hitoshura25/cvefixes huggingface dataset:
CVE-2020-7622 (Java, published 2020-04-06T15:15Z)
Description: value: This affects the package io.jooby:jooby-netty before 1.6.9, from 2.0.0 and before 2.2.1. The DefaultHttpHeaders is set to false which means it does not validates that the header isn't being abused for HTTP Response Splitting.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/jooby-project/jooby
Files changed:
modules/jooby-netty/src/main/java/io/jooby/internal/netty/NettyContext.java
Commit message: CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting fix #GHSA-gv3v-92v6-m48j


Vulnerable code:
  final DefaultHttpHeaders setHeaders = new DefaultHttpHeaders(false);

Fixed code:
  final DefaultHttpHeaders setHeaders = new DefaultHttpHeaders(true);
CVE-2013-7456 (C, published 2016-08-07T10:59Z)
Description: value: gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.1.1, as used in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7, allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted image that is mishandled by the imagescale function.
Severity: MEDIUM (CVSS v3 base score: 7.6)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/libgd/libgd
Files changed:
src/gd_interpolation.c
Commit message: Fixed memory overrun bug in gdImageScaleTwoPass

_gdContributionsCalc would compute a window size and then adjust
the left and right positions of the window to make a window within
that size.  However, it was storing the values in the struct *before*
it made the adjustment.  This change fixes that.


Vulnerable code:
		res->ContribRow[u].Left = iLeft;
		res->ContribRow[u].Right = iRight;


Fixed code:
		res->ContribRow[u].Left = iLeft;
		res->ContribRow[u].Right = iRight;
CVE-2015-8877 (C, published 2016-05-22T01:59Z)
Description: value: The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-399 \u2014 Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
Repository: https://github.com/libgd/libgd
Files changed:
src/gd_interpolation.c
Commit message: gdImageScaleTwoPass memory leak fix

Fixing memory leak in gdImageScaleTwoPass, as reported by @cmb69 and
confirmed by @vapier.  This bug actually bit me in production and I'm
very thankful that it was reported with an easy fix.

Fixes #173.


Vulnerable code:
        gdFree(tmp_im);

Fixed code:
        gdImageDestroy(tmp_im);
CVE-2016-10166 (C, published 2017-03-15T15:59Z)
Description: value: Integer underflow in the _gdContributionsAlloc function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors related to decrementing the u variable.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-191 \u2014 Integer Underflow (Wrap or Wraparound)
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Repository: https://github.com/libgd/libgd
Files changed:
src/gd_interpolation.c
Commit message: Fix potential unsigned underflow

No need to decrease `u`, so we don't do it. While we're at it, we also factor
out the overflow check of the loop, what improves performance and readability.

This issue has been reported by Stefan Esser to security@libgd.org.


Vulnerable code:
	int overflow_error = 0;
		if (overflow2(windows_size, sizeof(double))) {
			overflow_error = 1;
		} else {
			res->ContribRow[u].Weights = (double *) gdMalloc(windows_size * sizeof(double));
		}
		if (overflow_error == 1 || res->ContribRow[u].Weights == NULL) {
			u--;
			for (i=0;i<=u;i++) {

Fixed code:
	size_t weights_size;
	if (overflow2(windows_size, sizeof(double))) {
		return NULL;
	} else {
		weights_size = windows_size * sizeof(double);
	}
		res->ContribRow[u].Weights = (double *) gdMalloc(weights_size);
		if (res->ContribRow[u].Weights == NULL) {

			for (i=0;i<u;i++) {
CVE-2016-10167 (C, published 2017-03-15T15:59Z)
Description: value: The gdImageCreateFromGd2Ctx function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (application crash) via a crafted image file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/libgd/libgd
Files changed:
src/gd_gd2.c
tests/gd2/.gitignore
tests/gd2/CMakeLists.txt
tests/gd2/Makemodule.am
tests/gd2/too_few_image_data.c
Commit message: Fix DOS vulnerability in gdImageCreateFromGd2Ctx()

We must not pretend that there are image data if there are none. Instead
we fail reading the image file gracefully.


Vulnerable code:
								/*printf("EOF while reading\n"); */
								/*gdImageDestroy(im); */
								/*return 0; */
								im->tpixels[y][x] = 0;
								/*printf("EOF while reading\n"); */
								/*gdImageDestroy(im); */
								/*return 0; */
								ch = 0;
	gd2/gd2_read_corrupt
	gd2/invalid_neg_size.gd2

Fixed code:
								gd_error("gd2: EOF while reading\n");
								gdImageDestroy(im);
								return NULL;
								gd_error("gd2: EOF while reading\n");
								gdImageDestroy(im);
								return NULL;
/too_few_image_data
	too_few_image_data
	gd2/gd2_read_corrupt \
	gd2/too_few_image_data
	gd2/invalid_neg_size.gd2 \
	gd2/php_bug_72339_exp.gd2 \
	gd2/too_few_image_data.gd2
/*
too_few_image_data.gd2 claims to have a size of 12336x48 pixels, but doesn't
provide as much image data. We test that gdImageCreateFromGd2Ctx() returns NULL
in this case.
*/

#include "gd.h"
#include "gdtest.h"

int main()
{
    gdImagePtr im;
    FILE *fp;

    fp = gdTestFileOpen2("gd2", "too_few_image_data.gd2");
    gdTestAssert(fp != NULL);
    im = gdImageCreateFromGd2(fp);
    gdTestAssert(im == NULL);
    fclose(fp);

    return gdNumFailures();
}
CVE-2016-10168 (C, published 2017-03-15T15:59Z)
Description: value: Integer overflow in gd_io.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors involving the number of horizontal and vertical chunks in an image.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/libgd/libgd
Files changed:
src/gd_gd2.c
tests/gd2/.gitignore
tests/gd2/CMakeLists.txt
tests/gd2/Makemodule.am
tests/gd2/bug00354.c
Commit message: Fix #354: Signed Integer Overflow gd_io.c

GD2 stores the number of horizontal and vertical chunks as words (i.e. 2
byte unsigned). These values are multiplied and assigned to an int when
reading the image, what can cause integer overflows. We have to avoid
that, and also make sure that either chunk count is actually greater
than zero. If illegal chunk counts are detected, we bail out from
reading the image.


Vulnerable code:

Fixed code:
		if (*ncx <= 0 || *ncy <= 0 || *ncx > INT_MAX / *ncy) {
			GD2_DBG(printf ("Illegal chunk counts: %d * %d\n", *ncx, *ncy));
			goto fail1;
		}
/bug00354
	bug00354
	gd2/bug00354 \
	gd2/bug00354a.gd2 \
	gd2/bug00354b.gd2 \
/**
 * We're testing GD2 image files which report illegal chunk counts. These should
 * not cause integer overflows or other issues, but instead simply fail to be
 * loaded.
 *
 * See also <https://github.com/libgd/libgd/issues/354>.
 */


#include "gd.h"
#include "gdtest.h"


int main()
{
    gdImagePtr im;
    FILE *fp;

    fp = gdTestFileOpen2("gd2", "bug00354a.gd2");
    gdTestAssert(fp != NULL);
    im = gdImageCreateFromGd2(fp);
    gdTestAssert(im == NULL);
    fclose(fp);

    fp = gdTestFileOpen2("gd2", "bug00354b.gd2");
    gdTestAssert(fp != NULL);
    im = gdImageCreateFromGd2(fp);
    gdTestAssert(im == NULL);
    fclose(fp);

    return gdNumFailures();
}
CVE-2016-3074 (C, published 2016-04-26T14:59Z)
Description: value: Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via crafted compressed gd2 data, which triggers a heap-based buffer overflow.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-681 \u2014 Incorrect Conversion between Numeric Types
When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
Repository: https://github.com/libgd/libgd
Files changed:
.gitignore
src/gd_gd2.c
tests/Makefile.am
tests/gd2/gd2_read_corrupt.c
Commit message: gd2: handle corrupt images better (CVE-2016-3074)

Make sure we do some range checking on corrupted chunks.

Thanks to Hans Jerry Illikainen <hji@dyntopia.com> for indepth report
and reproducer information.  Made for easy test case writing :).


Vulnerable code:
	gd2/gd2_null

Fixed code:
/tests/gd2/gd2_read_corrupt
			if (cidx[i].offset < 0 || cidx[i].size < 0)
				goto fail2;
	gd2/gd2_null \
	gd2/gd2_read_corrupt
/* Just try to read the invalid gd2 image & not crash. */
#include "gd.h"
#include <stdio.h>
#include <stdlib.h>
#include "gdtest.h"

int main()
{
	gdImagePtr im;
	FILE *fp;
	char path[1024];

	/* Read the corrupt image. */
	sprintf(path, "%s/gd2/invalid_neg_size.gd2", GDTEST_TOP_DIR);
	fp = fopen(path, "rb");
	if (!fp) {
		printf("failed, cannot open file\n");
		return 1;
	}
	im = gdImageCreateFromGd2(fp);
	fclose(fp);

	/* Should have failed & rejected it. */
	return im == NULL ? 0 : 1;
}
CVE-2016-5116 (C, published 2016-08-07T10:59Z)
Description: value: gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/libgd/libgd
Files changed:
src/gd_xbm.c
Commit message: xbm: avoid stack overflow (read) with large names #211

We use the name passed in to printf into a local stack buffer which is
limited to 4000 bytes.  So given a large enough value, lots of stack
data is leaked.  Rewrite the code to do simple memory copies with most
of the strings to avoid that issue, and only use stack buffer for small
numbers of constant size.

This closes #211.


Vulnerable code:
	char buf[4096];
	gdCtxPrintf(out, "#define %s_width %d\n", name, gdImageSX(image));
	gdCtxPrintf(out, "#define %s_height %d\n", name, gdImageSY(image));
	gdCtxPrintf(out, "static unsigned char %s_bits[] = {\n  ", name);
					gdCtxPrintf(out, ", ");
						gdCtxPrintf(out, "\n  ");
	gdCtxPrintf(out, "};\n");

Fixed code:
	char buf[1024];
/* The compiler will optimize strlen(constant) to a constant number. */
#define gdCtxPuts(out, s) out->putBuf(out, s, strlen(s))

	/* Since "name" comes from the user, run it through a direct puts.
	 * Trying to printf it into a local buffer means we'd need a large
	 * or dynamic buffer to hold it all. */

	/* #define <name>_width 1234 */
	gdCtxPuts(out, "#define ");
	gdCtxPuts(out, name);
	gdCtxPuts(out, "_width ");
	gdCtxPrintf(out, "%d\n", gdImageSX(image));

	/* #define <name>_height 1234 */
	gdCtxPuts(out, "#define ");
	gdCtxPuts(out, name);
	gdCtxPuts(out, "_height ");
	gdCtxPrintf(out, "%d\n", gdImageSY(image));

	/* static unsigned char <name>_bits[] = {\n */
	gdCtxPuts(out, "static unsigned char ");
	gdCtxPuts(out, name);
	gdCtxPuts(out, "_bits[] = {\n  ");
					gdCtxPuts(out, ", ");
						gdCtxPuts(out, "\n  ");
	gdCtxPuts(out, "};\n");
CVE-2016-6128 (C, published 2016-08-07T10:59Z)
Description: value: The gdImageCropThreshold function in gd_crop.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 7.0.9, allows remote attackers to cause a denial of service (application crash) via an invalid color index.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/libgd/libgd
Files changed:
tests/gdimagecrop/php_bug_72494.c
Commit message: fix php 72494, invalid color index not handled, can lead to crash


Vulnerable code:

Fixed code:
#include <stdio.h>
#include <stdlib.h>
#include "gd.h"

#include "gdtest.h"

int main()
{
	gdImagePtr im, exp;
	int error = 0;

	im = gdImageCreate(50, 50);

	if (!im) {
		gdTestErrorMsg("gdImageCreate failed.\n");
		return 1;
	}

	gdImageCropThreshold(im, 1337, 0);
	gdImageDestroy(im);
	/* this bug tests a crash, it never reaches this point if the bug exists*/
	return 0;
}
CVE-2016-6128 (Other, published 2016-08-07T10:59Z)
Description: value: The gdImageCropThreshold function in gd_crop.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 7.0.9, allows remote attackers to cause a denial of service (application crash) via an invalid color index.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/libgd/libgd
Files changed:
src/gd_crop.c
tests/CMakeLists.txt
tests/Makefile.am
Commit message: fix php 72494, invalid color index not handled, can lead to crash


Vulnerable code:

Fixed code:
	if (color < 0 || (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im))) {
		return NULL;
	}

        gdimagecrop
include gdimagecrop/Makemodule.am
CVE-2016-6214 (C, published 2016-08-12T15:59Z)
Description: value: gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/libgd/libgd
Files changed:
src/gd_tga.c
tests/tga/.gitignore
tests/tga/CMakeLists.txt
tests/tga/Makemodule.am
tests/tga/bug00247a.c
Commit message: Unsupported TGA bpp/alphabit combinations should error gracefully

Currently, only 24bpp without alphabits and 32bpp with 8 alphabits are
really supported. All other combinations will be rejected with a warning.


Vulnerable code:
			} else if (tga->bits == TGA_BPP_32 || tga->alphabits) {
	switch(tga->bits) {
	case 8:
	case 16:
	case 24:
	case 32:
		break;
	default:
		gd_error("bps %i not supported", tga->bits);
		break;
	tga/bug00247.tga

Fixed code:
			} else if (tga->bits == TGA_BPP_32 && tga->alphabits) {
	if (!((tga->bits == TGA_BPP_24 && tga->alphabits == 0)
		|| (tga->bits == TGA_BPP_32 && tga->alphabits == 8)))
	{
		gd_error_ex(GD_WARNING, "gd-tga: %u bits per pixel with %u alpha bits not supported\n",
			tga->bits, tga->alphabits);
/bug00247a
	bug00247a
	tag/bug00247a \
	tga/bug00247.tga \
	tga/bug00247a.tga
/*
We test that a 8bpp TGA file will be gracefully rejected by
gdImageCreateFromTga().
*/

#include <stdio.h>

#include "gd.h"
#include "gdtest.h"

int main(int argc, char **argv)
{
    gdImagePtr im;
    FILE *fp = gdTestFileOpen("tga/bug00247a.tga");
    im = gdImageCreateFromTga(fp);
    gdTestAssert(im == NULL);
    fclose(fp);
    return gdNumFailures();
}
CVE-2016-6906 (C, published 2017-03-15T14:59Z)
Description: value: The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file, related to the decompression buffer.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/libgd/libgd
Files changed:
src/gd_tga.c
tests/tga/.gitignore
tests/tga/CMakeLists.txt
tests/tga/Makemodule.am
tests/tga/heap_overflow.c
Commit message: Fix OOB reads of the TGA decompression buffer

It is possible to craft TGA files which will overflow the decompression
buffer, but not the image's bitmap. Therefore we augment the check for the
bitmap's overflow with a check for the buffer's overflow.

This issue had been reported by Ibrahim El-Sayed to security@libgd.org.

CVE-2016-6906


Vulnerable code:
				if ((bitmap_caret + (encoded_pixels * pixel_block_size)) > image_block_size) {
				if ((bitmap_caret + (encoded_pixels * pixel_block_size)) > image_block_size) {

Fixed code:
				if ((bitmap_caret + (encoded_pixels * pixel_block_size)) > image_block_size
						|| buffer_caret + pixel_block_size > rle_size) {
				if ((bitmap_caret + (encoded_pixels * pixel_block_size)) > image_block_size
						|| buffer_caret + (encoded_pixels * pixel_block_size) > rle_size) {
/heap_overflow
	heap_overflow
	tga/heap_overflow \
	tga/heap_overflow.tga \
/**
 * Test that the crafted TGA file doesn't trigger OOB reads.
 */


#include "gd.h"
#include "gdtest.h"


static size_t read_test_file(char **buffer, char *basename);


int main()
{
    gdImagePtr im;
    char *buffer;
    size_t size;

    size = read_test_file(&buffer, "heap_overflow.tga");
    im = gdImageCreateFromTgaPtr(size, (void *) buffer);
    gdTestAssert(im == NULL);
    free(buffer);

    return gdNumFailures();
}


static size_t read_test_file(char **buffer, char *basename)
{
    char *filename;
    FILE *fp;
    size_t exp_size, act_size;

    filename = gdTestFilePath2("tga", basename);
    fp = fopen(filename, "rb");
    gdTestAssert(fp != NULL);

	fseek(fp, 0, SEEK_END);
	exp_size = ftell(fp);
	fseek(fp, 0, SEEK_SET);

    *buffer = malloc(exp_size);
    gdTestAssert(*buffer != NULL);
    act_size = fread(*buffer, sizeof(**buffer), exp_size, fp);
    gdTestAssert(act_size == exp_size);

    fclose(fp);
    free(filename);

    return act_size;
}
CVE-2016-6906 (C, published 2017-03-15T14:59Z)
Description: value: The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file, related to the decompression buffer.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/libgd/libgd
Files changed:
src/gd_tga.c
tests/tga/Makemodule.am
tests/tga/heap_overflow.c
Commit message: Fix OOB reads of the TGA decompression buffer

It is possible to craft TGA files which will overflow the decompression
buffer, but not the image's bitmap. Therefore we also have to check for
potential decompression buffer overflows.

This issue had been reported by Ibrahim El-Sayed to security@libgd.org;
a modified case exposing an off-by-one error of the first patch had been
provided by Konrad Beckmann.

This commit is an amendment to commit fb0e0cce, so we use CVE-2016-6906
as well.


Vulnerable code:
			
	tga/heap_overflow.tga \
 * Test that the crafted TGA file doesn't trigger OOB reads.
    size = read_test_file(&buffer, "heap_overflow.tga");

    return gdNumFailures();

Fixed code:

			if (buffer_caret + pixel_block_size > rle_size) {
				gdFree( decompression_buffer );
				gdFree( conversion_buffer );
				return -1;
			}

	tga/heap_overflow_1.tga \
	tga/heap_overflow_2.tga \
 * Test that crafted TGA files don't trigger OOB reads.
static void check_file(char *basename);
{
    check_file("heap_overflow_1.tga");
    check_file("heap_overflow_2.tga");

    return gdNumFailures();
}


static void check_file(char *basename)
    size = read_test_file(&buffer, basename);
CVE-2016-7568 (Unknown, published 2016-09-28T20:59Z)
Description: value: Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.0.11, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted imagewebp and imagedestroy calls.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/libgd/libgd
Files changed:
Commit message: Merge branch 'pull-request/296'


Vulnerable code:

Fixed code:
CVE-2016-8670 (C, published 2017-01-04T20:59Z)
Description: value: Integer signedness error in the dynamicGetbuf function in gd_io_dp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted imagecreatefromstring call.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/libgd/libgd
Files changed:
src/gd_io_dp.c
Commit message: Avoid potentially dangerous signed to unsigned conversion

We make sure to never pass a negative `rlen` as size to memcpy(). See
also <https://bugs.php.net/bug.php?id=73280>.

Patch provided by Emmanuel Law.


Vulnerable code:
		if(remain == 0) {

Fixed code:
		if(remain <= 0) {