hitoshura25/cvefixes huggingface dataset:
CVE-2022-0522 (C, published 2022-02-08T21:15Z)
Description: value: Access of Memory Location Before Start of Buffer in NPM radare2.js prior to 5.6.2.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/anal/p/anal_arm_cs.c
Commit message: Fix negative index in anal.arm64.cs ##crash

* Reported by Cen Zhang via huntr.dev


Vulnerable code:
#define VEC64_MASK(sh, sz) (bitmask_by_width[63]^(bitmask_by_width[sz-1]<<sh))


Fixed code:
#define VEC64_MASK(sh, sz) (bitmask_by_width[63]^(bitmask_by_width[sz>0?sz-1:0]<<sh))
CVE-2022-0523 (C, published 2022-02-08T21:15Z)
Description: value: Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/format/pyc/marshal.c
Commit message: Fix UAF in pyc parser ##crash

* Reported by Cen Zhang via huntr.dev
* Reproducer: bins/fuzzed/harep2.pyc


Vulnerable code:
/* radare - LGPL3 - Copyright 2016-2021 - Matthieu (c0riolis) Tardy - l0stb1t*/
static ut32 magic_int;
static ut32 symbols_ordinal = 0;
static RList *refs = NULL; // If you don't have a good reason, do not change this. And also checkout !refs in get_code_object()
		if (!tmp) {
			r_list_free (ret->data);
			R_FREE (ret);
			return NULL;
		}
		if (!r_list_append (ret->data, tmp)) {
/* */
	pyc_object *ret = NULL;
	ut32 n = 0;

	n = get_ut32 (buffer, &error);
	ret = get_array_object_generic (buffer, n);
		return ret;
	return NULL;
	ut32 n = 0;

	n = get_ut32 (buffer, &error);
	pyc_object *ret = NULL;
	ret = get_array_object_generic (buffer, n);
	if (!ret) {
		return NULL;
	ret->type = TYPE_SET;

Fixed code:
/* radare - LGPL3 - Copyright 2016-2022 - Matthieu (c0riolis) Tardy - l0stb1t */
static R_TH_LOCAL ut32 magic_int;
static R_TH_LOCAL ut32 symbols_ordinal = 0;
static R_TH_LOCAL RList *refs = NULL; // If you don't have a good reason, do not change this. And also checkout !refs in get_code_object()
		if (!tmp || !r_list_append (ret->data, tmp)) {
			((RList*)ret->data)->free = NULL;
	ut32 n = get_ut32 (buffer, &error);
	pyc_object *ret = get_array_object_generic (buffer, n);
	return ret;
	ut32 n = get_ut32 (buffer, &error);
	pyc_object *ret = get_array_object_generic (buffer, n);
	if (ret) {
		ret->type = TYPE_SET;
CVE-2022-0559 (C, published 2022-02-16T11:15Z)
Description: value: Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/io/io_bank.c
libr/util/new_rbtree.c
Commit message: Prefer memleak over usaf in io.bank's rbtree bug ##crash

* That's a workaround, proper fix will come later
* Reproducer: bins/fuzzed/iobank-crash
* Reported by Akyne Choi via huntr.dev


Vulnerable code:
	while (entry && r_io_submap_to (((RIOSubMap *)entry->data)) <= r_io_submap_to (sm)) {
	if (tree->root == NULL) {
		if (tree->root == NULL) {

Fixed code:
	ut64 smto = r_io_submap_to (sm);
	while (entry && r_io_submap_to (((RIOSubMap *)entry->data)) <= smto) {
		// XXX this is a workaround to avoid an UAF in Reproducer: iobank-crash
		void *smfree = bank->submaps->free;
		bank->submaps->free = NULL;
		bank->submaps->free = smfree;
			entry = NULL;
	if (!tree->root) {
		if (!tree->root) {
CVE-2022-0676 (C, published 2022-02-22T00:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/p/bin_dyldcache.c
Commit message: Fix heap buffer overflow in dyldcache parser ##crash

* Reported by: Lazymio via huntr.dev
* Reproducer: dyldovf


Vulnerable code:
		ut16 *depArray = NULL;
		cache_imgxtr_t *extras = NULL;
static cache_accel_t *read_cache_accel(RBuffer *cache_buf, cache_hdr_t *hdr, cache_map_t *maps) {

	ut64 offset = va2pa (hdr->accelerateInfoAddr, hdr->mappingCount, maps, cache_buf, 0, NULL, NULL);
	cache->accel = read_cache_accel (cache->buf, cache->hdr, cache->maps);

Fixed code:
	ut16 *depArray = NULL;
	cache_imgxtr_t *extras = NULL;
static cache_accel_t *read_cache_accel(RBuffer *cache_buf, cache_hdr_t *hdr, cache_map_t *maps, int n_maps) {
	size_t mc = R_MIN (hdr->mappingCount, n_maps);
	ut64 offset = va2pa (hdr->accelerateInfoAddr, mc, maps, cache_buf, 0, NULL, NULL);
	cache->accel = read_cache_accel (cache->buf, cache->hdr, cache->maps, cache->n_maps);
CVE-2022-0712 (C, published 2022-02-22T18:15Z)
Description: value: NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.4.
Severity: HIGH (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/p/bin_symbols.c
Commit message: Fix null deref in bin.symbols ##crash

* Reported by cnitlrt via huntr.dev


Vulnerable code:
/* radare - LGPL - Copyright 2018 - pancake */

Fixed code:
/* radare - LGPL - Copyright 2018-2022 - pancake */
		if (!sym) {
			break;
		}
CVE-2022-0713 (C, published 2022-02-22T19:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/format/mach0/coresymbolication.c
Commit message: Fix oobread in macho core symbolication ##crash

* Reported by @cnitlrt via huntr.dev


Vulnerable code:
		for (i = 0; i < hdr->n_segments && cursor < end; i++) {

Fixed code:
		for (i = 0; i < hdr->n_segments && cursor + sizeof (RCoreSymCacheElementSegment) < end; i++) {
CVE-2022-0849 (C, published 2022-03-05T10:15Z)
Description: value: Use After Free in r_reg_get_name_idx in GitHub repository radareorg/radare2 prior to 5.6.6.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/anal/arch/kvx/kvx-dis.c
libr/core/canal.c
Commit message: aaef on arm/thumb switches causes uaf ##crash

* Reported by peacock-doris via huntr.dev
* Reproducer: poc_uaf_r_reg_get


Vulnerable code:
/* radare - LGPL - Copyright 2009-2021 - pancake, nibble */
	const char *spname;
	const char *pcname;
	const char *spname = r_reg_get_name (core->anal->reg, R_REG_NAME_SP);
	if (!spname) {
	pcname = r_reg_get_name (core->anal->reg, R_REG_NAME_PC);
	if (!pcname || !*pcname) {
#if 1
#endif

Fixed code:
#if UNUSED0
#endif
/* radare - LGPL - Copyright 2009-2022 - pancake, nibble */
	char *spname;
	char *pcname = NULL;
	const char *kspname = r_reg_get_name (core->anal->reg, R_REG_NAME_SP);
	if (R_STR_ISEMPTY (kspname)) {
	char *spname = strdup (kspname);
	const char *kpcname = r_reg_get_name (core->anal->reg, R_REG_NAME_PC);
	if (!kpcname || !*kpcname) {
	pcname = strdup (kpcname);
	free (pcname);
	free (spname);
CVE-2022-1031 (C, published 2022-03-22T20:15Z)
Description: value: Use After Free in op_is_set_bp in GitHub repository radareorg/radare2 prior to 5.6.6.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/anal/fcn.c
libr/anal/var.c
Commit message: Fix UAF in aaaa on arm/thumb switching ##crash

* Reported by @peacock-doris via huntr.dev
* Reproducer tests_65185
* This is a logic fix, but not the fully safe as changes in the code
  can result on UAF again, to properly protect r2 from crashing we
  need to break the ABI and add refcounting to RRegItem, which can't
  happen in 5.6.x because of abi-compat rules


Vulnerable code:
				eprintf("Enter branch delay at 0x%08"PFMT64x ". bb->sz=%"PFMT64u"\n", at - oplen, bb->size);
				free(last_reg_mov_lea_name);
		if (maxstackframe != 0 && (frame_off > maxstackframe || frame_off < -maxstackframe)) {

Fixed code:
				eprintf ("Enter branch delay at 0x%08"PFMT64x ". bb->sz=%"PFMT64u"\n", at - oplen, bb->size);
		if (anal->opt.vars && !varset) {
			// XXX uses op.src/dst and fails because regprofile invalidates the regitems
			// lets just call this BEFORE retpoline() to avoid such issue
			r_anal_extract_vars (anal, fcn, op);
		}
		// this call may cause regprofile changes which cause ranalop.regitem references to be invalid
				free (last_reg_mov_lea_name);
#if 0
			// we must ranalop in here to avoid uaf
#endif
		if (maxstackframe > 0 && (frame_off > maxstackframe || frame_off < -maxstackframe)) {
CVE-2022-1052 (C, published 2022-03-24T13:15Z)
Description: value: Heap Buffer Overflow in iterate_chained_fixups in GitHub repository radareorg/radare2 prior to 5.6.6.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/format/mach0/mach0.c
libr/bin/format/mach0/mach0.h
libr/core/cmd_api.c
Commit message: Fix heap OOB read in macho.iterate_chained_fixups ##crash

* Reported by peacock-doris via huntr.dev
* Reproducer 'tests_65305'

mrmacete:
* Return early if segs_count is 0
* Initialize segs_count also for reconstructed fixups

Co-authored-by: pancake <pancake@nopcode.org>
Co-authored-by: Francesco Tamagni <mrmacete@protonmail.ch>

Vulnerable code:
	ut32 segs_count;
	if ((segs_count = r_buf_read_le32_at (bin->b, starts_at)) == UT32_MAX) {
		for (i = 0; i < mo->nsegs; i++) {
	for (; i < bin->nsegs; i++) {
	return ht_pp_find(cmd->aliases, k, NULL);

Fixed code:
	ut32 segs_count = r_buf_read_le32_at (bin->b, starts_at);
	if (segs_count == UT32_MAX || segs_count == 0) {
	bin->segs_count = segs_count;
	bin->segs_count = bin->nsegs;
		for (i = 0; i < mo->nsegs && i < mo->segs_count; i++) {
	for (; i < bin->nsegs && i < bin->segs_count; i++) {
	int segs_count;
	return ht_pp_find (cmd->aliases, k, NULL);
CVE-2022-1061 (C, published 2022-03-24T10:15Z)
Description: value: Heap Buffer Overflow in parseDragons in GitHub repository radareorg/radare2 prior to 5.6.8.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/p/bin_symbols.c
Commit message: Fix oobread in symbols header parsing ##bin


Vulnerable code:
	ut64 size = r_buf_size (buf);

Fixed code:
	st64 size = r_buf_size (buf);
	if (size < 32) {
		return NULL;
	}
CVE-2022-1207 (C, published 2022-04-01T19:15Z)
Description: value: Out-of-bounds read in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability allows attackers to read sensitive information from outside the allocated buffer boundary.
Severity: MEDIUM (CVSS v3 base score: 6.6)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/anal/p/anal_cris.c
Commit message: Fix 1 byte oobread in the cris analysis plugin ##crash


Vulnerable code:
/* radare2 - LGPL - Copyright 2014-2015 - pancake */
			op->ptr |= buf[3]<<8;
			op->ptr |= buf[4]<<16;
			op->ptr |= ((ut32)(0xff&buf[5]))<<24;
			delta |= buf[3]<<8;
			delta |= buf[4]<<16;
			delta |= buf[5]<<24;
		if (buf[1]==0xb9) {
			if (buf[0] >=0xc0) {

Fixed code:
/* radare2 - LGPL - Copyright 2014-2022 - pancake */
	if (len < 1) {
		return -1;
	}
			op->ptr |= buf[3] << 8;
			op->ptr |= buf[4] << 16;
			op->ptr |= ((ut32)(0xff & buf[5])) << 24;
			delta |= buf[3] << 8;
			delta |= buf[4] << 16;
			delta |= buf[5] << 24;
		if (len < 2) {
			break;
		}
		if (len < 2) {
			break;
		}
		if (buf[1] == 0xb9) {
		if (len < 2) {
			break;
		}
			if (buf[0] >= 0xc0) {
		"=SN	r0\n"
CVE-2022-1237 (C, published 2022-04-06T10:15Z)
Description: value: Improper Validation of Array Index in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is heap overflow and may be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html).
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-129 \u2014 Improper Validation of Array Index
The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/format/ne/ne.c
Commit message: Fix oobread segfaults in the NE bin parser ##crash

* Reported by @han0nly via huntr.dev
* Reproducers: seed1 seed2
* BountyID: ad3c9c4c-76e7-40c8-bd4a-c095acd8bb40


Vulnerable code:
/* radare - LGPL - Copyright 2019 - GustavoLCR */
		NE_image_segment_entry *se = &bin->segment_entries[i];
	ut16 *modref = malloc (bin->ne_header->ModRefs * sizeof (ut16));
		while (off < start + length * sizeof (NE_image_reloc_item)) {
				if (rel.index > bin->ne_header->ModRefs) {
					offset = modref[rel.index - 1] + bin->header_offset + bin->ne_header->ImportNameTable;
	ut16 size = bin->ne_header->SegCount * sizeof (NE_image_segment_entry);

Fixed code:
/* radare - LGPL - Copyright 2019-2022 - GustavoLCR */
		NE_image_segment_entry *se = &bin->segment_entries[i];
	ut16 *modref = calloc (bin->ne_header->ModRefs, sizeof (ut16));
		size_t buf_size = r_buf_size (bin->buf);
		while (off < start + length * sizeof (NE_image_reloc_item) && off < buf_size) {
				if (rel.index < 1 || rel.index > bin->ne_header->ModRefs) {
					int index = rel.index;
					offset = modref[index - 1] + bin->header_offset + bin->ne_header->ImportNameTable;
	// XXX this is endian unsafe
	if (bin->ne_header->FileAlnSzShftCnt > 8) {
		bin->ne_header->FileAlnSzShftCnt = 8;
	}
	if (bin->ne_header->ModRefs * sizeof (ut16) >= r_buf_size (bin->buf)) {
		bin->ne_header->ModRefs = r_buf_size (bin->buf) / sizeof (ut16);
	}
	size_t size = bin->ne_header->SegCount * sizeof (NE_image_segment_entry);
	if (offset >= r_buf_size (bin->buf)) {
		return;
	}
	size_t remaining = r_buf_size (bin->buf) - offset;
	size = R_MIN (remaining, size);
	if (size >= remaining) {
		bin->ne_header->SegCount = size / sizeof (NE_image_segment_entry);
	}
CVE-2022-1238 (C, published 2022-04-06T10:15Z)
Description: value: Out-of-bounds Write in libr/bin/format/ne/ne.c in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is heap overflow and may be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html).
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/format/ne/ne.c
Commit message: Fix another oobread segfault in the NE bin parser ##crash

* Reported by @han0nly via huntr.dev
* Reproducers: sample1 sample2 sample3
* BountyID: 47422cdf-aad2-4405-a6a1-6f63a3a93200


Vulnerable code:
				entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff;

Fixed code:
		if (bin->entry_table + off + 32 >= r_buf_size (bin->buf)) {
			break;
		}
				if (segnum > 0) {
					entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff;
				}
CVE-2022-1240 (C, published 2022-04-06T11:15Z)
Description: value: Heap buffer overflow in libr/bin/format/mach0/mach0.c in GitHub repository radareorg/radare2 prior to 5.8.6. If address sanitizer is disabled during the compiling, the program should executes into the `r_str_ncpy` function. Therefore I think it is very likely to be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html).
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/format/mach0/mach0.c
Commit message: Fix oobread in the macho parser ##crash

* Reported by @Han0nly via huntr.dev
* Reproducers: heapoverflow1
* BountyID: e589bd97-4c74-4e79-93b5-0951a281facc


Vulnerable code:
		if (sym_num > bin->nsymtab) {

Fixed code:
		if (sym_num >= bin->nsymtab) {
CVE-2022-1244 (C, published 2022-04-05T19:15Z)
Description: value: heap-buffer-overflow in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/format/mach0/dyldcache.h
libr/bin/p/bin_dyldcache.c
Commit message: Fix oobread in dyldcache ##crash

* Reported by @hdthky via huntr.dev
* Reproducers: poc1
* BountyID: 8ae2c61a-2220-47a5-bfe8-fe6d41ab1f82


Vulnerable code:
/* radare - LGPL - Copyright 2009-2010 nibble<.ds@gmail.com> */
			ut64 pa = va2pa (img[j].address, hdr->mappingCount, &cache->maps[maps_index], cache->buf, 0, NULL, NULL);

Fixed code:
/* radare - LGPL - Copyright 2009-2022 nibble, pancake */
			// ut64 pa = va2pa (img[j].address, hdr->mappingCount, &cache->maps[maps_index], cache->buf, 0, NULL, NULL);
			ut64 pa = va2pa (img[j].address, cache->n_maps, &cache->maps[maps_index], cache->buf, 0, NULL, NULL);
CVE-2022-1283 (C, published 2022-04-08T18:15Z)
Description: value: NULL Pointer Dereference in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability allows attackers to cause a denial of service (application crash).
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/format/ne/ne.c
Commit message: Fix null deref in the ne parser ##crash

* Reported by @hmsec via huntr.dev
* Reproducer: nepoc00
* BountyID: bfeb8fb8-644d-4587-80d4-cb704c404013


Vulnerable code:
	while (true) {

Fixed code:
	while (entries) {
	if (!bin->entry_table) {
		return NULL;
	}
CVE-2022-1284 (C, published 2022-04-08T19:15Z)
Description: value: heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/core/canal.c
Commit message: Fix UAF in `aaef` ##crash

* Reported by @hdthky
* Reproducer: uaf-aef
* BountyID: e98ad92c-3a64-48fb-84d4-d13afdbcbdd7


Vulnerable code:
	const char *sn = r_reg_get_name (core->anal->reg, R_REG_NAME_SN);
	if (!sn) {
		eprintf ("Warning: No SN reg alias for current architecture.\n");
	}

Fixed code:
		const char *sn = r_reg_get_name (core->anal->reg, R_REG_NAME_SN);
		if (!sn) {
			eprintf ("Warning: No SN reg alias for current architecture.\n");
		}
CVE-2022-1296 (Other, published 2022-04-11T12:15Z)
Description: value: Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability may allow attackers to read sensitive information or cause a crash.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/format/ne/ne.c
test/db/formats/ne
Commit message: Fix oobread in NE parser ##crash

* Reported by @hmsec via huntr.dev
* Reproducer: necrash
* BountyID: 52b57274-0e1a-4d61-ab29-1373b555fea0/


Vulnerable code:
#define NE_BUG 0
				char *name;
#if NE_BUG
				if (rel.index > 0 && rel.index < bin->ne_header->ModRefs) {
					offset = modref[rel.index - 1] + bin->header_offset + bin->ne_header->ImportNameTable;
					name = __read_nonnull_str_at (bin->buf, offset);
				} else {
					name = r_str_newf ("UnknownModule%d_%x", rel.index, off); // ????
				}
#else
				} else {
#endif
					imp->name = r_str_newf ("%s.%s", name, __func_name_from_ord(name, rel.func_ord));

Fixed code:
				char *name = NULL;
				} else if (rel.index > 0) {
					char *fname = __func_name_from_ord (name, rel.func_ord);
					imp->name = r_str_newf ("%s.%s", name, fname);
					free (fname);
#define NE_BUG 0
NAME=NE crash
FILE=bins/ne/necrash
CMDS=<<EOF
aaa
i~format
i~csum
aflc
EOF
EXPECT=<<EOF
format   ne
hdr.csum c258016a
0
EOF
RUN