referenced, but we don't parse that yet
			   just an offset involving framebase of a function*/
			i++;
			const ut8 *dump = block.data + i;
			if (loc->block.length > block.length) {
				// eprintf ("skip = %d%c", loc->block.length, 10);
				return NULL;
			}
			offset = r_sleb128 (&dump, block.data + loc->block.length);
			return NULL;
		result = (ut64)READ32 (*buf);
	case 2: result = READ16 (*buf); break;
	case 4: result = READ32 (*buf); break;
	case 8: result = READ64 (*buf); break;
	default:
static const ut8 *parse_die(const ut8 *buf, const ut8 *buf_end, RBinDwarfAbbrevDecl *abbrev, RBinDwarfCompUnitHdr *hdr, RBinDwarfDie *die, const ut8 *debug_str, size_t debug_str_len, Sdb *sdb) {
		bool is_string = (attribute->attr_form == DW_FORM_strp || attribute->attr_form == DW_FORM_string);
		bool is_valid_string_form = is_string && attribute->string.content;
CVE-2022-28069 (C, published 2023-08-22T19:16Z)
Description: value: A heap buffer overflow in vax_opfunction in radare2 5.4.2 and 5.4.0.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/anal/p/anal_vax.c
Commit message: Fix oobread in VAX disassembler (tests_64920) ##crash

Reported by giantbranch of NSFOCUS TIANJI Lab


Vulnerable code:
		{

Fixed code:
		if (len > 6) {
CVE-2022-28070 (C, published 2023-08-22T19:16Z)
Description: value: A null pointer deference in __core_anal_fcn function in radare2 5.4.2 and 5.4.0.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/core/canal.c
Commit message: Fix oobread crash in the analysis loop with corrupted ELFs (tests_64928) ##crash

Reported by giantbranch of NSFOCUS TIANJI Lab


Vulnerable code:
						if ((sym->paddr + baddr) == fcn->addr && !strcmp (sym->type, R_BIN_TYPE_FUNC_STR)) {

Fixed code:
						if (sym->type && (sym->paddr + baddr) == fcn->addr && !strcmp (sym->type, R_BIN_TYPE_FUNC_STR)) {
CVE-2022-28071 (C, published 2023-08-22T19:16Z)
Description: value: A use after free in r_reg_get_name_idx function in radare2 5.4.2 and 5.4.0.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/core/anal_tp.c
Commit message: Fix UAF in aaft (tests_64923) ##crash

Reported by giantbranch of NSFOCUS TIANJI Lab


Vulnerable code:
	const char *pc = r_reg_get_name (core->dbg->reg, R_REG_NAME_PC);
	if (!pc) {
        free (buf);

Fixed code:
	const char *_pc = r_reg_get_name (core->dbg->reg, R_REG_NAME_PC);
	if (!_pc) {
		free (buf);
	char *pc = strdup (_pc);
	free (pc);
CVE-2022-28072 (C, published 2023-08-22T19:16Z)
Description: value: A heap buffer overflow in r_read_le32 function in radare25.4.2 and 5.4.0.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/anal/p/anal_hexagon.c
Commit message: Fix oobread crash in RAnal.hexagon (tests_64900) ##crash

Reported by giantbranch of NSFOCUS TIANJI Lab


Vulnerable code:
	HexInsn hi = {0};;

Fixed code:
	HexInsn hi = {0};
	if (len < 4) {
		return 0;
	}
CVE-2022-28073 (C, published 2023-08-22T19:16Z)
Description: value: A use after free in r_reg_set_value function in radare2 5.4.2 and 5.4.0.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/core/anal_tp.c
libr/core/cmd_anal.c
libr/reg/rvalue.c
Commit message: Fix uaf crash in aaft (tests_64927) ##crash

Reported by giantbranch of NSFOCUS TIANJI Lab


Vulnerable code:
	RRegItem *r = r_reg_get (core->dbg->reg, pc, -1);
	if (!r) {
		free (buf);
		return;
	}
	RRegItem *r;
				r_reg_set_value (core->dbg->reg, r,
						r_num_math (core->num, arg + 1));
	r_return_val_if_fail (reg && item, false);

Fixed code:
		RRegItem *r = r_reg_get (core->dbg->reg, pc, -1);
		if (!r) {
			free (buf);
			return;
		}
				RRegItem *r = r_reg_get (core->dbg->reg, pc, -1);
				if (!r) {
					free (buf);
					return;
				}
	RRegItem *r = NULL;
			ut64 n = r_num_math (core->num, arg + 1);
				r_reg_set_value (core->dbg->reg, r, n); 
	r_return_val_if_fail (reg && item, false);
CVE-2022-4398 (Other, published 2022-12-10T20:15Z)
Description: value: Integer Overflow or Wraparound in GitHub repository radareorg/radare2 prior to 5.8.0.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/radareorg/radare2
Files changed:
dist/docker/Dockerfile
libr/core/canal.c
Commit message: Fix integer overflow in fuzzed dwarf rendering in graphs ##crash

* Reported by @solid-snail via huntrdev
* BountyID: c6f8d3ef-5420-4eba-9a5f-aba5e2b5fea2/
* Reproducer: `intof_mod`


Vulnerable code:

Fixed code:
  python3 \
  python3-pip \
  sudo \
					if (idx < 0 || ST32_ADD_OVFCHK (idx, flen + 8)) {
						R_LOG_WARN ("integer overflow detected");
						break;
					}
CVE-2022-4843 (C, published 2022-12-29T18:15Z)
Description: value: NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.8.2.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/io/io_bank.c
Commit message: Fix null deref in io.bank ##crash

* BountyID: 075b2760-66a0-4d38-b3b5-e9934956ab7f
* Reported by @coolkingcole
* Reproducer `POCbank`


Vulnerable code:
		if (map->perm & R_PERM_RELOC) {
	if (map->perm & R_PERM_RELOC) {

Fixed code:
		if (map->perm & R_PERM_RELOC && map->reloc_map) {
	if (map->perm & R_PERM_RELOC && map->reloc_map) {
CVE-2023-1605 (C, published 2023-03-23T19:15Z)
Description: value: Denial of Service in GitHub repository radareorg/radare2 prior to 5.8.6.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/p/bin_coff.c
Commit message: fix segfault when bin->symbols is NULL #21503


Vulnerable code:
	for (i = 0; i < bin->hdr.f_nsyms; i++) {
		if (is_imported_symbol (&bin->symbols[i])) {
			nimports++;
		i += bin->symbols[i].n_numaux;

Fixed code:
	if (bin->symbols) {
		for (i = 0; i < bin->hdr.f_nsyms; i++) {
			if (is_imported_symbol (&bin->symbols[i])) {
				nimports++;
			}
			i += bin->symbols[i].n_numaux;