hitoshura25/cvefixes huggingface dataset:
CVE-2022-4876 (PHP, published 2023-01-04T23:15Z)
Description: value: A vulnerability was found in Kaltura mwEmbed up to 2.96.rc1 and classified as problematic. This issue affects some unknown processing of the file includes/DefaultSettings.php. The manipulation of the argument HTTP_X_FORWARDED_HOST leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.96.rc2 is able to address this issue. The patch is named 13b8812ebc8c9fa034eed91ab35ba8423a528c0b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217427.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/kaltura/mwEmbed
Files changed:
includes/DefaultSettings.php
Commit message: fix(FEC-12267): Fix XSS Vulnerability in mwEmbed - enforce valid domain format (#4266)

ignore non valid hostname in HTTP_X_FORWARDED_HOST header (same regex as [the server](https://github.com/kaltura/server/blob/Rigel-18.6.0/infra/storage/file_transfer_managers/asperaMgr.class.php#L81))

Vulnerable code:
    $_SERVER["HTTP_HOST"] = $xForwardedHosts[0];
    $_SERVER["SERVER_NAME"] = $xForwardedHosts[0];

Fixed code:
    $VALID_HOSTNAME_PATTERN = "/^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\\-]*[a-zA-Z0-9])\\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\\-]*[A-Za-z0-9])$/";
    if (preg_match($VALID_HOSTNAME_PATTERN, $xForwardedHosts[0]) === 1)
    {
        $_SERVER["HTTP_HOST"] = $xForwardedHosts[0];
        $_SERVER["SERVER_NAME"] = $xForwardedHosts[0];
    }
CVE-2022-4882 (JavaScript, published 2023-01-09T09:15Z)
Description: value: A vulnerability was found in kaltura mwEmbed up to 2.91. It has been rated as problematic. Affected by this issue is some unknown functionality of the file modules/KalturaSupport/components/share/share.js of the component Share Plugin. The manipulation of the argument res leads to cross site scripting. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.92.rc1 is able to address this issue. The name of the patch is 4f11b6f6610acd6d89de5f8be47cf7c610643845. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217664.
Severity: nan (CVSS v3 base score: 4.7)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/kaltura/mwEmbed
Files changed:
modules/KalturaSupport/components/share/share.js
Commit message: fix(FEC-11791): share url has cross-site scripting vulnerability (#4255)

**description of the issue:**
when share plugin is enabled for the player, the share url is not being sanitized, which exposes a security vulnerability.

**the solution:**
sanitizing encoded and decoded share url.

Solves FEC-11791

Vulnerable code:
			return res;

Fixed code:
			var sanitized = kWidget.sanitize(decodeURIComponent(res));
			return encodeURIComponent(sanitized);
CVE-2017-17439 (C, published 2017-12-06T15:29Z)
Description: value: In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/heimdal/heimdal
Files changed:
kdc/kerberos5.c
Commit message: Security: Avoid NULL structure pointer member dereference

This can happen in the error path when processing malformed AS
requests with a NULL client name.  Bug originally introduced on
Fri Feb 13 09:26:01 2015 +0100 in commit:

    a873e21d7c06f22943a90a41dc733ae76799390d

    kdc: base _kdc_fast_mk_error() on krb5_mk_error_ext()

Original patch by Jeffrey Altman <jaltman@secure-endpoints.com>


Vulnerable code:
    if(ret != 0 && ret != HDB_ERR_NOT_FOUND_HERE && reply->length == 0) {
				 &r->client_princ->name,
				 &r->client_princ->realm,

Fixed code:
    if (ret != 0 && ret != HDB_ERR_NOT_FOUND_HERE && reply->length == 0) {
				 r->client_princ ?
                                     &r->client_princ->name : NULL,
				 r->client_princ ?
                                     &r->client_princ->realm : NULL,
CVE-2017-6594 (Other, published 2017-08-28T19:29Z)
Description: value: The transit path validation code in Heimdal before 7.3 might allow attackers to bypass the capath policy protection mechanism by leveraging failure to add the previous hop realm to the transit path of issued tickets.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-295 \u2014 Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
Repository: https://github.com/heimdal/heimdal
Files changed:
NEWS
kdc/krb5tgs.c
tests/kdc/check-kdc.in
tests/kdc/krb5.conf.in
Commit message: Fix transit path validation CVE-2017-6594

Commit f469fc6 (2010-10-02) inadvertently caused the previous hop realm
to not be added to the transit path of issued tickets.  This may, in
some cases, enable bypass of capath policy in Heimdal versions 1.5
through 7.2.

Note, this may break sites that rely on the bug.  With the bug some
incomplete [capaths] worked, that should not have.  These may now break
authentication in some cross-realm configurations.


Vulnerable code:
	/* not us, so add the previous realm to transited set */
				 krb5_principal_get_realm(context, krbtgt->entry.principal));

Fixed code:
Release Notes - Heimdal - Version Heimdal 7.3

 Security

 - Fix transit path validation.  Commit f469fc6 (2010-10-02) inadvertently
   caused the previous hop realm to not be added to the transit path
   of issued tickets.  This may, in some cases, enable bypass of capath
   policy in Heimdal versions 1.5 through 7.2.

   Note, this may break sites that rely on the bug.  With the bug some
   incomplete [capaths] worked, that should not have.  These may now break
   authentication in some cross-realm configurations.
   (CVE-2017-6594)


    /*
     * If the realm of the presented tgt is neither the client nor the server
     * realm, it is a transit realm and must be added to transited set.
     */
               const char *tgt_realm,
				 tgt_realm);
    const char *tgt_realm = /* Realm of TGT issuer */
        krb5_principal_get_realm(context, krbtgt->entry.principal);
                         tgt_realm,
R8=SOME-REALM8.UK
${kadmin} \
    init \
    --realm-max-ticket-life=1day \
    --realm-max-renewable-life=1month \
    ${R8} || exit 1

${kadmin} add -p foo --use-defaults foo@${R8} || exit 1
${kadmin} add -p cross1 --use-defaults krbtgt/${R8}@${R6} || exit 1
${kadmin} add -p cross2 --use-defaults krbtgt/${R6}@${R8} || exit 1

${kadmin} check ${R8} || exit 1
echo "Should not get x-realm tickets with capaths for $R -> $R8"
${kgetcred} foo@${R8} && { ec=1 ; eval "${testfailed}"; }
fgrep "cross-realm ${H3} -> ${H1} via [${H2}, ${R}]" messages.log > /dev/null || { ec=1 ; eval "${testfailed}"; }
fgrep "cross-realm ${H3} -> ${R} via [${H2}]" messages.log > /dev/null || { ec=1 ; eval "${testfailed}"; }
fgrep "cross-realm ${H3} -> ${H2}" messages.log > /dev/null || { ec=1 ; eval "${testfailed}"; }
	SOME-REALM8.UK = {
		kdc = localhost:@port@
	}
		SOME-REALM8.UK = SOME-REALM6.US
CVE-2021-3671 (C, published 2021-10-12T18:15Z)
Description: value: A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/heimdal/heimdal
Files changed:
kdc/krb5tgs.c
Commit message: kdc: validate sname in TGS-REQ

In tgs_build_reply(), validate the server name in the TGS-REQ is present before
dereferencing.


Vulnerable code:

Fixed code:
    } else if (s == NULL) {
	ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
	_kdc_set_e_text(r, "No server in request");
	goto out;
CVE-2020-5281 (Unknown, published 2020-03-25T18:15Z)
Description: value: In Perun before version 3.9.1, VO or group manager can modify configuration of the LDAP extSource to retrieve all from Perun LDAP. Issue is fixed in version 3.9.1 by sanitisation of the input.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/CESNET/perun
Files changed:
Commit message: Merge pull request #2635 from stavamichal/fixVulnerablityInLDAPBasedExtSources

Fix vulnerability in communication with LDAP connector

Vulnerable code:

Fixed code:
CVE-2023-42457 (Unknown, published 2023-09-21T15:15Z)
Description: value: plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches are available in `plone.rest` 2.0.1 and 3.0.1.  Series 1.x is not affected. As a workaround, one may redirect `/++api++/++api++` to `/++api++` in one's frontend web server (nginx, Apache).

Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/plone/plone.rest
Files changed:
Commit message: Merge pull request from GHSA-h6rp-mprm-xgcq

When ++api++ is in the url multiple times, redirect to the proper url. [master]

Vulnerable code:

Fixed code:
CVE-2022-36752 (C, published 2022-07-28T23:15Z)
Description: value: png2webp v1.0.4 was discovered to contain an out-of-bounds write via the function w2p. This vulnerability is exploitable via a crafted png file.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/landfillbaby/png2webp
Files changed:
png2webp.c
Commit message: v1.0.5: fix buffer overrun when reading bad WebPs


Vulnerable code:
#define VERSION "v1.0.4"

Fixed code:
#define VERSION "v1.0.5"
  if(l <= 12
#ifdef SSIZE_MAX
    || l - 12 > SSIZE_MAX
#endif
  ) {
    PF("ERROR reading %s: %s", IP, k[2]);
    goto w2p_close;
  }
CVE-2024-34713 (Other, published 2024-05-14T16:17Z)
Description: value: sshproxy is used on a gateway to transparently proxy a user SSH connection on the gateway to an internal host via SSH. Prior to version 1.6.3, any user authorized to connect to a ssh server using `sshproxy` can inject options to the `ssh` command executed by `sshproxy`. All versions of `sshproxy` are impacted. The problem is patched starting in version 1.6.3. The only workaround is to use the `force_command` option in `sshproxy.yaml`, but it's rarely relevant.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/cea-hpc/sshproxy
Files changed:
cmd/sshproxy/sshproxy.go
test/fedora-image/Dockerfile
Commit message: Prevent ssh option injection (#16)



Vulnerable code:
				sshArgs = append(sshArgs, "--", host, translateCmdConf.Command)
			sshArgs = append(sshArgs, host, doCmd)
FROM fedora:latest

Fixed code:
				sshArgs = append(sshArgs, host, "--", translateCmdConf.Command)
			sshArgs = append(sshArgs, host, "--", doCmd)
FROM fedora:39
CVE-2021-23444 (Other, published 2021-09-21T17:15Z)
Description: value: This affects the package jointjs before 3.4.2. A type confusion vulnerability can lead to a bypass of CVE-2020-28480 when the user-provided keys used in the path parameter are arrays in the setByPath function.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-843 \u2014 Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Repository: https://github.com/clientIO/joint
Files changed:
src/util/util.mjs
test/jointjs/core/util.js
Commit message: util.setByPath() - prevent prototype pollution (#1514)



Vulnerable code:
        ['__proto__/polluted', 'constructor/prototype/polluted'].forEach(function(path) {

Fixed code:
    if (typeof key !== 'string' && typeof key !== 'number') {
        key = String(key);
    }
        [
            '__proto__/polluted',
            'constructor/prototype/polluted',
            [['__proto__'], 'polluted']
        ].forEach(function(path) {
CVE-2024-29032 (Python, published 2024-03-20T21:15Z)
Description: value: Qiskit IBM Runtime is an environment that streamlines quantum computations and provides optimal implementations of the Qiskit quantum computing SDK. Starting in version 0.1.0 and prior to version 0.21.2, deserializing json data using `qiskit_ibm_runtime.RuntimeDecoder` can lead to arbitrary code execution given a correctly formatted input string. Version 0.21.2 contains a fix for this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Qiskit/qiskit-ibm-runtime
Files changed:
qiskit_ibm_runtime/utils/json.py
test/unit/test_data_serialization.py
Commit message: Merge pull request from GHSA-x4x5-jv3x-9c7m

* restrict import path

* add test

Vulnerable code:
            if obj_type == "settings":
from qiskit.quantum_info import SparsePauliOp, Pauli, Statevector
    @skip("Skip until qiskit-ibm-provider/736 is merged")
        coeff_x = Parameter("x")
        coeff_y = coeff_x + 1
            SparsePauliOp(Pauli("XYZX"), coeffs=[coeff_y]),
            Statevector([1, 0]),

Fixed code:
            if obj_type == "settings" and obj["__module__"].startswith(
                "qiskit.quantum_info.operators"
            ):
from qiskit.quantum_info import SparsePauliOp, Pauli
        # TODO: Re-enable use of Parameter when #1521 is fixed.
        # coeff_x = Parameter("x")
        # coeff_y = coeff_x + 1
            # SparsePauliOp(Pauli("XYZX"), coeffs=[coeff_y]),
            Pauli("XYZ"),
            Pauli("XYZX"),

    def test_unknown_settings(self):
        """Test settings not on whitelisted path."""
        random_settings = {
            "__type__": "settings",
            "__module__": "subprocess",
            "__class__": "Popen",
            "__value__": {
                "args": ["echo", "hi"]
            }
        }
        encoded = json.dumps(random_settings)
        decoded = json.loads(encoded, cls=RuntimeDecoder)
        self.assertIsInstance(decoded, dict)
        self.assertDictEqual(decoded, random_settings)
CVE-2021-44421 (Rust, published 2022-03-10T17:44Z)
Description: value: The pointer-validation logic in util/mem_util.rs in Occlum before 0.26.0 for Intel SGX acts as a confused deputy that allows a local attacker to access unauthorized information via side-channel analysis.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/occlum/occlum
Files changed:
src/libos/src/util/mem_util.rs
Commit message: Check the buffer address before copy the data from the buffer

This commit fixed an Occlum security issue. The researchers from KU
Leuven (Belgium) and the University of Birmingham (UK) found it and
reported it to Occlum team. Thank you, Jo Van Bulck, Frank Piessens,
Fritz Alder, David Oswald, Jesse Spielman and Sam Thomas.


Vulnerable code:
        if !is_inside_user_space(out_ptr as *const u8, cstring.as_bytes().len()) {
            cstring.as_bytes().len(),

Fixed code:
        // confirm that at least the fisrt byte of the string is from user
        check_ptr(out_ptr)?;

        if !is_inside_user_space(out_ptr as *const u8, cstring.as_bytes_with_nul().len()) {
        // confirm that at least the fisrt byte of the string is out side of enclave
        check_ptr(out_ptr)?;

            cstring.as_bytes_with_nul().len(),
CVE-2015-9542 (C, published 2020-02-24T15:15Z)
Description: value: add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could send a crafted password to an application (loading the pam_radius library) and crash it. Arbitrary code execution might be possible, depending on the application, C library, compiler, and other factors.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FreeRADIUS/pam_radius
Files changed:
src/pam_radius_auth.c
Commit message: Use "length", which has been limited in size


Vulnerable code:
	memcpy(hashed, password, strlen(password));

Fixed code:
	memcpy(hashed, password, length);
CVE-2018-8088 (Java, published 2018-03-20T16:29Z)
Description: value: org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/qos-ch/slf4j
Files changed:
slf4j-ext/src/main/java/org/slf4j/ext/EventData.java
Commit message: fix SLF4J-431


Vulnerable code:

Fixed code:
 * 
 * @deprecated Due to a security vulnerability, this class will be removed without replacement.
CVE-2022-27311 (Ruby, published 2022-04-25T13:15Z)
Description: value: Gibbon v3.4.4 and below allows attackers to execute a Server-Side Request Forgery (SSRF) via a crafted URL.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/amro/gibbon
Files changed:
lib/gibbon/api_request.rb
spec/gibbon/gibbon_spec.rb
Commit message: Ensure we raise if the root domain changed and it was not an expected behavior


Vulnerable code:

Fixed code:
      raise Gibbon::GibbonError, "SSRF attempt" unless URI(computed_api_endpoint).host.include?("api.mailchimp.com")


    it "raises with a valid SSRF attack" do
      @api_key = "-attacker.net/test/?"
      @gibbon.api_key = @api_key
      expect {@gibbon.try.retrieve}.not_to raise_error
    end
CVE-2022-27311 (Ruby, published 2022-04-25T13:15Z)
Description: value: Gibbon v3.4.4 and below allows attackers to execute a Server-Side Request Forgery (SSRF) via a crafted URL.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/amro/gibbon
Files changed:
CHANGELOG.md
lib/gibbon/api_request.rb
lib/gibbon/gibbon_helpers.rb
lib/gibbon/version.rb
spec/gibbon/gibbon_spec.rb
Commit message: bump version, handle invalid API key DC


Vulnerable code:
      raise Gibbon::GibbonError, "SSRF attempt" unless URI(computed_api_endpoint).host.include?("api.mailchimp.com")

        # Add a period since the data_center is a subdomain and it keeps things dry
        data_center = "#{api_key.split('-').last}."
  VERSION = "3.4.3"
    it "raises with a valid SSRF attack" do
      @api_key = "-attacker.net/test/?"
      expect {@gibbon.try.retrieve}.to raise_error(Gibbon::MailChimpError, /SSRF attempt/)

Fixed code:
## [3.4.4] - 2022-02-24
- Remove non-alpha characters when parsing datacenter from API keys to prevent potential attackers from injecting a domain via the API key. This would only be possible if one were using user-provided API keys (e.g. from a form, etc.).
        # Remove all non-alphanumberic characters in case someone attempts to inject
        # a different domain into the API key (e.g. when consuming user form-provided keys)
        # This approach avoids assuming a 3 letter prefix (e.g. is MC were to create 
        # a us10 DC, this would continue to work), and will continue to hit MC's server
        # rather than a would-be attacker's servers.
        data_center = "#{api_key.split('-').last.gsub(/[^0-9a-z ]/i, '')}."
  VERSION = "3.4.4"
  
    it "removes non-alpha characters from datacenter prefix" do
      @api_key = "123-attacker.net/test/?"
      @gibbon.try
      @request = Gibbon::APIRequest.new(builder: @gibbon)
      expect(@request.api_url).to eq("https://attackernettest.api.mailchimp.com/3.0/try")
CVE-2022-31796 (Other, published 2022-06-02T14:15Z)
Description: value: libjpeg 1.63 has a heap-based buffer over-read in HierarchicalBitmapRequester::FetchRegion in hierarchicalbitmaprequester.cpp because the MCU size can be different between allocation and use.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/thorfdbg/libjpeg
Files changed:
README
README.history
control/hierarchicalbitmaprequester.cpp
Commit message: The code now checks for consistency of the MCU sizes across
hierarchical levels, and fails in case they are different.


Vulnerable code:
** $Id: hierarchicalbitmaprequester.cpp,v 1.42 2020/04/08 10:05:41 thor Exp $

Fixed code:
The code now also checks the consistency of the MCU sizes in the
hierarchical process and fails if they differ across levels.
The code now also checks the consistency of the MCU sizes in the
hierarchical process and fails if they differ across levels.
** $Id: hierarchicalbitmaprequester.cpp,v 1.43 2022/05/24 05:42:35 thor Exp $
      if (m_pLargestScale) {
        class Frame *frame = m_pLargestScale->FrameOf();
        while(frame) {
          if (frame->ComponentOf(i)->SubXOf() != sx || frame->ComponentOf(i)->SubYOf() != sy)
            JPG_THROW(MALFORMED_STREAM,"HierarchicalBitmapRequester::PrepareForDecoding",
                      "component subsampling is inconsistent across hierarchical levels");
          frame = frame->NextOf();
        }
      }