hitoshura25/cvefixes huggingface dataset:
CVE-2014-9653 (C, published 2015-03-30T10:59Z)
Description: value: readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory access) or possibly have unspecified other impact via a crafted ELF file.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/file/file
Files changed:
src/readelf.c
Commit message: Bail out on partial reads, from Alexander Cherepanov


Vulnerable code:
FILE_RCSID("@(#)$File: readelf.c,v 1.113 2014/12/11 14:10:53 christos Exp $")
		if (pread(fd, xph_addr, xph_sizeof, off) == -1) {
	if (pread(fd, xsh_addr, xsh_sizeof, off + size * strtab) == -1) {
		if (pread(fd, name, sizeof(name), name_off + xsh_name) == -1) {
		name[sizeof(name) - 1] = '\0';
		if (pread(fd, xsh_addr, xsh_sizeof, off) == -1) {
			if (pread(fd, nbuf, xsh_size, xsh_offset) == -1) {
		if (pread(fd, xph_addr, xph_sizeof, off) == -1) {

Fixed code:
FILE_RCSID("@(#)$File: readelf.c,v 1.114 2014/12/11 14:19:36 christos Exp $")
		if (pread(fd, xph_addr, xph_sizeof, off) < (ssize_t)xph_sizeof) {
	ssize_t namesize;
	if (pread(fd, xsh_addr, xsh_sizeof, off + size * strtab) < (ssize_t)xsh_sizeof) {
		if ((namesize = pread(fd, name, sizeof(name) - 1, name_off + xsh_name)) == -1) {
		name[namesize] = '\0';
		if (pread(fd, xsh_addr, xsh_sizeof, off) < (ssize_t)xsh_sizeof) {
			if (pread(fd, nbuf, xsh_size, xsh_offset) < (ssize_t)xsh_size) {
		if (pread(fd, xph_addr, xph_sizeof, off) < (ssize_t)xph_sizeof) {
CVE-2015-8865 (C, published 2016-05-20T10:59Z)
Description: value: The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5, mishandles continuation-level jumps, which allows context-dependent attackers to cause a denial of service (buffer overflow and application crash) or possibly execute arbitrary code via a crafted magic file.
Severity: HIGH (CVSS v3 base score: 7.3)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/file/file
Files changed:
src/funcs.c
Commit message: PR/454: Fix memory corruption when the continuation level jumps by more than
20 in a single step.


Vulnerable code:
FILE_RCSID("@(#)$File: funcs.c,v 1.80 2015/01/02 21:29:39 christos Exp $")
		len = (ms->c.len += 20) * sizeof(*ms->c.li);

Fixed code:
FILE_RCSID("@(#)$File: funcs.c,v 1.81 2015/05/28 19:26:59 christos Exp $")
		len = (ms->c.len = 20 + level) * sizeof(*ms->c.li);
CVE-2017-1000249 (C, published 2017-09-11T19:29Z)
Description: value: An issue in file() was introduced in commit 9611f31313a93aa036389c5f3b15eea53510d4d1 (Oct 2016) lets an attacker overwrite a fixed 20 bytes stack buffer with a specially crafted .notes section in an ELF binary. This was fixed in commit 35c94dc6acc418f1ad7f6241a6680e5327495793 (Aug 2017).
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/file/file
Files changed:
src/readelf.c
Commit message: Fix always true condition (Thomas Jarosch)


Vulnerable code:
FILE_RCSID("@(#)$File: readelf.c,v 1.137 2017/08/13 00:21:47 christos Exp $")
	    type == NT_GNU_BUILD_ID && (descsz >= 4 || descsz <= 20)) {

Fixed code:
FILE_RCSID("@(#)$File: readelf.c,v 1.138 2017/08/27 07:55:02 christos Exp $")
	    type == NT_GNU_BUILD_ID && (descsz >= 4 && descsz <= 20)) {
CVE-2018-10360 (C, published 2018-06-11T10:29Z)
Description: value: The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/file/file
Files changed:
src/readelf.c
Commit message: Avoid reading past the end of buffer (Rui Reis)


Vulnerable code:
FILE_RCSID("@(#)$File: readelf.c,v 1.142 2018/05/24 18:08:01 christos Exp $")
				for (cp = cname; *cp && isprint(*cp); cp++)

Fixed code:
FILE_RCSID("@(#)$File: readelf.c,v 1.143 2018/06/09 16:00:06 christos Exp $")
				for (cp = cname; cp < nbuf + size && *cp
				    && isprint(*cp); cp++)
CVE-2019-18218 (C, published 2019-10-21T05:15Z)
Description: value: cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write).
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/file/file
Files changed:
src/cdf.c
src/cdf.h
Commit message: Limit the number of elements in a vector (found by oss-fuzz)


Vulnerable code:
FILE_RCSID("@(#)$File: cdf.c,v 1.115 2019/08/23 14:29:14 christos Exp $")
			if (nelements == 0) {
				DPRINTF(("CDF_VECTOR with nelements == 0\n"));
			DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
			    nelements));

Fixed code:
FILE_RCSID("@(#)$File: cdf.c,v 1.116 2019/08/26 14:31:39 christos Exp $")
			if (nelements > CDF_ELEMENT_LIMIT || nelements == 0) {
				DPRINTF(("CDF_VECTOR with nelements == %"
				    SIZE_T_FORMAT "u\n", nelements));
#define CDF_ELEMENT_LIMIT				100000
CVE-2019-8906 (C, published 2019-02-18T17:29Z)
Description: value: do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused.
Severity: LOW (CVSS v3 base score: 4.4)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/file/file
Files changed:
src/readelf.c
Commit message: Avoid OOB read (found by ASAN reported by F. Alonso)


Vulnerable code:
FILE_RCSID("@(#)$File: readelf.c,v 1.156 2018/10/19 00:33:04 christos Exp $")
			memcpy(&pi, nbuf + doff, descsz);

Fixed code:
FILE_RCSID("@(#)$File: readelf.c,v 1.157 2019/01/02 19:44:14 christos Exp $")
			memcpy(&pi, nbuf + doff, MIN(descsz, sizeof(pi)));
CVE-2019-20421 (Unknown, published 2020-01-27T05:15Z)
Description: value: In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, with high CPU consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.
Severity: HIGH (CVSS v3 base score: 7.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/Exiv2/exiv2
Files changed:
Commit message: Fix #1011 fix_1011_jp2_readmetadata_loop (#1013)

Fix #1011 fix_1011_jp2_readmetadata_loop

Vulnerable code:

Fixed code:
CVE-2021-29464 (C++, published 2021-04-30T19:15Z)
Description: value: Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A heap buffer overflow was found in Exiv2 versions v0.27.3 and earlier. The heap overflow is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `insert`. The bug is fixed in version v0.27.4.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/Exiv2/exiv2
Files changed:
src/jp2image.cpp
Commit message: Better bounds checking in Jp2Image::encodeJp2Header()


Vulnerable code:
        int     outlen = sizeof(Jp2BoxHeader) ; // now many bytes have we written to output?
        int      inlen = sizeof(Jp2BoxHeader) ; // how many bytes have we read from boxBuf?
        int32_t       length = getLong((byte*)&pBox->length, bigEndian);
        int32_t       count  = sizeof (Jp2BoxHeader);
            int32_t newlen = subBox.length;

Fixed code:
        long    outlen = sizeof(Jp2BoxHeader) ; // now many bytes have we written to output?
        long    inlen = sizeof(Jp2BoxHeader) ; // how many bytes have we read from boxBuf?
        uint32_t      length = getLong((byte*)&pBox->length, bigEndian);
        uint32_t      count  = sizeof (Jp2BoxHeader);
                enforce(subBox.length <= length - count, Exiv2::kerCorruptedMetadata);
            uint32_t newlen = subBox.length;
                    enforce(newlen <= output.size_ - outlen, Exiv2::kerCorruptedMetadata);
                    enforce(newlen <= output.size_ - outlen, Exiv2::kerCorruptedMetadata);
                enforce(newlen <= output.size_ - outlen, Exiv2::kerCorruptedMetadata);
CVE-2016-9435 (C, published 2017-01-20T15:59Z)
Description: value: The HTMLtagproc1 function in file.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via a crafted html file, related to <dd> tags.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/tats/w3m
Files changed:
file.c
parsetagx.c
Commit message: Fix uninitialised values for <i> and <dd>

Bug-Debian: https://github.com/tats/w3m/issues/16


Vulnerable code:

Fixed code:
	if (h_env->envc == 0 ||
	    (h_env->envc_real < h_env->nenv &&
	     envs[h_env->envc].env != HTML_DL &&
	     envs[h_env->envc].env != HTML_DL_COMPACT)) {
	    PUSH_ENV(HTML_DL);
	}
    tagname[0] = '\0';
CVE-2016-9436 (C, published 2017-01-20T15:59Z)
Description: value: parsetagx.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via a crafted html file, related to a <i> tag.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/tats/w3m
Files changed:
file.c
parsetagx.c
Commit message: Fix uninitialised values for <i> and <dd>

Bug-Debian: https://github.com/tats/w3m/issues/16


Vulnerable code:

Fixed code:
	if (h_env->envc == 0 ||
	    (h_env->envc_real < h_env->nenv &&
	     envs[h_env->envc].env != HTML_DL &&
	     envs[h_env->envc].env != HTML_DL_COMPACT)) {
	    PUSH_ENV(HTML_DL);
	}
    tagname[0] = '\0';
CVE-2016-9442 (Unknown, published 2016-12-12T02:59Z)
Description: value: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause memory corruption in certain conditions via a crafted HTML page.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/tats/w3m
Files changed:
Commit message: Merge pull request #27 from kcwu/fix-strgrow

Fix potential heap buffer corruption due to Strgrow

Vulnerable code:

Fixed code:
CVE-2018-6196 (C, published 2018-01-25T03:29Z)
Description: value: w3m through 0.5.3 is prone to an infinite recursion flaw in HTMLlineproc0 because the feed_table_block_tag function in table.c does not prevent a negative indent value.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/tats/w3m
Files changed:
table.c
Commit message: Prevent negative indent value in feed_table_block_tag()

Bug-Debian: https://github.com/tats/w3m/issues/88


Vulnerable code:

Fixed code:
    if (tbl->indent < 0)
	tbl->indent = 0;
	if (offset < 0)
	    offset = 0;
CVE-2018-6197 (C, published 2018-01-25T03:29Z)
Description: value: w3m through 0.5.3 is prone to a NULL pointer dereference flaw in formUpdateBuffer in form.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/tats/w3m
Files changed:
form.c
Commit message: Prevent invalid columnPos() call in formUpdateBuffer()

Bug-Debian: https://github.com/tats/w3m/issues/89


Vulnerable code:

Fixed code:
	    if (l == NULL)
		break;
CVE-2018-6198 (C, published 2018-01-25T03:29Z)
Description: value: w3m through 0.5.3 does not properly handle temporary files when the ~/.w3m directory is unwritable, which allows a local attacker to craft a symlink attack to overwrite arbitrary files.
Severity: LOW (CVSS v3 base score: 4.7)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/tats/w3m
Files changed:
config.h.dist
config.h.in
configure
configure.ac
main.c
rc.c
Commit message: Make temporary directory safely when ~/.w3m is unwritable


Vulnerable code:
for ac_func in strcasecmp strcasestr strchr memcpy strerror bcopy setpgrp chdir getcwd getwd readlink setenv putenv strtoll stroq atoll atoq symlink readlink lstat srand48 srandom getpassphrase waitpid setlocale
AC_CHECK_FUNCS(strcasecmp strcasestr strchr memcpy strerror bcopy setpgrp chdir getcwd getwd readlink setenv putenv strtoll stroq atoll atoq symlink readlink lstat srand48 srandom getpassphrase waitpid setlocale)

Fixed code:
#define HAVE_MKDTEMP
#undef HAVE_MKDTEMP
for ac_func in strcasecmp strcasestr strchr memcpy strerror bcopy setpgrp chdir mkdtemp getcwd getwd readlink setenv putenv strtoll stroq atoll atoq symlink readlink lstat srand48 srandom getpassphrase waitpid setlocale
AC_CHECK_FUNCS(strcasecmp strcasestr strchr memcpy strerror bcopy setpgrp chdir mkdtemp getcwd getwd readlink setenv putenv strtoll stroq atoll atoq symlink readlink lstat srand48 srandom getpassphrase waitpid setlocale)
#endif
#ifdef HAVE_MKDTEMP
    if (no_rc_dir && tmp_dir != rc_dir)
	if (rmdir(tmp_dir) != 0) {
	    fprintf(stderr, "Can't remove temporary directory (%s)!\n", tmp_dir);
	    exit(1);
	}
#ifdef HAVE_MKDTEMP
    tmp_dir = mkdtemp(Strnew_m_charp(tmp_dir, "/w3m-XXXXXX", NULL)->ptr);
    if (tmp_dir == NULL)
	tmp_dir = rc_dir;
#endif
CVE-2023-4255 (C, published 2023-12-21T16:15Z)
Description: value: An out-of-bounds write issue has been discovered in the backspace handling of the checkType() function in etc.c within the W3M application. This vulnerability is triggered by supplying a specially crafted HTML file to the w3m binary. Exploitation of this flaw could lead to application crashes, resulting in a denial of service condition.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/tats/w3m
Files changed:
etc.c
Commit message: Fix OOB access due to multiple backspaces

Commit 419ca82d57 (Fix m17n backspace handling causes out-of-bounds
write in checkType) introduced an incomplete fix.

In function checkType we store the length of the previous multi-char
character in a buffer plens_buffer with pointer plens pointing to the
current position inside the buffer. When encountering a backspace plens
is set to the previous position without a bounds check. This will lead
to plens being out of bounds if we get more backspaces than we have
processed multi-char characters before.

If we are at the beginning of the buffer do not decrement and set plen
(the current length) to 0.

This also fixes GH Issue #270 [BUG] Out of bound read in Strnew_size ,
Str.c:61

If the above explanation does sound weird it's because I didn't fully
grok that function. :-)


Vulnerable code:
			    plen = *(--plens);
			    plen = *(--plens);

Fixed code:
			    if (plens == plens_buffer)
				plen = 0;
			    else
				plen = *(--plens);
			    if (plens == plens_buffer)
				plen = 0;
			    else
				plen = *(--plens);
CVE-2022-4493 (Java, published 2022-12-14T12:15Z)
Description: value: A vulnerability classified as critical was found in scifio. Affected by this vulnerability is the function downloadAndUnpackResource of the file src/test/java/io/scif/util/DefaultSampleFilesService.java of the component ZIP File Handler. The manipulation leads to path traversal. The attack can be launched remotely. The name of the patch is fcb0dbca0ec72b22fe0c9ddc8abc9cb188a0ff31. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215803.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/scifio/scifio
Files changed:
src/test/java/io/scif/util/DefaultSampleFilesService.java
Commit message: vuln-fix: Zip Slip Vulnerability

This fixes a Zip-Slip vulnerability.

This change does one of two things. This change either

1. Inserts a guard to protect against Zip Slip.
OR
2. Replaces `dir.getCanonicalPath().startsWith(parent.getCanonicalPath())`, which is vulnerable to partial path traversal attacks, with the more secure `dir.getCanonicalFile().toPath().startsWith(parent.getCanonicalFile().toPath())`.

For number 2, consider `"/usr/outnot".startsWith("/usr/out")`.
The check is bypassed although `/outnot` is not under the `/out` directory.
It's important to understand that the terminating slash may be removed when using various `String` representations of the `File` object.
For example, on Linux, `println(new File("/var"))` will print `/var`, but `println(new File("/var", "/")` will print `/var/`;
however, `println(new File("/var", "/").getCanonicalPath())` will print `/var`.

Weakness: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Severity: High
CVSSS: 7.4
Detection: CodeQL (https://codeql.github.com/codeql-query-help/java/java-zipslip/) & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.ZipSlip)

Reported-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>
Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>

Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/16

Co-authored-by: Moderne <team@moderne.io>

Vulnerable code:

Fixed code:
				if (!outFile.toPath().normalize().startsWith(targetFolder.toPath().normalize())) {
					throw new RuntimeException("Bad zip entry");
				}
CVE-2024-22051 (Unknown, published 2024-01-04T21:15Z)
Description: value: CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more than UINT16_MAX columns.


Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/gjtorikian/commonmarker
Files changed:
Commit message: Merge pull request from GHSA-fmx4-26r3-wxpf

Update `cmark-gfm` to `0.29.0.gfm.3`, bump main to version `v0.23.3`

Vulnerable code:

Fixed code:
CVE-2017-20186 (Other, published 2023-08-28T13:15Z)
Description: value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in nikooo777 ckSurf up to 1.19.2. It has been declared as problematic. This vulnerability affects the function SpecListMenuDead of the file csgo/addons/sourcemod/scripting/ckSurf/misc.sp of the component Spectator List Name Handler. The manipulation of the argument cleanName leads to denial of service. Upgrading to version 1.21.0 is able to address this issue. The name of the patch is fd6318d99083a06363091441a0614bd2f21068e6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-238156. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-404 \u2014 Improper Resource Shutdown or Release
The product does not release or incorrectly releases a resource before it is made available for re-use.
Repository: https://github.com/nikooo777/ckSurf
Files changed:
csgo/addons/sourcemod/scripting/ckSurf/misc.sp
Commit message: fixed exploit with names

https://forums.alliedmods.net/showthread.php?t=297179

Vulnerable code:
								Format(sSpecs, 512, "%s%N\n", sSpecs, x);

Fixed code:
							//strip backslashes from names (causes lags and crashes?)
							char cleanName[MAX_NAME_LENGTH];
							Format(cleanName, sizeof(cleanName),"%N",x);
							ReplaceString(cleanName,sizeof(cleanName),"\\","",false);
								Format(sSpecs, 512, "%s%s\n", sSpecs, cleanName);