hitoshura25/cvefixes huggingface dataset:
CVE-2018-14015 (C, published 2018-07-12T20:29Z)
Description: value: The sdb_set_internal function in sdb.c in radare2 2.7.0 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted ELF file because of missing input validation in r_bin_dwarf_parse_comp_unit in libr/bin/dwarf.c.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/dwarf.c
Commit message: Fix #10465 - Avoid string on low addresses (workaround) for corrupted dwarf (#10478)



Vulnerable code:
				sdb_set (s, "DW_AT_comp_dir", name, 0);

Fixed code:
				if (name > 1024) { // solve some null derefs
					sdb_set (s, "DW_AT_comp_dir", name, 0);
				} else {
					eprintf ("Invalid string pointer at %p\n", name);
				}
CVE-2018-14016 (C, published 2018-07-12T20:29Z)
Description: value: The r_bin_mdmp_init_directory_entry function in mdmp.c in radare2 2.7.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted Mini Crash Dump file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/format/mdmp/mdmp.c
Commit message: Fix #10464 - oobread crash in mdmp (#10683)



Vulnerable code:
		eprintf("[ERROR] Size Mismatch - Stream data is larger than file size!\n");
	ut8 *directory_base;
	struct minidump_directory *entry;

	directory_base = obj->b->buf + obj->hdr->stream_directory_rva;
		entry = (struct minidump_directory *)(directory_base + (i * sizeof (struct minidump_directory)));
		r_bin_mdmp_init_directory_entry (obj, entry);

Fixed code:
		eprintf ("[ERROR] Size Mismatch - Stream data is larger than file size!\n");
	struct minidump_directory entry;
	ut64 rvadir = obj->hdr->stream_directory_rva;
		ut32 delta = i * sizeof (struct minidump_directory);
		int r = r_buf_read_at (obj->b, rvadir + delta, (ut8*) &entry, sizeof (struct minidump_directory));
		if (r) {
			r_bin_mdmp_init_directory_entry (obj, &entry);
		}
CVE-2018-14017 (C, published 2018-07-12T20:29Z)
Description: value: The r_bin_java_annotation_new function in shlr/java/class.c in radare2 2.7.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted .class file because of missing input validation in r_bin_java_line_number_table_attr_new.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
shlr/java/class.c
Commit message: Fix #10498 - Fix crash in fuzzed java files (#10511)



Vulnerable code:
	char *name = NULL;
	RBinJavaAttrMetas *type_info = NULL;
	name = r_bin_java_get_utf8_from_bin_cp_list (R_BIN_JAVA_GLOBAL_BIN, name_idx);
	type_info = r_bin_java_get_attr_type_by_name (name);
	if (attr->info.code_attr.code == NULL) {
	if (linenum_len > sz) {
		free (attr);
		return NULL;
	}

Fixed code:

	char *name = r_bin_java_get_utf8_from_bin_cp_list (R_BIN_JAVA_GLOBAL_BIN, name_idx);
	RBinJavaAttrMetas *type_info = r_bin_java_get_attr_type_by_name (name);
	if (!attr->info.code_attr.code) {
		// wtf it works
		if (offset - 2 > sz) {
			break;
		}
		if (offset + 10 > sz) {
			eprintf ("oob");
			break;
		}
CVE-2018-20457 (C, published 2018-12-25T19:29Z)
Description: value: In radare2 through 3.1.3, the assemble function inside libr/asm/p/asm_arm_cs.c allows attackers to cause a denial-of-service (application crash via an r_num_calc out-of-bounds read) by crafting an arm assembly input because a loop uses an incorrect index in armass.c and certain length validation is missing in armass64.c, a related issue to CVE-2018-20459.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/asm/arch/arm/armass.c
libr/asm/arch/arm/armass64.c
Commit message: Fix #12417/#12418 (arm assembler heap overflows)



Vulnerable code:
	for (i = j = 0; i < sizeof (buf) - 1 && str[i]; i++, j++) {
		if (op->operands[operand].shift != ARM_NO_SHIFT) {

Fixed code:
	for (i = j = 0; i < sizeof (buf) - 1 && str[j]; i++, j++) {
		if (strlen (token) > 4 && op->operands[operand].shift != ARM_NO_SHIFT) {
CVE-2018-20458 (C, published 2018-12-25T19:29Z)
Description: value: In radare2 prior to 3.1.1, r_bin_dyldcache_extract in libr/bin/format/mach0/dyldcache.c may allow attackers to cause a denial-of-service (application crash caused by out-of-bounds read) by crafting an input file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/format/mach0/dyldcache.c
Commit message: Fix #12374 - oobread crash in truncated dyldcache ##bin (#12381)



Vulnerable code:
/* radare - LGPL - Copyright 2010-2016 - nibble, pancake  */
		perror ("malloc (ret)");
	image_infos = (struct dyld_cache_image_info*) (bin->b->buf + bin->hdr.startaddr);
	dyld_vmbase = *(ut64 *)(bin->b->buf + bin->hdr.baseaddroff);
	if (image_infos[idx].pathFileOffset > bin->size) {
	    eprintf ("corrupted file\n");
	libname = (char *)(bin->b->buf + image_infos[idx].pathFileOffset);
	struct r_bin_dyldcache_obj_t *bin;
	if (!(bin = malloc (sizeof (struct r_bin_dyldcache_obj_t)))) {
	memset (bin, 0, sizeof (struct r_bin_dyldcache_obj_t));
	bin->b = r_buf_new();
	if (!r_buf_set_bytes (bin->b, buf, size)) {

Fixed code:
/* radare - LGPL - Copyright 2010-2018 - nibble, pancake  */
// make it public in util/buf.c ?
static ut64 r_buf_read64le (RBuffer *buf, ut64 off) {
	ut8 data[8] = {0};
	r_buf_read_at (buf, off, data, 8);
	return r_read_le64 (data);
}

static char *r_buf_read_string (RBuffer *buf, ut64 addr, int len) {
	ut8 *data = malloc (len);
	if (data) {
		r_buf_read_at (buf, addr, data, len);
		data[len-1] = 0;
		return data;
	}
	return NULL;
}


	int sz = bin->nlibs * sizeof (struct dyld_cache_image_info);
	image_infos = malloc (sz); //(struct dyld_cache_image_info*) (bin->b->buf + bin->hdr.startaddr);
	if (!image_infos) {
		free (ret);
		return NULL;
	}
	r_buf_read_at (bin->b, bin->hdr.startaddr, (ut8*)image_infos, sz);
	dyld_vmbase = r_buf_read64le (bin->b, bin->hdr.baseaddroff);
	int pfo = image_infos[idx].pathFileOffset;
	if (pfo < 0 || pfo > bin->size) {
		eprintf ("corrupted file: pathFileOffset > bin->size (%d)\n", pfo);
	libname = r_buf_read_string (bin->b, pfo, 64);
	struct r_bin_dyldcache_obj_t *bin = R_NEW0 (struct r_bin_dyldcache_obj_t);
	if (!bin) {
	bin->b = r_buf_new ();
	if (!bin->b || !r_buf_set_bytes (bin->b, buf, size)) {
CVE-2018-20459 (C, published 2018-12-25T19:29Z)
Description: value: In radare2 through 3.1.3, the armass_assemble function in libr/asm/arch/arm/armass.c allows attackers to cause a denial-of-service (application crash by out-of-bounds read) by crafting an arm assembly input because a loop uses an incorrect index in armass.c and certain length validation is missing in armass64.c, a related issue to CVE-2018-20457.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/asm/arch/arm/armass.c
libr/asm/arch/arm/armass64.c
Commit message: Fix #12417/#12418 (arm assembler heap overflows)



Vulnerable code:
	for (i = j = 0; i < sizeof (buf) - 1 && str[i]; i++, j++) {
		if (op->operands[operand].shift != ARM_NO_SHIFT) {

Fixed code:
	for (i = j = 0; i < sizeof (buf) - 1 && str[j]; i++, j++) {
		if (strlen (token) > 4 && op->operands[operand].shift != ARM_NO_SHIFT) {
CVE-2019-16718 (C, published 2019-09-23T14:15Z)
Description: value: In radare2 before 3.9.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to an insufficient fix for CVE-2019-14745 and improper handling of symbol names embedded in executables.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/core/cbin.c
Commit message: More fixes for the CVE-2019-14745


Vulnerable code:
		switch (*arg) {
			*b++ = *arg;
							r_cons_printf ("k bin/pe/%s/%d=%s.%s\n",
							r_cons_printf ("k bin/pe/%s/%d=%s\n",

Fixed code:
		case '"':
		case '\\':
		char ch = *arg;
		switch (ch) {
		case '=':
			*b++ = ch;
							r_cons_printf ("\"k bin/pe/%s/%d=%s.%s\"\n",
							r_cons_printf ("\"k bin/pe/%s/%d=%s\"\n",
CVE-2019-16718 (C, published 2019-09-23T14:15Z)
Description: value: In radare2 before 3.9.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to an insufficient fix for CVE-2019-14745 and improper handling of symbol names embedded in executables.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/core/cmd.c
Commit message: Fix #14990 - multiple quoted command parsing issue ##core

	> "?e hello""?e world"
	hello
	world"
	> "?e hello";"?e world"
	hello
	world


Vulnerable code:
						cmd = p + 1;
						*p = '"';

Fixed code:
			char op0 = 0;
						op0 = *q;
						cmd = p;
						*p = op0;
CVE-2020-27793 (C, published 2022-08-19T23:15Z)
Description: value: An off-by-one overflow flaw was found in radare2 due to mismatched array length in core_java.c. This could allow an attacker to cause a crash, and perform a denail of service attack.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-193 \u2014 Off-by-one Error
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/core/p/core_java.c
Commit message: Fix unmatched array length in core_java.c (issue #16304) (#16313)



Vulnerable code:
	for (; i < END_CMDS; i++) {

Fixed code:
	for (; i < END_CMDS - 1; i++) {
CVE-2020-27794 (C, published 2022-08-19T23:15Z)
Description: value: A double free issue was discovered in radare2 in cmd_info.c:cmd_info(). Successful exploitation could lead to modification of unexpected memory locations and potentially causing a crash.
Severity: nan (CVSS v3 base score: 9.1)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/core/core.c
Commit message: Fix #16303 - c->table_query double free (#16318)



Vulnerable code:
	free (c->table_query);

Fixed code:
	R_FREE (c->table_query);
CVE-2020-27795 (Other, published 2022-08-19T23:15Z)
Description: value: A segmentation fault was discovered in radare2 with adf command. In libr/core/cmd_anal.c, when command "adf" has no or wrong argument, anal_fcn_data (core, input + 1) --> RAnalFunction *fcn = r_anal_get_fcn_in (core->anal, core->offset, -1); returns null pointer for fcn causing segmentation fault later in ensure_fcn_range (fcn).
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-908 \u2014 Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/core/cmd_anal.c
test/new/db/anal/x86_32
Commit message: Fix segfault in adf  (#16230)



Vulnerable code:
	RAnalFunction *fcn = r_anal_get_fcn_in (core->anal, core->offset, -1);
	ut32 fcn_size = r_anal_function_size_from_entry (fcn);

Fixed code:
	RAnalFunction *fcn = r_anal_get_fcn_in (core->anal, core->offset, R_ANAL_FCN_TYPE_ANY);
		ut32 fcn_size = r_anal_function_size_from_entry (fcn);
NAME=adf bug #16215
FILE=-
EXPECT=<<EOF
EOF
CMDS=<<EOF
adf
EOF
CVE-2021-32494 (C, published 2023-07-07T19:15Z)
Description: value: Radare2 has a division by zero vulnerability in Mach-O parser's rebase_buffer function. This allow attackers to create malicious inputs that can cause denial of service.



Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/p/bin_mach0.c
Commit message: Fix #18667 - division by zero in the macho parser ##bin


Vulnerable code:
/* radare - LGPL - Copyright 2009-2019 - pancake */
		ut64 page_size = obj->chained_starts[i]->page_size;

Fixed code:
/* radare - LGPL - Copyright 2009-2021 - pancake */
		int page_size = obj->chained_starts[i]->page_size;
		if (page_size < 1) {
			page_size = 4096;
		}
CVE-2021-32495 (C, published 2023-07-07T19:15Z)
Description: value: Radare2 has a use-after-free vulnerability in pyc parser's get_none_object function. Attacker can read freed memory afterwards. This will allow attackers to cause denial of service.


Severity: nan (CVSS v3 base score: 9.1)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/format/pyc/marshal.c
Commit message: Fix #18666 - uaf in python bin parser


Vulnerable code:
/* radare - LGPL3 - Copyright 2016-2020 - Matthieu (c0riolis) Tardy - l0stb1t*/
	pyc_object *ret;

	ret = R_NEW0 (pyc_object);
		free_object (ref_idx->data);

Fixed code:
/* radare - LGPL3 - Copyright 2016-2021 - Matthieu (c0riolis) Tardy - l0stb1t*/
	pyc_object *ret = R_NEW0 (pyc_object);
		if (ref_idx->data != ret) {
			free_object (ref_idx->data);
		}
CVE-2021-32613 (C, published 2021-05-14T13:15Z)
Description: value: In radare2 through 5.3.0 there is a double free vulnerability in the pyc parse via a crafted file which can lead to DoS.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/p/bin_mach0.c
Commit message: Fix #18667 - division by zero in the macho parser ##bin


Vulnerable code:
/* radare - LGPL - Copyright 2009-2019 - pancake */
		ut64 page_size = obj->chained_starts[i]->page_size;

Fixed code:
/* radare - LGPL - Copyright 2009-2021 - pancake */
		int page_size = obj->chained_starts[i]->page_size;
		if (page_size < 1) {
			page_size = 4096;
		}
CVE-2021-32613 (C, published 2021-05-14T13:15Z)
Description: value: In radare2 through 5.3.0 there is a double free vulnerability in the pyc parse via a crafted file which can lead to DoS.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/format/pyc/marshal.c
Commit message: Fix #18666 - uaf in python bin parser


Vulnerable code:
/* radare - LGPL3 - Copyright 2016-2020 - Matthieu (c0riolis) Tardy - l0stb1t*/
	pyc_object *ret;

	ret = R_NEW0 (pyc_object);
		free_object (ref_idx->data);

Fixed code:
/* radare - LGPL3 - Copyright 2016-2021 - Matthieu (c0riolis) Tardy - l0stb1t*/
	pyc_object *ret = R_NEW0 (pyc_object);
		if (ref_idx->data != ret) {
			free_object (ref_idx->data);
		}
CVE-2022-0139 (C, published 2022-02-08T19:15Z)
Description: value: Use After Free in GitHub repository radareorg/radare2 prior to 5.6.0.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/io/io_bank.c
Commit message: Fix use-after-free in iobank rbtree usage ##io

* See havoc4 bin for reproducer
* Reported via huntr.dev by 'Cen Zhang'


Vulnerable code:
		r_crbtree_delete (bank->submaps, entry->data, _find_sm_by_from_vaddr_cb, NULL);

Fixed code:
		bool a = r_crbtree_delete (bank->submaps, entry->data, _find_sm_by_from_vaddr_cb, NULL);
		if (!a) {
			break;
		}
CVE-2022-0173 (C, published 2022-01-11T17:15Z)
Description: value: radare2 is vulnerable to Out-of-bounds Read
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/io/io_bank.c
Commit message: Fix use-after-free in iobank rbtree usage ##io

* See havoc4 bin for reproducer
* Reported via huntr.dev by 'Cen Zhang'


Vulnerable code:
		r_crbtree_delete (bank->submaps, entry->data, _find_sm_by_from_vaddr_cb, NULL);

Fixed code:
		bool a = r_crbtree_delete (bank->submaps, entry->data, _find_sm_by_from_vaddr_cb, NULL);
		if (!a) {
			break;
		}
CVE-2022-0419 (C, published 2022-02-01T11:15Z)
Description: value: NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.0.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/p/bin_xnu_kernelcache.c
Commit message: Fix null deref in xnu.kernelcache ##crash

* Reported by @xshad3 via huntr.dev


Vulnerable code:
	obj->cache_buf = NULL;

Fixed code:
	if (obj) {
		obj->cache_buf = NULL;
	}
CVE-2022-0476 (C, published 2022-02-23T17:15Z)
Description: value: Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/format/mdmp/mdmp.c
Commit message: Fix DoS in the minidump parser ##crash

* Reported by lazymio via huntr.dev
* Reproducer: mdmp-dos


Vulnerable code:
static void read_module(RBuffer *b, ut64 addr, struct minidump_module *module) {
	r_buf_seek (b, addr, R_BUF_SET);
		for (i = 0; i < module_list.number_of_modules; i++) {
			struct minidump_module *module = R_NEW (struct minidump_module);
				break;
			read_module (obj->b, offset, module);
		for (i = 0; i < memory_list.number_of_memory_ranges; i++) {
		for (i = 0; i < thread_ex_list.number_of_threads; i++) {
		for (i = 0; i < memory64_list.number_of_memory_ranges; i++) {
		for (i = 0; i < unloaded_module_list.number_of_entries; i++) {
		for (i = 0; i < memory_info_list.number_of_entries; i++) {
		for (i = 0; i < thread_info_list.number_of_entries; i++) {
		for (i = 0; i < handle_operation_list.number_of_entries; i++) {
		for (i = 0; i < token_info_list.number_of_entries; i++) {

Fixed code:
static struct minidump_module *read_module(RBuffer *b, ut64 addr) {
	if (r_buf_seek (b, addr, R_BUF_SET) == -1) {
		return NULL;
	}
	struct minidump_module *module = R_NEW0 (struct minidump_module);
	if (!module) {
		return NULL;
	}
	return module;
		for (i = 0; i < module_list.number_of_modules && offset < obj->size; i++) {
			struct minidump_module *module = read_module (obj->b, offset);
				break;	
		for (i = 0; i < memory_list.number_of_memory_ranges && offset < obj->size; i++) {
		for (i = 0; i < thread_ex_list.number_of_threads && offset < obj->size; i++) {
		for (i = 0; i < memory64_list.number_of_memory_ranges && offset < obj->size; i++) {
		for (i = 0; i < unloaded_module_list.number_of_entries && offset < obj->size; i++) {
		for (i = 0; i < memory_info_list.number_of_entries && offset < obj->size; i++) {
		for (i = 0; i < thread_info_list.number_of_entries && offset < obj->size; i++) {
		for (i = 0; i < handle_operation_list.number_of_entries && offset < obj->size; i++) {
		for (i = 0; i < token_info_list.number_of_entries && offset < obj->size; i++) {
CVE-2022-0518 (C, published 2022-02-08T21:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.2.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
shlr/java/class.c
Commit message: Fix oobread segfault in java arith8.class ##crash

* Reported by Cen Zhang via huntr.dev


Vulnerable code:
		if (offset + 8 > sz) {

Fixed code:
	if (buf_offset + offset + 8 > sz) {
		eprintf ("Invalid amount of inner classes\n");
		return NULL;
	}
		if (buf_offset + offset + 8 > sz) {
CVE-2022-0520 (C, published 2022-02-08T21:15Z)
Description: value: Use After Free in NPM radare2.js prior to 5.6.2.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/format/pyc/marshal.c
Commit message: Fix bins/*/rep8 - UAF crash in pyc parser ##crash

* Reported by Cen Zhang via huntr.dev


Vulnerable code:
		r_list_pop (refs);

Fixed code:
		// r_list_pop (refs);