hitoshura25/cvefixes huggingface dataset:
CVE-2017-16909 (C++, published 2018-12-07T22:29Z)
Description: value: An error related to the "LibRaw::panasonic_load_raw()" function (dcraw_common.cpp) in LibRaw versions prior to 0.18.6 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash via a specially crafted TIFF image.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/LibRaw/LibRaw
Files changed:
dcraw/dcraw.c
internal/dcraw_common.cpp
libraw/libraw_const.h
Commit message: SECUNIA advisory 76000 #1 (wrong fuji width set via tiff tag


Vulnerable code:
  for (row = 0; row < height; row++)
      if ((RAW(row, col) = pred[col & 1]) > 4098 && col < width)
  for (row = 0; row < height; row++)
      if ((RAW(row, col) = pred[col & 1]) > 4098 && col < width)
  LIBRAW_WARN_FALLBACK_TO_AHD = 1 << 15

Fixed code:
  for (row = 0; row < raw_height; row++)
      if ((RAW(row, col) = pred[col & 1]) > 4098 && col < width && row < height)
#ifdef LIBRAW_LIBRARY_BUILD
  imgdata.process_warnings |=  LIBRAW_WARN_PARSEFUJI_PROCESSED; 
#endif
#ifdef LIBRAW_LIBRARY_BUILD
  // Clear erorneus fuji_width if not set through parse_fuji or for DNG
  if(fuji_width && !dng_version && !(imgdata.process_warnings & LIBRAW_WARN_PARSEFUJI_PROCESSED ))
     fuji_width = 0;
#endif
  for (row = 0; row < raw_height; row++)
      if ((RAW(row, col) = pred[col & 1]) > 4098 && col < width && row < height)
#ifdef LIBRAW_LIBRARY_BUILD
  imgdata.process_warnings |=  LIBRAW_WARN_PARSEFUJI_PROCESSED; 
#endif
#ifdef LIBRAW_LIBRARY_BUILD
  // Clear erorneus fuji_width if not set through parse_fuji or for DNG
  if(fuji_width && !dng_version && !(imgdata.process_warnings & LIBRAW_WARN_PARSEFUJI_PROCESSED ))
     fuji_width = 0;
#endif
  LIBRAW_WARN_FALLBACK_TO_AHD = 1 << 15,
  LIBRAW_WARN_PARSEFUJI_PROCESSED = 1 << 16
CVE-2017-16910 (C++, published 2018-12-07T22:29Z)
Description: value: An error within the "LibRaw::xtrans_interpolate()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.6 can be exploited to cause an invalid read memory access and subsequently a Denial of Service condition.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/LibRaw/LibRaw
Files changed:
dcraw/dcraw.c
internal/dcraw_common.cpp
Commit message: Secunia 76000 #2: xtrans allhex not initialized


Vulnerable code:
          row--;
          row--;

Fixed code:
  if(width < TS || height < TS)
	  throw LIBRAW_EXCEPTION_IO_CORRUPT; // too small image

 // Init allhex table to unreasonable values
 for(int i = 0; i < 3; i++)
  for(int j = 0; j < 3; j++)
   for(int k = 0; k < 2; k++)
    for(int l = 0; l < 8; l++)
     allhex[i][j][k][l]=32700;
  int minv=0,maxv=0,minh=0,maxh=0;
	    minv=MIN(v,minv);
	    maxv=MAX(v,maxv);
	    minh=MIN(v,minh);
   	    maxh=MAX(v,maxh);
#ifdef LIBRAW_LIBRARY_BUILD
   // Check allhex table initialization
  for(int i = 0; i < 3; i++)
    for(int j = 0; j < 3; j++)
      for(int k = 0; k < 2; k++)
        for(int l = 0; l < 8; l++)
	  if(allhex[i][j][k][l]>maxh+maxv*width+1 || allhex[i][j][k][l]<minh+minv*width-1)
	  throw LIBRAW_EXCEPTION_IO_CORRUPT;
  int retrycount = 0;
#endif
	{
           row--;
#ifdef LIBRAW_LIBRARY_BUILD
	  if(retrycount++ > width*height)
	  	throw LIBRAW_EXCEPTION_IO_CORRUPT;
#endif
	}
  if(width < TS || height < TS)
	  throw LIBRAW_EXCEPTION_IO_CORRUPT; // too small image

 // Init allhex table to unreasonable values
 for(int i = 0; i < 3; i++)
  for(int j = 0; j < 3; j++)
   for(int k = 0; k < 2; k++)
    for(int l = 0; l < 8; l++)
     allhex[i][j][k][l]=32700;
  int minv=0,maxv=0,minh=0,maxh=0;
	    minv=MIN(v,minv);
	    maxv=MAX(v,maxv);
	    minh=MIN(v,minh);
   	    maxh=MAX(v,maxh);
#ifdef LIBRAW_LIBRARY_BUILD
   // Check allhex table initialization
  for(int i = 0; i < 3; i++)
    for(int j = 0; j < 3; j++)
      for(int k = 0; k < 2; k++)
        for(int l = 0; l < 8; l++)
	  if(allhex[i][j][k][l]>maxh+maxv*width+1 || allhex[i][j][k][l]<minh+minv*width-1)
	  throw LIBRAW_EXCEPTION_IO_CORRUPT;
  int retrycount = 0;
#endif
	{
           row--;
#ifdef LIBRAW_LIBRARY_BUILD
	  if(retrycount++ > width*height)
	  	throw LIBRAW_EXCEPTION_IO_CORRUPT;
#endif
	}
CVE-2017-6886 (C++, published 2017-05-16T16:29Z)
Description: value: An error within the "parse_tiff_ifd()" function (internal/dcraw_common.cpp) in LibRaw versions before 0.18.2 can be exploited to corrupt memory.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/LibRaw/LibRaw
Files changed:
dcraw/dcraw.c
internal/dcraw_common.cpp
Commit message: Secunia SA75000 advisory: several buffer overruns


Vulnerable code:
      if (len > 2560000 || !(cbuf = (char *)malloc(len)))
    if (get4() == 0x48454150) /* "HEAP" */
      if (len > 2560000 || !(cbuf = (char *)malloc(len)))
    if (get4() == 0x48454150) /* "HEAP" */

Fixed code:
#ifdef LIBRAW_LIBRARY_BUILD
	if (ifd >= sizeof tiff_ifd / sizeof tiff_ifd[0])
	  throw LIBRAW_EXCEPTION_IO_CORRUPT;
#endif    
      if (len < 1 || len > 2560000 || !(cbuf = (char *)malloc(len)))
    if (get4() == 0x48454150
#ifdef LIBRAW_LIBRARY_BUILD
	&& (save+hlen) >= 0 && (save+hlen)<=ifp->size()
#endif
	) /* "HEAP" */
#ifdef LIBRAW_LIBRARY_BUILD
	if (ifd >= sizeof tiff_ifd / sizeof tiff_ifd[0])
	  throw LIBRAW_EXCEPTION_IO_CORRUPT;
#endif    
      if (len < 1 || len > 2560000 || !(cbuf = (char *)malloc(len)))
    if (get4() == 0x48454150
#ifdef LIBRAW_LIBRARY_BUILD
	&& (save+hlen) >= 0 && (save+hlen)<=ifp->size()
#endif
	) /* "HEAP" */
CVE-2017-6887 (C++, published 2017-05-16T16:29Z)
Description: value: A boundary error within the "parse_tiff_ifd()" function (internal/dcraw_common.cpp) in LibRaw versions before 0.18.2 can be exploited to cause a memory corruption via e.g. a specially crafted KDC file with model set to "DSLR-A100" and containing multiple sequences of 0x100 and 0x14A TAGs.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/LibRaw/LibRaw
Files changed:
dcraw/dcraw.c
internal/dcraw_common.cpp
Commit message: Secunia SA75000 advisory: several buffer overruns


Vulnerable code:
      if (len > 2560000 || !(cbuf = (char *)malloc(len)))
    if (get4() == 0x48454150) /* "HEAP" */
      if (len > 2560000 || !(cbuf = (char *)malloc(len)))
    if (get4() == 0x48454150) /* "HEAP" */

Fixed code:
#ifdef LIBRAW_LIBRARY_BUILD
	if (ifd >= sizeof tiff_ifd / sizeof tiff_ifd[0])
	  throw LIBRAW_EXCEPTION_IO_CORRUPT;
#endif    
      if (len < 1 || len > 2560000 || !(cbuf = (char *)malloc(len)))
    if (get4() == 0x48454150
#ifdef LIBRAW_LIBRARY_BUILD
	&& (save+hlen) >= 0 && (save+hlen)<=ifp->size()
#endif
	) /* "HEAP" */
#ifdef LIBRAW_LIBRARY_BUILD
	if (ifd >= sizeof tiff_ifd / sizeof tiff_ifd[0])
	  throw LIBRAW_EXCEPTION_IO_CORRUPT;
#endif    
      if (len < 1 || len > 2560000 || !(cbuf = (char *)malloc(len)))
    if (get4() == 0x48454150
#ifdef LIBRAW_LIBRARY_BUILD
	&& (save+hlen) >= 0 && (save+hlen)<=ifp->size()
#endif
	) /* "HEAP" */
CVE-2018-5813 (C++, published 2018-12-07T22:29Z)
Description: value: An error within the "parse_minolta()" function (dcraw/dcraw.c) in LibRaw versions prior to 0.18.11 can be exploited to trigger an infinite loop via a specially crafted file.
Severity: HIGH (CVSS v3 base score: 6.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/LibRaw/LibRaw
Files changed:
dcraw/dcraw.c
internal/dcraw_common.cpp
Commit message: Secunia Advisory SA83050: possible infinite loop in parse_minolta()


Vulnerable code:

Fixed code:
#ifdef LIBRAW_LIBRARY_BUILD
  if(offset>ifp->size()-8) // At least 8 bytes for tag/len
    offset = ifp->size()-8;
#endif

    if(len < 0)
      return; // just ignore wrong len?? or raise bad file exception?
#ifdef LIBRAW_LIBRARY_BUILD
  if(offset>ifp->size()-8) // At least 8 bytes for tag/len
    offset = ifp->size()-8;
#endif

    if(len < 0)
      return; // just ignore wrong len?? or raise bad file exception?
CVE-2020-15503 (C++, published 2020-07-02T14:15Z)
Description: value: LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpack_thumb.cpp, postprocessing/mem_image.cpp, and utils/thumb_utils.cpp. For example, malloc(sizeof(libraw_processed_image_t)+T.tlength) occurs without validating T.tlength.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/LibRaw/LibRaw
Files changed:
libraw/libraw_const.h
src/decoders/unpack_thumb.cpp
src/postprocessing/mem_image.cpp
src/utils/thumb_utils.cpp
Commit message: Thumbnail size range check


Vulnerable code:

Fixed code:
#ifndef LIBRAW_MAX_ALLOC_MB_DEFAULT
#endif

/* limit thumbnail size, default is 512Mb*/
#ifndef LIBRAW_MAX_THUMBNAIL_MB
#define LIBRAW_MAX_THUMBNAIL_MB 512L
#endif
#define THUMB_SIZE_CHECKT(A) \
  do { \
    if (INT64(A) > 1024ULL * 1024ULL * LIBRAW_MAX_THUMBNAIL_MB) throw LIBRAW_EXCEPTION_IO_CORRUPT; \
    if (INT64(A) > 0 &&  INT64(A) < 64ULL)        throw LIBRAW_EXCEPTION_IO_CORRUPT; \
  } while (0)

#define THUMB_SIZE_CHECKTNZ(A) \
  do { \
    if (INT64(A) > 1024ULL * 1024ULL * LIBRAW_MAX_THUMBNAIL_MB) throw LIBRAW_EXCEPTION_IO_CORRUPT; \
    if (INT64(A) < 64ULL)        throw LIBRAW_EXCEPTION_IO_CORRUPT; \
  } while (0)


#define THUMB_SIZE_CHECKWH(W,H) \
  do { \
    if (INT64(W)*INT64(H) > 1024ULL * 1024ULL * LIBRAW_MAX_THUMBNAIL_MB) throw LIBRAW_EXCEPTION_IO_CORRUPT; \
    if (INT64(W)*INT64(H) < 64ULL)        throw LIBRAW_EXCEPTION_IO_CORRUPT; \
  } while (0)

        THUMB_SIZE_CHECKT(tsize);
        THUMB_SIZE_CHECKTNZ(T.tlength);

        THUMB_SIZE_CHECKWH(T.twidth, T.theight);

        THUMB_SIZE_CHECKWH(T.twidth, T.theight);
        THUMB_SIZE_CHECKWH(T.twidth, T.theight);
            THUMB_SIZE_CHECKTNZ(T.tlength);
        THUMB_SIZE_CHECKTNZ(T.tlength);

        THUMB_SIZE_CHECKTNZ(o_length);
        THUMB_SIZE_CHECKTNZ(i_length);
        THUMB_SIZE_CHECKTNZ(T.tlength);

  if (T.tlength < 64u)
  {
      if (errcode)
          *errcode = EINVAL;
      return NULL;
  }

  if (INT64(T.tlength) > 1024ULL * 1024ULL * LIBRAW_MAX_THUMBNAIL_MB)
  {
      if (errcode)
          *errcode = LIBRAW_TOO_BIG;
      return NULL;
  }

  if(INT64(T.theight) * INT64(T.twidth) > 1024ULL * 1024ULL * LIBRAW_MAX_THUMBNAIL_MB)
      throw LIBRAW_EXCEPTION_IO_CORRUPT;

  if (INT64(T.theight) * INT64(T.twidth) < 64ULL)
      throw LIBRAW_EXCEPTION_IO_CORRUPT;
CVE-2020-24870 (C++, published 2021-06-02T16:15Z)
Description: value: Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/LibRaw/LibRaw
Files changed:
src/metadata/identify.cpp
Commit message: limit loops to MIN(colors,4) in dng fields parser


Vulnerable code:
							for (int i = 0; i < colors; i++)
							for (int i = 0; i < colors; i++)
						FORCC for (int i = 0; i < 3; i++) for (cam_xyz[c][i] = j = 0;
							j < colors; j++)
							cam_xyz[c][i] +=
							cc[c][j] * cm[j][i]; // add AsShotXY later * xyz[i];
					for (unsigned c = 0; c < tiff_samples; c++)

Fixed code:
							for (int i = 0; i < colors && i < 4; i++)
							for (int i = 0; i < colors && i < 4; i++)
						FORCC for (int i = 0; i < 3; i++) 
                            for (cam_xyz[c][i] = j = 0; j < colors && j < 4; j++)
							    cam_xyz[c][i] +=
							        cc[c][j] * cm[j][i]; // add AsShotXY later * xyz[i];
					for (unsigned c = 0; c < tiff_samples && c < 4; c++)
CVE-2020-35530 (C++, published 2022-09-01T18:15Z)
Description: value: In LibRaw, there is an out-of-bounds write vulnerability within the "new_node()" function (libraw\src\x3f\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/LibRaw/LibRaw
Files changed:
internal/x3f_tools.h
src/x3f/x3f_utils_patched.cpp
Commit message: X3F: check huffman tree size


Vulnerable code:

Fixed code:
  uint32_t total_node_index;
  HTP->total_node_index = HUF_TREE_MAX_NODES(leaves);
	if (tree->free_node_index >= tree->total_node_index)
		throw LIBRAW_EXCEPTION_IO_CORRUPT;
CVE-2020-35531 (C++, published 2022-09-01T18:15Z)
Description: value: In LibRaw, an out-of-bounds read vulnerability exists within the get_huffman_diff() function (libraw\src\x3f\x3f_utils_patched.cpp) when reading data from an image file.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/LibRaw/LibRaw
Files changed:
src/x3f/x3f_utils_patched.cpp
Commit message: X3F: check for data offset limit


Vulnerable code:

Fixed code:
  if (HUF->row_offsets.element[row] > ID->data_size - 1)
	  throw LIBRAW_EXCEPTION_IO_CORRUPT;
CVE-2020-35532 (C++, published 2022-09-01T18:15Z)
Description: value: In LibRaw, an out-of-bounds read vulnerability exists within the "simple_decode_row()" function (libraw\src\x3f\x3f_utils_patched.cpp) which can be triggered via an image with a large row_stride field.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/LibRaw/LibRaw
Files changed:
src/x3f/x3f_utils_patched.cpp
Commit message: X3F/simple_decode_row: check for data offset limit


Vulnerable code:

Fixed code:
  if (row*row_stride > ID->data_size - (ID->columns*sizeof(uint32_t)))
	  throw LIBRAW_EXCEPTION_IO_CORRUPT;
CVE-2020-35533 (C++, published 2022-09-01T18:15Z)
Description: value: In LibRaw, an out-of-bounds read vulnerability exists within the "LibRaw::adobe_copy_pixel()" function (libraw\src\decoders\dng.cpp) when reading data from the image file.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/LibRaw/LibRaw
Files changed:
src/decoders/decoders_dcraw.cpp
Commit message: more room for ljpeg row


Vulnerable code:
  jh->row = (ushort *)calloc(jh->wide * jh->clrs, 4);

Fixed code:
  jh->row = (ushort *)calloc(jh->wide * jh->clrs, 16);
CVE-2020-35534 (C++, published 2022-09-01T18:15Z)
Description: value: In LibRaw, there is a memory corruption vulnerability within the "crxFreeSubbandData()" function (libraw\src\decoders\crx.cpp) when processing cr3 files.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/LibRaw/LibRaw
Files changed:
libraw/libraw_const.h
src/decoders/crx.cpp
Commit message: CR3 decoder: use mempool for memory


Vulnerable code:
int crxParamInit(CrxBandParam **param, uint64_t subbandMdatOffset,
  uint8_t *paramBuf = (uint8_t *)calloc(
  planeComp->compBuf = (uint8_t *)malloc(compDataSize);
      if (crxParamInit(&subbands[subbandNum].bandParam,
    img->tiles = (CrxTile *)malloc(
        sizeof(CrxSubband) * nTiles * img->nPlanes * img->subbandCount);
        (int16_t *)malloc(img->planeHeight * img->planeWidth * img->nPlanes *


Fixed code:
#ifndef LIBRAW_NO_CR3_MEMPOOL
#define LIBRAW_CR3_MEMPOOL
#endif


#ifdef LIBRAW_CR3_MEMPOOL
  libraw_memmgr memmgr;
  CrxImage() : memmgr(0){}
#endif
int crxParamInit(
#ifdef LIBRAW_CR3_MEMPOOL
	libraw_memmgr&  mm,
#endif	
	CrxBandParam **param, uint64_t subbandMdatOffset,
  uint8_t *paramBuf = (uint8_t *)
#ifdef LIBRAW_CR3_MEMPOOL
	  mm.
#endif
	  calloc(
  planeComp->compBuf = (uint8_t *)
#ifdef LIBRAW_CR3_MEMPOOL
	  img->memmgr.
#endif
	  malloc(compDataSize);
      if (crxParamInit(
#ifdef LIBRAW_CR3_MEMPOOL
		  img->memmgr,
#endif
		  &subbands[subbandNum].bandParam,
    img->tiles = (CrxTile *)
#ifdef LIBRAW_CR3_MEMPOOL
		img->memmgr.
#endif
		calloc(
        sizeof(CrxSubband) * nTiles * img->nPlanes * img->subbandCount,1);
        (int16_t *)
#ifdef LIBRAW_CR3_MEMPOOL
		img->memmgr.
#endif
		malloc(img->planeHeight * img->planeWidth * img->nPlanes *
#ifdef LIBRAW_CR3_MEMPOOL
	img->memmgr.cleanup();
#else
#endif
CVE-2021-32142 (C++, published 2023-02-17T18:15Z)
Description: value: Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRaw_buffer_datastream::gets(char*, int) in /src/libraw/src/libraw_datastream.cpp.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/LibRaw/LibRaw
Files changed:
src/libraw_datastream.cpp
Commit message: check for input buffer size on datastream::gets


Vulnerable code:

Fixed code:
  if(sz<1) return NULL;
  if(sz<1) return NULL;
  if(sz<1) return NULL;
CVE-2011-4596 (Python, published 2011-12-23T22:55Z)
Description: value: Multiple directory traversal vulnerabilities in OpenStack Nova before 2011.3.1, when the EC2 API and the S3/RegisterImage image-registration method are enabled, allow remote authenticated users to overwrite arbitrary files via a crafted (1) tarball or (2) manifest.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/openstack/nova
Files changed:
MANIFEST.in
nova/image/s3.py
nova/tests/image/test_s3.py
Commit message: Sanitize EC2 manifests and image tarballs

Prevent potential directory traversal with malicious EC2 image tarballs,
by making sure the tarfile is safe before unpacking it. Fixes bug 894755

Prevent potential directory traversal with malicious file names in
EC2 image manifests. Fixes bug 885167

Change-Id: If6109047307bd6e654ee9d1254f0d7f31cf741c1


Vulnerable code:
        local_filename = os.path.join(local_dir, filename)

Fixed code:
include nova/tests/image/*.tar.gz
        local_filename = os.path.join(local_dir, os.path.basename(filename))
    @staticmethod
    def _test_for_malicious_tarball(path, filename):
        """Raises exception if extracting tarball would escape extract path"""
        tar_file = tarfile.open(filename, 'r|gz')
        for n in tar_file.getnames():
            if not os.path.abspath(os.path.join(path, n)).startswith(path):
                tar_file.close()
                raise exception.Error(_('Unsafe filenames in image'))
        tar_file.close()

        S3ImageService._test_for_malicious_tarball(path, filename)
import os


    def test_s3_malicious_tarballs(self):
        self.assertRaises(exception.Error,
            self.image_service._test_for_malicious_tarball,
            "/unused", os.path.join(os.path.dirname(__file__), 'abs.tar.gz'))
        self.assertRaises(exception.Error,
            self.image_service._test_for_malicious_tarball,
            "/unused", os.path.join(os.path.dirname(__file__), 'rel.tar.gz'))
CVE-2012-2654 (Python, published 2012-06-21T15:55Z)
Description: value: The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to bypass intended access restrictions.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/openstack/nova
Files changed:
nova/api/ec2/cloud.py
nova/api/openstack/compute/contrib/security_groups.py
nova/virt/firewall.py
Commit message: Fix up protocol case handling for security groups.

Fix bug 985184.

When creating security group rules, any case for the protocol was
accepted as input, such as TCP, Tcp, tcp, etc., and was stored in the
database as specified.  However, unless specified as all lowercase, the
code to apply the rules would break and result in some rules not being
applied.

Change-Id: I6c723d371579eb37a94bd484d39beeb773668ed4


Vulnerable code:
            values['protocol'] = ip_protocol
            values['protocol'] = ip_protocol
                protocol = rule.protocol
                if version == 6 and rule.protocol == 'icmp':

Fixed code:
            values['protocol'] = ip_protocol.lower()
            values['protocol'] = ip_protocol.lower()
                protocol = rule.protocol.lower()
                if version == 6 and protocol == 'icmp':