hitoshura25/cvefixes huggingface dataset:
CVE-2023-39523 (Python, published 2023-08-07T21:15Z)
Description: value: ScanCode.io is a server to script and automate software composition analysis with ScanPipe pipelines. Prior to version 32.5.1, the software has a possible command injection vulnerability in the docker fetch process as it allows to append malicious commands in the `docker_reference` parameter.

In the function `scanpipe/pipes/fetch.py:fetch_docker_image` the parameter `docker_reference` is user controllable. The `docker_reference` variable is then passed to the vulnerable function `get_docker_image_platform`.  However, the `get_docker_image_plaform` function constructs a shell command with the passed `docker_reference`. The `pipes.run_command` then executes the shell command without any prior sanitization, making the function vulnerable to command injections. A malicious user who is able to create or add inputs to a project can inject commands. Although the command injections are blind and the user will not receive direct feedback without logs, it is still possible to cause damage to the server/container. The vulnerability appears for example if a malicious user adds a semicolon after the input of `docker://;`, it would allow appending malicious commands.

Version 32.5.1 contains a patch for this issue. The `docker_reference` input should be sanitized to avoid command injections and, as a workaround, one may avoid creating commands with user controlled input directly.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/nexB/scancode.io
Files changed:
scanpipe/pipes/__init__.py
scanpipe/pipes/fetch.py
Commit message: Merge pull request from GHSA-2ggp-cmvm-f62f

- Regex that validates docker_reference variable
- Securing against possible command injection

Vulnerable code:
        shell=True,

Fixed code:
        shell=False,
import re

    whitelist = r"^docker://[a-zA-Z0-9_.:/@-]+$"
    if not re.match(whitelist, docker_reference):
        raise ValueError("Invalid Docker reference.")
CVE-2020-5244 (PHP, published 2020-02-24T18:15Z)
Description: value: In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed. This has been patched in version 5.1.2.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/buddypress/BuddyPress
Files changed:
src/bp-core/admin/bp-core-admin-slugs.php
Commit message: Admin: Sanitize external links to activated BP component pages.

Props imath.
See #8235.

git-svn-id: https://buddypress.svn.wordpress.org/trunk@12549 cdf35c40-ae34-48e0-9cc9-0c9da1808c22


Vulnerable code:
								<a href="<?php echo get_permalink( $existing_pages[$name] ); ?>" class="button-secondary" target="_bp"><?php _e( 'View', 'buddypress' ); ?></a>

Fixed code:
								<a href="<?php echo esc_url( get_permalink( $existing_pages[$name] ) ); ?>" class="button-secondary" target="_bp"><?php _e( 'View', 'buddypress' ); ?></a>
CVE-2021-46875 (YAML, published 2023-03-12T05:15Z)
Description: value: An issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1. An XSS attack can occur because JavaScript code can be uploaded in a .html or .js file.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ezsystems/ezpublish-kernel
Files changed:
eZ/Bundle/EzPublishCoreBundle/Resources/config/default_settings.yml
Commit message: Merge pull request from GHSA-mrvj-7q4f-5p42

Co-authored-by: Gunnstein Lye <gunnstein.lye@ibexa.co>

Vulnerable code:

Fixed code:
        - hta
        - htm
        - html
        - xhtm
        - xhtml
        - jar
        - js
        - jse
        - svg
        - swf
CVE-2021-46876 (PHP, published 2023-03-12T05:15Z)
Description: value: An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/ezsystems/ezpublish-kernel
Files changed:
eZ/Bundle/EzPublishRestBundle/Resources/config/default_settings.yml
eZ/Bundle/EzPublishRestBundle/Resources/config/security.yml
eZ/Publish/Core/REST/Server/Controller/SessionController.php
eZ/Publish/Core/REST/Server/Security/RestAuthenticator.php
Commit message: Merge pull request from GHSA-gmrf-99gw-vvwj

Co-authored-by: Bartek Wajda <bartlomiej.wajda@ibexa.co>

Vulnerable code:
        $request->attributes->set('password', $sessionInput->password);
        LoggerInterface $logger = null

Fixed code:

    # Boundary times in microseconds which the authentication check will be delayed by.
    ezpublish_rest.authentication_min_delay_time: 30000
    ezpublish_rest.authentication_max_delay_time: 500000
            - "%ezpublish_rest.authentication_min_delay_time%"
            - "%ezpublish_rest.authentication_max_delay_time%"
        $request->attributes->set('password', (string) $sessionInput->password);
    const DEFAULT_MIN_SLEEP_VALUE = 30000;

    const DEFAULT_MAX_SLEEP_VALUE = 500000;

    /**
     * @var int|null
     */
    private $minSleepTime;

    /**
     * @var int|null
     */
    private $maxSleepTime;

        LoggerInterface $logger = null,
        $minSleepTime = self::DEFAULT_MIN_SLEEP_VALUE,
        $maxSleepTime = self::DEFAULT_MAX_SLEEP_VALUE
        $this->minSleepTime = !is_int($minSleepTime) ? self::DEFAULT_MIN_SLEEP_VALUE : $minSleepTime;
        $this->maxSleepTime = !is_int($maxSleepTime) ? self::DEFAULT_MAX_SLEEP_VALUE : $maxSleepTime;
        usleep(random_int($this->minSleepTime, $this->maxSleepTime));
CVE-2021-43816 (Go, published 2022-01-05T19:15Z)
Description: value: containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface (CRI), an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any privileged, regular file on disk for complete read/write access (sans delete). Such is achieved by placing the in-container location of the hostPath volume mount at either `/etc/hosts`, `/etc/hostname`, or `/etc/resolv.conf`. These locations are being relabeled indiscriminately to match the container process-label which effectively elevates permissions for savvy containers that would not normally be able to access privileged host files. This issue has been resolved in version 1.5.9. Users are advised to upgrade as soon as possible.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-281 \u2014 Improper Preservation of Permissions
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
Repository: https://github.com/dweomer/containerd
Files changed:
pkg/cri/opts/spec_linux.go
pkg/cri/server/container_create_linux.go
Commit message: Revert "[cri] label etc files for selinux containers"

This reverts commit a731039238c62be081eb8c31525b988415745eea.


Vulnerable code:
const (
	etcHosts       = "/etc/hosts"
	etcHostname    = "/etc/hostname"
	resolvConfPath = "/etc/resolv.conf"
)

// WithRelabeledContainerMounts relabels the default container mounts for files in /etc
func WithRelabeledContainerMounts(mountLabel string) oci.SpecOpts {
	return func(ctx context.Context, client oci.Client, _ *containers.Container, s *runtimespec.Spec) (err error) {
		if mountLabel == "" {
			return nil
		}
		for _, m := range s.Mounts {
			switch m.Destination {
			case etcHosts, etcHostname, resolvConfPath:
				if err := label.Relabel(m.Source, mountLabel, false); err != nil {
					return err
				}
			}
		}
		return nil
	}
}

	specOpts = append(specOpts, customopts.WithMounts(c.os, config, extraMounts, mountLabel), customopts.WithRelabeledContainerMounts(mountLabel))

Fixed code:
	specOpts = append(specOpts, customopts.WithMounts(c.os, config, extraMounts, mountLabel))
CVE-2015-5221 (C, published 2017-07-25T18:29Z)
Description: value: Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/mdadams/jasper
Files changed:
src/libjasper/mif/mif_cod.c
Commit message: CVE-2015-5221


Vulnerable code:
	jas_tvparser_destroy(tvp);

Fixed code:
	jas_tvparser_destroy(tvp);
CVE-2016-10248 (C, published 2017-03-15T14:59Z)
Description: value: The jpc_tsfb_synthesize function in jpc_tsfb.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) via vectors involving an empty sequence.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/mdadams/jasper
Files changed:
src/libjasper/include/jasper/jas_math.h
src/libjasper/include/jasper/jas_seq.h
src/libjasper/jpc/jpc_dec.c
src/libjasper/jpc/jpc_tsfb.c
Commit message: Fixed an integral type promotion problem by adding a JAS_CAST.
Modified the jpc_tsfb_synthesize function so that it will be a noop for
an empty sequence (in order to avoid dereferencing a null pointer).


Vulnerable code:
				mask = (1 << numbps) - 1;
	return (tsfb->numlvls > 0) ? jpc_tsfb_synthesize2(tsfb,

Fixed code:
/******************************************************************************\
*
\******************************************************************************/

__attribute__((no_sanitize("undefined")))
inline static jas_int_asr(int x, int n)
{
	assert(n >= 0);
	return x >> n;
}

__attribute__((no_sanitize("undefined")))
inline static jas_int_asl(int x, int n)
{
	assert(n >= 0);
	return x << n;
}

#define jas_matrix_size(matrix) \
	(jas_matrix_width(matrix) * jas_matrix_height(matrix))

#define jas_seq2d_size(s) \
	(jas_seq2d_width(s) * jas_seq2d_height(s))
	if (roishift < 0) {
		/* We could instead return an error here. */
		/* I do not think it matters much. */
		jas_eprintf("warning: forcing negative ROI shift to zero "
		  "(bitstream is probably corrupt)\n");
		roishift = 0;
	}
				mask = (JAS_CAST(uint_fast32_t, 1) << numbps) - 1;
	return (tsfb->numlvls > 0 && jas_seq2d_size(a)) ?
	  jpc_tsfb_synthesize2(tsfb,
CVE-2016-10249 (C, published 2017-03-15T14:59Z)
Description: value: Integer overflow in the jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.12 allows remote attackers to have unspecified impact via a crafted image file, which triggers a heap-based buffer overflow.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/mdadams/jasper
Files changed:
src/libjasper/base/jas_malloc.c
src/libjasper/base/jas_seq.c
Commit message: Fixed an integer overflow problem.


Vulnerable code:
	JAS_DBGLOG(101, ("jas_malloc called with %zu\n", size));
	JAS_DBGLOG(101, ("jas_realloc called with %x,%zu\n", ptr, size));
		return 0;
		return 0;
	matrix->datasize_ = numrows * numcols;
			jas_matrix_destroy(matrix);
			return 0;
			jas_matrix_destroy(matrix);
			return 0;

Fixed code:
	JAS_DBGLOG(101, ("jas_malloc(%zu)\n", size));
	JAS_DBGLOG(101, ("jas_realloc(%x, %zu)\n", ptr, size));
	size_t size;

	matrix = 0;
		goto error;
		goto error;
	matrix->datasize_ = 0;

	// matrix->datasize_ = numrows * numcols;
	if (!jas_safe_size_mul(numrows, numcols, &size)) {
		goto error;
	}
	matrix->datasize_ = size;
			goto error;
			goto error;

error:
	if (matrix) {
		jas_matrix_destroy(matrix);
	}
	return 0;
CVE-2016-10250 (C, published 2017-03-15T14:59Z)
Description: value: The jp2_colr_destroy function in jp2_cod.c in JasPer before 1.900.13 allows remote attackers to cause a denial of service (NULL pointer dereference) by leveraging incorrect cleanup of JP2 box data on error. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8887.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/mdadams/jasper
Files changed:
src/libjasper/jp2/jp2_cod.c
Commit message: Fixed another problem with incorrect cleanup of JP2 box data upon error.


Vulnerable code:
	box->ops = &boxinfo->ops;
			// Mark the box data as never having been constructed
			// so that we will not errantly attempt to destroy it later.
			box->ops = &jp2_boxinfo_unk.ops;
	fprintf(out, "type=%c%s%c (0x%08"PRIxFAST32"); length=%"PRIuFAST32"\n", '"', boxinfo->name,
	  '"', box->type, box->len);

Fixed code:

	// Mark the box data as never having been constructed
	// so that we will not errantly attempt to destroy it later.

		// From here onwards, the box data will need to be destroyed.
		// So, initialize the box operations.
		box->ops = &boxinfo->ops;

	fprintf(out, "type=%c%s%c (0x%08"PRIxFAST32"); length=%"PRIuFAST32"\n", '"',
	  boxinfo->name, '"', box->type, box->len);
CVE-2016-10251 (C, published 2017-03-15T14:59Z)
Description: value: Integer overflow in the jpc_pi_nextcprl function in jpc_t2cod.c in JasPer before 1.900.20 allows remote attackers to have unspecified impact via a crafted file, which triggers use of an uninitialized value.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/mdadams/jasper
Files changed:
src/libjasper/jpc/jpc_t2cod.c
src/libjasper/jpc/jpc_t2cod.h
Commit message: Fixed an integer overflow problem in the JPC codec that later resulted
in the use of uninitialized data.


Vulnerable code:
		pi->xstep = pi->picomp->hsamp * (1 << (pirlvl->prcwidthexpn +
		  pi->picomp->numrlvls - 1));
		pi->ystep = pi->picomp->vsamp * (1 << (pirlvl->prcheightexpn +
		  pi->picomp->numrlvls - 1));
			pi->xstep = JAS_MIN(pi->xstep, pi->picomp->hsamp * (1 <<
			  (pirlvl->prcwidthexpn + pi->picomp->numrlvls -
			  rlvlno - 1)));
			pi->ystep = JAS_MIN(pi->ystep, pi->picomp->vsamp * (1 <<
			  (pirlvl->prcheightexpn + pi->picomp->numrlvls -
			  rlvlno - 1)));
	int hsamp;
	int vsamp;
	int x;
	int y;
	int xstep;
	int ystep;
	int xstart;
	int ystart;
	int xend;
	int yend;

Fixed code:
		pi->xstep = pi->picomp->hsamp * (JAS_CAST(uint_fast32_t, 1) <<
		  (pirlvl->prcwidthexpn + pi->picomp->numrlvls - 1));
		pi->ystep = pi->picomp->vsamp * (JAS_CAST(uint_fast32_t, 1) <<
		  (pirlvl->prcheightexpn + pi->picomp->numrlvls - 1));
			pi->xstep = JAS_MIN(pi->xstep, pi->picomp->hsamp *
			  (JAS_CAST(uint_fast32_t, 1) << (pirlvl->prcwidthexpn +
			  pi->picomp->numrlvls - rlvlno - 1)));
			pi->ystep = JAS_MIN(pi->ystep, pi->picomp->vsamp *
			  (JAS_CAST(uint_fast32_t, 1) << (pirlvl->prcheightexpn +
			  pi->picomp->numrlvls - rlvlno - 1)));
	uint_fast32_t hsamp;
	uint_fast32_t vsamp;
	uint_fast32_t x;
	uint_fast32_t y;
	uint_fast32_t xstep;
	uint_fast32_t ystep;
	uint_fast32_t xstart;
	uint_fast32_t ystart;
	uint_fast32_t xend;
	uint_fast32_t yend;
CVE-2016-8654 (C, published 2018-08-01T16:29Z)
Description: value: A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versions before 2.0.0 are affected.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/mdadams/jasper
Files changed:
src/libjasper/jpc/jpc_qmfb.c
Commit message: Fixed a buffer overrun problem in the QMFB code in the JPC codec
that was caused by a buffer being allocated with a size that was too small
in some cases.
Added a new regression test case.


Vulnerable code:
	int hstartcol;
		hstartcol = (numrows + 1 - parity) >> 1;
		// ORIGINAL (WRONG): m = (parity) ? hstartcol : (numrows - hstartcol);
		m = numrows - hstartcol;
		dstptr = &a[hstartcol * stride];
	int hstartcol;
		if (!(buf = jas_alloc2(bufsize, sizeof(jpc_fix_t)))) {
		hstartcol = (numrows + 1 - parity) >> 1;
		// ORIGINAL (WRONG): m = (parity) ? hstartcol : (numrows - hstartcol);
		m = numrows - hstartcol;
		dstptr = &a[hstartcol * stride];
		if (!(buf = jas_alloc2(bufsize, sizeof(jpc_fix_t)))) {
		if (!(buf = jas_alloc3(bufsize, JPC_QMFB_COLGRPSIZE, sizeof(jpc_fix_t)))) {

Fixed code:
	int hstartrow;
		hstartrow = (numrows + 1 - parity) >> 1;
		// ORIGINAL (WRONG): m = (parity) ? hstartrow : (numrows - hstartrow);
		m = numrows - hstartrow;
		dstptr = &a[hstartrow * stride];
	int hstartrow;
		if (!(buf = jas_alloc3(bufsize, JPC_QMFB_COLGRPSIZE,
		  sizeof(jpc_fix_t)))) {
		hstartrow = (numrows + 1 - parity) >> 1;
		// ORIGINAL (WRONG): m = (parity) ? hstartrow : (numrows - hstartrow);
		m = numrows - hstartrow;
		dstptr = &a[hstartrow * stride];
		if (!(buf = jas_alloc3(bufsize, numcols, sizeof(jpc_fix_t)))) {
		if (!(buf = jas_alloc3(bufsize, JPC_QMFB_COLGRPSIZE,
		  sizeof(jpc_fix_t)))) {
CVE-2016-8690 (C, published 2017-02-15T19:59Z)
Description: value: The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted BMP image in an imginfo command.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/mdadams/jasper
Files changed:
src/appl/imginfo.c
src/libjasper/bmp/bmp_dec.c
Commit message: Fixed a sanitizer failure in the BMP codec.
Also, added a --debug-level command line option to the imginfo command
for debugging purposes.


Vulnerable code:
	OPT_INFILE
		v |= (c << 24);

Fixed code:
	OPT_INFILE,
	OPT_DEBUG
	{OPT_DEBUG, "debug-level", JAS_OPT_HASARG},
	int debug;
	debug = 0;
		case OPT_DEBUG:
			debug = atoi(jas_optarg);
			break;
	jas_setdbglevel(debug);

		jas_stream_close(instream);
#include "jasper/jas_debug.h"
	JAS_DBGLOG(1, (
	  "BMP header: magic 0x%x; siz %d; res1 %d; res2 %d; off %d\n",
	  hdr.magic, hdr.siz, hdr.reserved1, hdr.reserved2, hdr.off
	  ));
	JAS_DBGLOG(1,
	  ("BMP information: len %d; width %d; height %d; numplanes %d; "
	  "depth %d; enctype %d; siz %d; hres %d; vres %d; numcolors %d; "
	  "mincolors %d\n", info->len, info->width, info->height, info->numplanes,
	  info->depth, info->enctype, info->siz, info->hres, info->vres,
	  info->numcolors, info->mincolors));
		v |= (JAS_CAST(uint_fast32_t, c) << 24);
CVE-2016-8691 (C, published 2017-02-15T19:59Z)
Description: value: The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted XRsiz value in a BMP image to the imginfo command.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/mdadams/jasper
Files changed:
src/libjasper/jpc/jpc_cs.c
Commit message: Added range check on XRsiz and YRsiz fields of SIZ marker segment.


Vulnerable code:

Fixed code:
		if (siz->comps[i].hsamp == 0 || siz->comps[i].hsamp > 255) {
			jas_eprintf("invalid XRsiz value %d\n", siz->comps[i].hsamp);
			jas_free(siz->comps);
			return -1;
		}
		if (siz->comps[i].vsamp == 0 || siz->comps[i].vsamp > 255) {
			jas_eprintf("invalid YRsiz value %d\n", siz->comps[i].vsamp);
			jas_free(siz->comps);
			return -1;
		}
CVE-2016-8692 (C, published 2017-02-15T19:59Z)
Description: value: The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted YRsiz value in a BMP image to the imginfo command.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/mdadams/jasper
Files changed:
src/libjasper/jpc/jpc_cs.c
Commit message: Added range check on XRsiz and YRsiz fields of SIZ marker segment.


Vulnerable code:

Fixed code:
		if (siz->comps[i].hsamp == 0 || siz->comps[i].hsamp > 255) {
			jas_eprintf("invalid XRsiz value %d\n", siz->comps[i].hsamp);
			jas_free(siz->comps);
			return -1;
		}
		if (siz->comps[i].vsamp == 0 || siz->comps[i].vsamp > 255) {
			jas_eprintf("invalid YRsiz value %d\n", siz->comps[i].vsamp);
			jas_free(siz->comps);
			return -1;
		}
CVE-2016-8693 (C, published 2017-02-15T19:59Z)
Description: value: Double free vulnerability in the mem_close function in jas_stream.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image to the imginfo command.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/mdadams/jasper
Files changed:
src/libjasper/base/jas_stream.c
Commit message: The memory stream interface allows for a buffer size of zero.
The case of a zero-sized buffer was not handled correctly, as it could
lead to a double free.
This problem has now been fixed (hopefully).
One might ask whether a zero-sized buffer should be allowed at all,
but this is a question for another day.


Vulnerable code:
	assert(m->buf_);
	if (!(buf = jas_realloc2(m->buf_, bufsize, sizeof(unsigned char)))) {

Fixed code:
	//assert(m->buf_);
	if (!(buf = jas_realloc2(m->buf_, bufsize, sizeof(unsigned char))) &&
	  bufsize) {