hitoshura25/cvefixes huggingface dataset:
CVE-2020-15007 (C, published 2020-06-24T11:15Z)
Description: value: A buffer overflow in the M_LoadDefaults function in m_misc.c in id Tech 1 (aka Doom engine) allows arbitrary code execution via an unsafe usage of fscanf, because it does not limit the number of characters to be read in a format argument.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/AXDOOMER/doom-vanille
Files changed:
m_misc.c
Commit message: Fix buffer overflow in M_LoadDefaults

Too much data will most likely result in a crash or freeze, but you can overwrite the stack which can be used to do an arbitrary code execution. (https://twitter.com/notrevenant/status/1268654123903340544)


Vulnerable code:
	    if (fscanf (f, "%79s %[^\n]\n", def, strparm) == 2)

Fixed code:
	    if (fscanf (f, "%79s %99[^\n]\n", def, strparm) == 2)
CVE-2020-7611 (Java, published 2020-03-30T22:15Z)
Description: value: All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from 1.3.0 before 1.3.2 are vulnerable to HTTP Request Header Injection due to not validating request headers passed to the client.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-444 \u2014 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent
         (such as a proxy or firewall) in the data flow between two
         entities such as a client and server, but it does not
         interpret malformed HTTP requests or responses in ways that
         are consistent with how the messages will be processed by
         those entities that are at the ultimate destination.
Repository: https://github.com/micronaut-projects/micronaut-core
Files changed:
http-netty/src/main/java/io/micronaut/http/netty/NettyHttpHeaders.java
Commit message: Validate client headers


Vulnerable code:
        this.nettyHeaders = new DefaultHttpHeaders(false);

Fixed code:
        this.nettyHeaders = new DefaultHttpHeaders();
CVE-2020-11722 (C++, published 2020-04-12T19:15Z)
Description: value: Dungeon Crawl Stone Soup (aka DCSS or crawl) before 0.25 allows remote attackers to execute arbitrary code via Lua bytecode embedded in an uploaded .crawlrc file.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/crawl/crawl
Files changed:
crawl-ref/source/clua.cc
Commit message: Disable lua load(), loadstring() bytcode loading


Vulnerable code:

Fixed code:
    if (script[0] == 0x1b)
        abort();

    lua_pushnil(_state);
    lua_setglobal(_state, "load");
CVE-2020-11722 (C++, published 2020-04-12T19:15Z)
Description: value: Dungeon Crawl Stone Soup (aka DCSS or crawl) before 0.25 allows remote attackers to execute arbitrary code via Lua bytecode embedded in an uploaded .crawlrc file.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/crawl/crawl
Files changed:
crawl-ref/source/clua.cc
Commit message: Disable lua bytecode loading


Vulnerable code:

Fixed code:
static int lua_loadstring(lua_State *ls)
{
    const auto lua = luaL_checkstring(ls, 1);
    if (lua[0] == 0x1b)
        abort();
    lua_settop(ls, 0);
    if (luaL_loadstring(ls, lua))
    {
        lua_pushnil(ls);
        lua_insert(ls, 1);
    }
    return lua_gettop(ls);
}

    lua_pushcfunction(_state, lua_loadstring);
    lua_setglobal(_state, "loadstring");
CVE-2014-125096 (PHP, published 2023-04-10T03:15Z)
Description: value: A vulnerability was found in Fancy Gallery Plugin 1.5.12 on WordPress. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file class.options.php of the component Options Page. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.5.13 is able to address this issue. The identifier of the patch is fdf1f9e5a1ec738900f962e69c6fa4ec6055ed8d. It is recommended to upgrade the affected component. The identifier VDB-225349 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wp-plugins/fancy-gallery
Files changed:
assets/js/fancy-gallery.js
class.options.php
plugin.php
readme.txt
widget.taxonomies.php
widget.taxonomy-cloud.php
Commit message: Fixed: XSS issue in the options page, Improved: Options page slug is sanitized now, Fixed Settings warning in taxonomy and taxonomy cloud widget

git-svn-id: https://plugins.svn.wordpress.org/fancy-gallery/trunk@1026822 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
      // Find other link images which belongs to this one
      __CLASS__,
    $url = Add_Query_Arg(Array('page' => __CLASS__), Admin_Url('options-general.php'));
      WP_Die($this->t('Error while deleting: ' . $_GET['delete']));
Version: 1.5.12
  var $core; #  Pointer to the core class
    Echo $args['before_title'] . Apply_Filters('widget_title', $this->Get_Option('title'), $settings, $this->id_base) . $args['after_title'];
  var $core; #  Pointer to the core class
    Echo $args['before_title'] . Apply_Filters('widget_title', $this->get_option('title'), $settings, $this->id_base) . $args['after_title'];

Fixed code:
      // Find other linked images which belongs to this gallery
    $options_page_slug, # Slug for the options page
    $this->options_page_slug = Sanitize_Title(Str_Replace(Array('\\', '/', '_'), '-', __CLASS__));
      $this->options_page_slug,
    $url = Add_Query_Arg(Array('page' => $this->options_page_slug), Admin_Url('options-general.php'));
      WP_Die($this->t('Error while deleting: ' . HTMLSpecialChars($_GET['delete'])));
Version: 1.5.13
= 1.5.13 =
* Fixed: XSS issue in the options page
* Improved: Options page slug is sanitized now
* Fixed Settings warning in taxonomy and taxonomy cloud widget

  public
    $arr_options,
    $core; #  Pointer to the core class
    Echo $args['before_title'] . Apply_Filters('widget_title', $this->Get_Option('title'), $this->arr_option, $this->id_base) . $args['after_title'];
  public
    $arr_option,
    $core; #  Pointer to the core class
    Echo $args['before_title'] . Apply_Filters('widget_title', $this->get_option('title'), $this->arr_option, $this->id_base) . $args['after_title'];
CVE-2019-14934 (C, published 2019-08-11T22:15Z)
Description: value: An issue was discovered in PDFResurrect before 0.18. pdf_load_pages_kids in pdf.c doesn't validate a certain size value, which leads to a malloc failure and out-of-bounds write.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/enferex/pdfresurrect
Files changed:
main.c
main.h
pdf.c
Commit message: Zero and sanity check all dynamic allocs.

This addresses the memory issues in Issue #6 expressed in
calloc_some.pdf and malloc_some.pdf


Vulnerable code:
    new_fname = malloc(strlen(fname) + strlen(dirname) + 16);
        dname = malloc(strlen(name) + 16);
    pdf = calloc(1, sizeof(pdf_t));
        pdf->name = malloc(strlen(n) + 1);
        pdf->name = malloc(strlen("Unknown") + 1);
    pdf->xrefs = calloc(1, sizeof(xref_t) * pdf->n_xrefs);
            buf = malloc(sz + 1);
        dst_name = malloc(strlen(name) * 2 + 16);
    xref->entries = calloc(1, xref->n_entries * sizeof(struct _xref_entry));
    daddy = malloc(sizeof(creator_template));
    data = malloc(blk_sz * n_blks);
    memset(data, 0, blk_sz * n_blks);
    long start;

    char *header;

    header = calloc(1, 1024);
    
    start = ftell(fp);
    
        ascii = malloc(strlen(str) + 1);
    ascii = malloc(str_len);

Fixed code:
    new_fname = safe_calloc(strlen(fname) + strlen(dirname) + 16);
void *safe_calloc(size_t size) {
  void *addr;

  if (!size)
  {
    ERR("Invalid allocation size.\n");
    exit(EXIT_FAILURE);
  }
  if (!(addr = calloc(1, size)))
  {
      ERR("Failed to allocate requested number of bytes, out of memory?\n");
      exit(EXIT_FAILURE);
  }
  return addr;
}


        dname = safe_calloc(strlen(name) + 16);
/* Returns a zero'd buffer of 'size' bytes or exits in failure. */
extern void *safe_calloc(size_t bytes);
    pdf = safe_calloc(sizeof(pdf_t));
        pdf->name = safe_calloc(strlen(n) + 1);
        pdf->name = safe_calloc(strlen("Unknown") + 1);
    pdf->xrefs = safe_calloc(sizeof(xref_t) * pdf->n_xrefs);
            buf = safe_calloc(sz + 1);
        dst_name = safe_calloc(strlen(name) * 2 + 16);
    xref->entries = safe_calloc(xref->n_entries * sizeof(struct _xref_entry));
    daddy = safe_calloc(sizeof(creator_template));
    data = safe_calloc(blk_sz * n_blks);
    char *header = safe_calloc(1024);
    long start = ftell(fp);
        ascii = safe_calloc(strlen(str) + 1);
    ascii = safe_calloc(str_len);
CVE-2020-20740 (Other, published 2020-11-20T19:15Z)
Description: value: PDFResurrect before 0.20 lack of header validation checks causes heap-buffer-overflow in pdf_get_version().
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/enferex/pdfresurrect
Files changed:
AUTHORS
pdf.c
Commit message: Update header validation checks.

Thanks to yifengchen-cc for identifying this.


Vulnerable code:
    int   is_pdf;
    header = get_header(fp);

    if (header && strstr(header, "%PDF-"))
      is_pdf = 1;
    else 
      is_pdf = 0;

    char *header, *c;

    header = get_header(fp);
    /* Locate version string start and make sure we dont go past header */
        (c + strlen("%PDF-M.m") + 2))

Fixed code:

yifengchen-cc: Reported a header parsing bug.
    if (!(header = get_header(fp)))
      return 0;
    /* First 1024 bytes of doc must be header (1.7 spec pg 1102) */
    const char *c = strstr(header, "%PDF-");
    const int is_pdf = c && ((c - header+strlen("%PDF-M.m")) < 1024);
    char *header = get_header(fp);
    /* Locate version string start and make sure we dont go past header
     * The format is %PDF-M.m, where 'M' is the major number and 'm' minor.
     */
    const char *c;
        ((c + 6)[0] == '.') && // Separator
        isdigit((c + 5)[0]) && // Major number
        isdigit((c + 7)[0]))   // Minor number
CVE-2019-25085 (C, published 2022-12-26T07:15Z)
Description: value: A vulnerability was found in GNOME gvdb. It has been classified as critical. This affects the function gvdb_table_write_contents_async of the file gvdb-builder.c. The manipulation leads to use after free. It is possible to initiate the attack remotely. The name of the patch is d83587b2a364eb9a9a53be7e6a708074e252de14. It is recommended to apply a patch to fix this issue. The identifier VDB-216789 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/GNOME/gvdb
Files changed:
gvdb-builder.c
Commit message: Fix gvdb_table_write_contents_async()

It worked when I first wrote it, but I broke it during the late stages
of code review. str is already freed here, so this is a use-after-free
vulnerability for starters. It also causes the file saved to be always
empty.


Vulnerable code:
  g_file_replace_contents_async (file, str->str, str->len,

Fixed code:
  g_file_replace_contents_async (file,
                                 g_bytes_get_data (bytes, NULL),
                                 g_bytes_get_size (bytes),
CVE-2021-40348 (Other, published 2021-11-01T05:15Z)
Description: value: Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tomcat user account with Sudo, according to the installation setup. This can lead to the ability of an attacker to use --option to append arbitrary code to a root-owned file that eventually will be executed by the system. This is fixed in Uyuni spacewalk-admin 4.3.2-1.
Severity: HIGH (CVSS v3 base score: 8.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/uyuni-project/uyuni
Files changed:
spacewalk/admin/spacewalk-admin.changes
Commit message: Merge pull request #4414 from uyuni-project/Uyuni-2021.09

Backport #4413 and tagging to master

Vulnerable code:

Fixed code:
 -------------------------------------------------------------------
 Thu Oct 28 12:16:53 CEST 2021 - jgonzalez@suse.com
 
 - version 4.3.2-1
   * Fix setup with rhn-config-satellite (bsc#1190300)
   * Allow admins to modify only spacewalk config files with
     rhn-config-satellite.pl (bsc#1190040) (CVE-2021-40348)
CVE-2020-7704 (JavaScript, published 2020-08-17T17:15Z)
Description: value: The package linux-cmdline before 1.0.1 are vulnerable to Prototype Pollution via the constructor.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/piranna/linux-cmdline
Files changed:
index.js
test.js
Commit message: [fix] Don't pollute prototype


Vulnerable code:
  let key = keypath.shift()
  let node = result

  while(keypath.length)
  {
    node[key] = node[key] || {}
    node = node[key]

    key = keypath.shift()
  }

  node[key] = val

Fixed code:
  let key = keypath.shift()

  if(!keypath.length) return {...result, [key]: val}

  if(!result.hasOwnProperty(key)) result = {...result, [key]: {}}

  let newKey
  let newNode
  let node = result

  while(true)
  {
    newKey = keypath.shift()
    newNode = node[key]

    if(!keypath.length) break

    node = node[key] = {...newNode, [newKey]: newNode[newKey] || {}}
    key = newKey
  }

  node[key] = {...newNode, [newKey]: val}


// Don't pollute prototype
const result2 = linuxCmdline('__proto__.polluted=foo')
const expected2 =
{
  ['__proto__']:
  {
    polluted: 'foo'
  }
}

deepStrictEqual(result2, expected2)

deepStrictEqual({}.__proto__.polluted, undefined)
CVE-2024-23346 (Python, published 2024-02-21T17:15Z)
Description: value: Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.20. This method insecurely utilizes `eval()` for processing input, enabling execution of arbitrary code when parsing untrusted input. Version 2024.2.20 fixes this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/materialsproject/pymatgen
Files changed:
pymatgen/symmetry/settings.py
Commit message: Update `JonesFaithfulTransformation` to use sympy

Signed-off-by: Matthew Horton <mkhorton@users.noreply.github.com>

Vulnerable code:
            # should be fine to use eval here but be mindful for security
            # reasons
            # see http://lybniz2.sourceforge.net/safeeval.html
            # could replace with regex? or sympy expression?
            P = np.array([eval(x, {"__builtins__": None}, {"a": a, "b": b, "c": c}) for x in basis_change])
            P = P.transpose()  # by convention
        except Exception:
            raise ValueError("Failed to parse transformation string.")

Fixed code:
from sympy import Matrix
from sympy.parsing.sympy_parser import parse_expr


            # basic input sanitation
            allowed_chars = "0123456789+-*/.abc()"
            basis_change = ["".join([c for c in string if c in allowed_chars]) for string in basis_change]

            # requires round-trip to sympy to evaluate
            # (alternatively, `numexpr` looks like a nice solution but requires an additional dependency)
            basis_change = [
                parse_expr(string).subs({"a": Matrix(a), "b": Matrix(b), "c": Matrix(c)}) for string in basis_change
            ]
            # convert back to numpy, perform transpose by convention
            P = np.array(basis_change, dtype=float).T[0]

        except Exception as exc:
            raise ValueError(f"Failed to parse transformation string: {exc}")
CVE-2022-29368 (C, published 2022-05-12T19:15Z)
Description: value: Moddable commit before 135aa9a4a6a9b49b60aa730ebc3bcc6247d75c45 was discovered to contain an out-of-bounds read via the function fxUint8Getter at /moddable/xs/sources/xsDataView.c.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/Moddable-OpenSource/moddable
Files changed:
xs/sources/xsDataView.c
Commit message: XS: #896


Vulnerable code:
		if (info->value.bufferInfo.length < (offset + size))
			if (info->value.bufferInfo.length < (offset + size))
				size <<= shift;
				if (info->value.bufferInfo.length < (offset + size))
					mxRangeError("out of range byteLength %ld", size);

Fixed code:
		txInteger end = offset + size;
		if ((info->value.bufferInfo.length < end) || (end < offset))
			txInteger end = offset + size;
			if ((info->value.bufferInfo.length < end) || (end < offset))
				txInteger delta = size << shift;
				txInteger end = offset + delta;
				if ((info->value.bufferInfo.length < end) || (end < offset))
					mxRangeError("out of range length %ld", size);
				size = delta;
CVE-2015-5195 (C, published 2017-07-21T14:29Z)
Description: value: ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/ntp-project/ntp
Files changed:
ChangeLog
m4/ntp_openssl.m4
ntpd/ntp_config.c
ntpd/ntp_util.c
Commit message: [Bug 1773] openssl not detected during ./configure.
[Bug 1774] Segfaults if cryptostats enabled and built without OpenSSL.


Vulnerable code:
	pkgans=`$PKG_CONFIG --libs-only-L openssl | sed -e 's/^-L//'`
	case "$pkgans" in
	 '')
	    # Look in:
	    ans="/usr/lib /usr/lib/openssl /usr/sfw/lib"
	    ans="$ans /usr/local/lib /usr/local/ssl/lib /lib"
	    ;;
	 *)
	    ans="$pkgans"
	    ;;
	esac
	pkgans=`$PKG_CONFIG --cflags-only-I openssl | sed -e 's/^-I//'`
	case "$pkgans" in
	 '')
	    # Look in:
	    ans="/usr/include /usr/sfw/include /usr/local/include"
	    ans="$ans /usr/local/ssl/include"
	    ;;
	 *)
	    ans="$pkgans"
	    ;;
	esac
#ifdef DEBUG_TIMING
static FILEGEN timingstats;
#endif
#ifdef AUTOKEY
static FILEGEN cryptostats;
#endif	/* AUTOKEY */
#ifdef AUTOKEY
#endif	/* AUTOKEY */
#ifdef DEBUG_TIMING
#endif	/* DEBUG_TIMING */

Fixed code:
* [Bug 1773] openssl not detected during ./configure.
* [Bug 1774] Segfaults if cryptostats enabled and built without OpenSSL.
	pkgans="`$PKG_CONFIG --libs-only-L openssl | sed -e 's/^-L//'`" 2>/dev/null
	test -f "${pkgans}/pkgconfig/openssl.pc" && ans="$pkgans"
case "$ans" in
 yes)
    # Look in:
    ans="/usr/lib /usr/lib/openssl /usr/sfw/lib"
    ans="$ans /usr/local/lib /usr/local/ssl/lib /lib"
esac
	pkgans="`$PKG_CONFIG --cflags-only-I openssl | sed -e 's/^-I//'`" 2>/dev/null
	test -f "${pkgans}/pkgconfig/openssl.pc" && ans="$pkgans"
case "$ans" in
 yes)
    # Look in:
    ans="/usr/include /usr/sfw/include /usr/local/include"
    ans="$ans /usr/local/ssl/include"
esac
		if (NULL == filegen) {
			msyslog(LOG_ERR,
				"stats %s unrecognized",
				filegen_string);
			continue;
		}
		if (NULL == filegen) {
			msyslog(LOG_ERR,
				"filegen category '%s' unrecognized",
				filegen_file);
			continue;
		}
static FILEGEN cryptostats;
static FILEGEN timingstats;
CVE-2015-5219 (Other, published 2017-07-21T14:29Z)
Description: value: The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-704 \u2014 Incorrect Type Conversion or Cast
The product does not correctly convert an object, resource, or structure from one type to a different type.
Repository: https://github.com/ntp-project/ntp
Files changed:
ChangeLog
include/ntp.h
Commit message: [Bug 2382] Implement LOGTOD using ldexp() instead of shifting


Vulnerable code:
#define LOGTOD(a)	((a) < 0 ? 1. / (1L << -(a)) : \
			    1L << (int)(a)) /* log2 to double */
#define ULOGTOD(a)	(1L << (int)(a)) /* ulog2 to double */

Fixed code:
* [Bug 2382] Implement LOGTOD using ldexp() instead of shifting.
#define LOGTOD(a)	ldexp(1., (int)(a)) /* log2 to double */
#define ULOGTOD(a)	ldexp(1., (int)(a)) /* ulog2 to double */
CVE-2017-5953 (C, published 2017-02-10T07:59Z)
Description: value: vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/vim/vim
Files changed:
src/spellfile.c
src/version.c
Commit message: patch 8.0.0322: possible overflow with corrupted spell file

Problem:    Possible overflow with spell file where the tree length is
            corrupted.
Solution:   Check for an invalid length (suggested by shqking)


Vulnerable code:

Fixed code:
    if (len >= 0x3ffffff)
	/* Invalid length, multiply with sizeof(int) would overflow. */
	return SP_FORMERROR;
/**/
    322,