hitoshura25/cvefixes huggingface dataset:
CVE-2022-31116 (Unknown, published 2022-07-05T18:15Z)
Description: value: UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key confusion and value overwriting in dictionaries. All users parsing JSON from untrusted sources are vulnerable. From version 5.4.0, UltraJSON decodes lone surrogates in the same way as the standard library's `json` module does, preserving them in the parsed output. Users are advised to upgrade. There are no known workarounds for this issue.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-670 \u2014 Always-Incorrect Control Flow Implementation
The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
Repository: https://github.com/ultrajson/ultrajson
Files changed:
Commit message: Merge pull request #555 from JustAnotherArchivist/fix-decode-surrogates-2



Vulnerable code:

Fixed code:
CVE-2022-31117 (Unknown, published 2022-07-05T18:15Z)
Description: value: UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python. This issue has been resolved in version 5.4.0 and all users should upgrade to UltraJSON 5.4.0. There are no known workarounds for this issue.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/ultrajson/ultrajson
Files changed:
Commit message: Merge pull request from GHSA-fm67-cv37-96ff

Fix double free on string decoding if realloc fails

Vulnerable code:

Fixed code:
CVE-2015-8894 (C, published 2017-03-15T19:59Z)
Description: value: Double free vulnerability in coders/tga.c in ImageMagick 7.0.0 and later allows remote attackers to cause a denial of service (application crash) via a crafted tga file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/tga.c
Commit message: https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1490362


Vulnerable code:

Fixed code:
      if (image->colors < tga_info.colormap_index)
        image->colors=tga_info.colormap_index;
CVE-2015-8897 (C, published 2017-03-15T19:59Z)
Description: value: The SpliceImage function in MagickCore/transform.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (application crash) via a crafted png file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/transform.c
Commit message: Fixed out of bounds error in SpliceImage.


Vulnerable code:
    p=GetCacheViewVirtualPixels(image_view,0,y,image->columns,1,exception);
    for (x=0; x < splice_geometry.x; x++)
    p=GetCacheViewVirtualPixels(image_view,0,y-(ssize_t) splice_geometry.height,
      image->columns,1,exception);
    if ((y < 0) || (y >= (ssize_t) splice_image->rows))
    for (x=0; x < splice_geometry.x; x++)

Fixed code:
    columns,
  columns=MagickMin(splice_geometry.x,(ssize_t) splice_image->columns);
    p=GetCacheViewVirtualPixels(image_view,0,y,splice_image->columns,1,
      exception);
    for (x=0; x < columns; x++)
    if ((y < 0) || (y >= (ssize_t)splice_image->rows))
    p=GetCacheViewVirtualPixels(image_view,0,y-(ssize_t) splice_geometry.height,
      splice_image->columns,1,exception);
    for (x=0; x < columns; x++)
CVE-2015-8898 (C, published 2017-03-15T19:59Z)
Description: value: The WriteImages function in magick/constitute.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted image file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/constitute.c
Commit message: https://github.com/ImageMagick/ImageMagick/pull/34


Vulnerable code:
    if (p->scene >= GetNextImageInList(p)->scene)

Fixed code:
  {
    register Image
      *next;
    
    next=GetNextImageInList(p);
    if (next == (Image *) NULL)
      break;
    if (p->scene >= next->scene)
  }
CVE-2015-8900 (C, published 2017-02-27T22:59Z)
Description: value: The ReadHDRImage function in coders/hdr.c in ImageMagick 6.x and 7.x allows remote attackers to cause a denial of service (infinite loop) via a crafted HDR file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/hdr.c
Commit message: Fixed infinite loop and added checks for the sscanf result.


Vulnerable code:
          while ((c != '\n') && (c != '\0'))
                  (void) sscanf(value,"%g %g %g %g %g %g %g %g",
                    &chromaticity[0],&chromaticity[1],&chromaticity[2],
                    &chromaticity[3],&chromaticity[4],&chromaticity[5],
                    &white_point[0],&white_point[1]);
                  image->chromaticity.red_primary.x=chromaticity[0];
                  image->chromaticity.red_primary.y=chromaticity[1];
                  image->chromaticity.green_primary.x=chromaticity[2];
                  image->chromaticity.green_primary.y=chromaticity[3];
                  image->chromaticity.blue_primary.x=chromaticity[4];
                  image->chromaticity.blue_primary.y=chromaticity[5];
                  image->chromaticity.white_point.x=white_point[0],
                  image->chromaticity.white_point.y=white_point[1];
                  (void) sscanf(value,"%d +X %d",&height,&width);
                  image->columns=(size_t) width;
                  image->rows=(size_t) height;

Fixed code:
          while ((c != '\n') && (c != '\0') && (c != EOF))
                  if (sscanf(value,"%g %g %g %g %g %g %g %g",&chromaticity[0],
                      &chromaticity[1],&chromaticity[2],&chromaticity[3],
                      &chromaticity[4],&chromaticity[5],&white_point[0],
                      &white_point[1]) == 8)
                    {
                      image->chromaticity.red_primary.x=chromaticity[0];
                      image->chromaticity.red_primary.y=chromaticity[1];
                      image->chromaticity.green_primary.x=chromaticity[2];
                      image->chromaticity.green_primary.y=chromaticity[3];
                      image->chromaticity.blue_primary.x=chromaticity[4];
                      image->chromaticity.blue_primary.y=chromaticity[5];
                      image->chromaticity.white_point.x=white_point[0],
                      image->chromaticity.white_point.y=white_point[1];
                    }
                  if (sscanf(value,"%d +X %d",&height,&width) == 2)
                    {
                      image->columns=(size_t) width;
                      image->rows=(size_t) height;
                    }
CVE-2015-8957 (C, published 2017-04-20T18:59Z)
Description: value: Buffer overflow in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (application crash) via a crafted SUN file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/sun.c
Commit message: http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=26848



Vulnerable code:
        image->storage_class=PseudoClass;
      case RMT_NONE:
      {
        if (sun_info.depth < 24)
          {
            /*
              Create linear color ramp.
            */
            if (AcquireImageColormap(image,image->colors,exception) == MagickFalse)
              ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
          }
        break;
      }
        if (AcquireImageColormap(image,image->colors,exception) == MagickFalse)
          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");

Fixed code:
        if (AcquireImageColormap(image,image->colors,exception) == MagickFalse)
          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
CVE-2015-8957 (C, published 2017-04-20T18:59Z)
Description: value: Buffer overflow in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (application crash) via a crafted SUN file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/sun.c
Commit message: http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=26838



Vulnerable code:
    sun_data=(unsigned char *) AcquireQuantumMemory((size_t) sun_info.length,
      sizeof(*sun_data));
        bytes_per_line=sun_info.width*sun_info.depth;

Fixed code:
    bytes_per_line=sun_info.width*sun_info.depth;
    sun_data=(unsigned char *) AcquireQuantumMemory((size_t) MagickMax(
      sun_info.length,bytes_per_line*sun_info.width),sizeof(*sun_data));
CVE-2015-8957 (C, published 2017-04-20T18:59Z)
Description: value: Buffer overflow in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (application crash) via a crafted SUN file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/composite.c
MagickCore/pixel-accessor.h
MagickCore/threshold.c
coders/sun.c

Vulnerable code:
        q[i]=ClampToQuantum(pixel);
static inline Quantum ClampPixel(const MagickRealType value)
{
#if !defined(MAGICKCORE_HDRI_SUPPORT)
  return((Quantum) value);
#else
  if (value < 0.0f)
    return(0.0);
  if (value >= (MagickRealType) QuantumRange)
    return((Quantum) QuantumRange);
  return(value);
#endif
}


Fixed code:
        q[i]=ClampPixel(pixel);
static inline Quantum ClampPixel(const MagickRealType value)
{
#if !defined(MAGICKCORE_HDRI_SUPPORT)
  return((Quantum) value);
#else
  if (value < 0.0)
    return((Quantum) 0.0);
  if (value >= (MagickRealType) QuantumRange)
    return((Quantum) QuantumRange);
  return((Quantum) value);
#endif
}

      case RMT_NONE:
        break;
CVE-2015-8958 (C, published 2017-04-20T18:59Z)
Description: value: coders/sun.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted SUN file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/sun.c
Commit message: http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=26857



Vulnerable code:
    if ((sun_info.type != RT_ENCODED) && (sun_info.depth >= 8) &&
        ((number_pixels*((sun_info.depth+7)/8)) > sun_info.length))
          length=image->rows*(bytes_per_line+image->columns % 2);

Fixed code:
    if ((sun_info.type != RT_ENCODED) && 
        ((number_pixels*sun_info.depth) > (8*sun_info.length)))
          length=image->rows*(bytes_per_line+bytes_per_line % 2);
CVE-2015-8958 (C, published 2017-04-20T18:59Z)
Description: value: coders/sun.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted SUN file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/sun.c

Vulnerable code:
    height,
    length;
          if (bytes_per_line == 0)
            bytes_per_line=image->columns;
          length=image->rows*(image->columns+image->columns % 2);
          if (((sun_info.type == RT_ENCODED) &&
               (length > (bytes_per_line*image->rows))) ||
              ((sun_info.type != RT_ENCODED) && (length > sun_info.length)))
            ThrowReaderException(CorruptImageError,"UnableToReadImageData");
          length=image->rows*(bytes_per_line+bytes_per_line % 2);
          if (((sun_info.type == RT_ENCODED) &&
               (length > (bytes_per_line*image->rows))) ||
              ((sun_info.type != RT_ENCODED) && (length > sun_info.length)))
            ThrowReaderException(CorruptImageError,"UnableToReadImageData");

Fixed code:
    height;
CVE-2015-8958 (C, published 2017-04-20T18:59Z)
Description: value: coders/sun.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted SUN file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/sun.c

Vulnerable code:
      ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
      ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
      ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");

Fixed code:
      ThrowReaderException(ResourceLimitError,"ImproperImageHeader");
      ThrowReaderException(ResourceLimitError,"ImproperImageHeader");
      ThrowReaderException(ResourceLimitError,"ImproperImageHeader");
    else
      {
        if (sun_info.length > (height*bytes_per_line))
          ThrowReaderException(ResourceLimitError,"ImproperImageHeader");
        (void) CopyMagickMemory(sun_pixels,sun_data,sun_info.length);
      }
CVE-2015-8958 (C, published 2017-04-20T18:59Z)
Description: value: coders/sun.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted SUN file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/sun.c

Vulnerable code:
    sun_pixels=sun_data;
    bytes_per_line=0;
      {
        size_t
          height;

        /*
          Read run-length encoded raster pixels.
        */
        height=sun_info.height;
        if ((height == 0) || (sun_info.width == 0) || (sun_info.depth == 0) ||
            ((bytes_per_line/sun_info.depth) != sun_info.width))
          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
        bytes_per_line+=15;
        bytes_per_line<<=1;
        if ((bytes_per_line >> 1) != (sun_info.width*sun_info.depth+15))
          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
        bytes_per_line>>=4;
        sun_pixels=(unsigned char *) AcquireQuantumMemory(height,
          bytes_per_line*sizeof(*sun_pixels));
        if (sun_pixels == (unsigned char *) NULL)
          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
        (void) DecodeImage(sun_data,sun_info.length,sun_pixels,bytes_per_line*
          height);
        sun_data=(unsigned char *) RelinquishMagickMemory(sun_data);
      }

Fixed code:
    height,
    height=sun_info.height;
    if ((height == 0) || (sun_info.width == 0) || (sun_info.depth == 0) ||
        ((bytes_per_line/sun_info.depth) != sun_info.width))
      ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
    bytes_per_line+=15;
    bytes_per_line<<=1;
    if ((bytes_per_line >> 1) != (sun_info.width*sun_info.depth+15))
      ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
    bytes_per_line>>=4;
    sun_pixels=(unsigned char *) AcquireQuantumMemory(height,
      bytes_per_line*sizeof(*sun_pixels));
    if (sun_pixels == (unsigned char *) NULL)
      ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
      (void) DecodeImage(sun_data,sun_info.length,sun_pixels,bytes_per_line*
        height);
    sun_data=(unsigned char *) RelinquishMagickMemory(sun_data);
CVE-2015-8959 (C, published 2017-04-20T18:59Z)
Description: value: coders/dds.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (CPU consumption) via a crafted DDS file.
Severity: HIGH (CVSS v3 base score: 6.5)
Weakness: CWE-399 \u2014 Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/dds.c
Commit message: http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=26861



Vulnerable code:
        (void) SeekBlob(image, offset, SEEK_CUR);
        
        (void) SeekBlob(image, offset, SEEK_CUR);
        

Fixed code:
        if (SeekBlob(image, offset, SEEK_CUR) < 0)
          break;
        if (SeekBlob(image, offset, SEEK_CUR) < 0)
          break;
CVE-2016-10049 (C, published 2017-03-23T17:59Z)
Description: value: Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick before 6.9.4-4 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted RLE file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/rle.c
Commit message: https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=29710


Vulnerable code:
      number_planes_filled*sizeof(*pixels));
    pixel_info_length=image->columns*image->rows*number_planes_filled;

Fixed code:
      MagickMax(number_planes_filled,4)*sizeof(*pixels));
    pixel_info_length=image->columns*image->rows*
      MagickMax(number_planes_filled,4);
CVE-2016-10050 (Other, published 2017-03-23T17:59Z)
Description: value: Heap-based buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.9.4-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted RLE file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
ChangeLog
coders/rle.c
Commit message: RLE check for pixel offset less than 0 (heap overflow report from Craig Young)


Vulnerable code:
    offset,
          if (offset+((size_t) operand*number_planes) > pixel_info_length)
          if (offset+((size_t) operand*number_planes) > pixel_info_length)

Fixed code:
  * RLE check for pixel offset less than 0 (heap overflow report from Craig
    Young).
    offset,
          if ((offset < 0) ||
              (offset+((size_t) operand*number_planes) > pixel_info_length))
          if ((offset < 0) ||
              (offset+((size_t) operand*number_planes) > pixel_info_length))
CVE-2016-10051 (Other, published 2017-03-23T17:59Z)
Description: value: Use-after-free vulnerability in the ReadPWPImage function in coders/pwp.c in ImageMagick 6.9.5-5 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
ChangeLog
coders/pwp.c
Commit message: Prevent memory use after free


Vulnerable code:
  (void) CloseBlob(pwp_image);
  pwp_image=DestroyImage(pwp_image);

Fixed code:
  * Prevent memory use after free (reference
    https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=30245).