hitoshura25/cvefixes huggingface dataset:
CVE-2019-10776 (JavaScript, published 2020-01-07T19:15Z)
Description: value: In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/kellyselden/git-diff-apply
Files changed:
src/index.js
Commit message: spawn git clone

to prevent injecting a command


Vulnerable code:
    await utils.run(`git clone ${remoteUrl} ${_tmpDir}`);

Fixed code:
const { runWithSpawn } = require('./run');
    await runWithSpawn('git', ['clone', remoteUrl, _tmpDir]);
CVE-2016-5851 (Python, published 2016-12-21T22:59Z)
Description: value: python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted document.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/python-openxml/python-docx
Files changed:
docx/opc/oxml.py
docx/oxml/__init__.py
Commit message: oxml: don't resolve XML entities in oxml_parser

Resolving entities in the XML is not required by the Open XML standard
and represents a security vulnerability. Turn off entity resolution in
both the opc (package) parser and the part parser.


Vulnerable code:
oxml_parser = etree.XMLParser(remove_blank_text=True)
oxml_parser = etree.XMLParser(remove_blank_text=True)

Fixed code:
oxml_parser = etree.XMLParser(remove_blank_text=True, resolve_entities=False)
oxml_parser = etree.XMLParser(remove_blank_text=True, resolve_entities=False)
CVE-2013-4118 (C, published 2016-10-03T21:59Z)
Description: value: FreeRDP before 1.1.0-beta1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
libfreerdp/core/rdp.c
libfreerdp/core/security.c
Commit message: security: add a NULL pointer check to fix a server crash.


Vulnerable code:
	security_decrypt(s->p, length, rdp);

Fixed code:
	if (!security_decrypt(s->p, length, rdp))
		return FALSE;
	if (rdp->rc4_decrypt_key == NULL)
		return FALSE;
CVE-2013-4119 (C, published 2016-10-03T21:59Z)
Description: value: FreeRDP before 1.1.0-beta+2013071101 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by disconnecting before authentication has finished.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
libfreerdp/core/nla.c
libfreerdp/core/peer.c
libfreerdp/core/transport.c
winpr/libwinpr/sspi/sspi.c
Commit message: nla: invalidate sec handle after creation

If sec pointer isn't invalidated after creation it is not possible
to check if the upper and lower pointers are valid.

This fixes a segfault in the server part if the client disconnects before
the authentication was finished.


Vulnerable code:
	if (!handle)
	if (!handle)
	char* Name;

Fixed code:
		SecInvalidateHandle(&credssp->context);
				rdp->nego->transport->credssp = NULL;
		transport->credssp = NULL;
		transport->credssp = NULL;
	if (!handle || !SecIsValidHandle(handle))
	if (!handle || !SecIsValidHandle(handle))
	char* Name = NULL;
CVE-2018-8784 (C, published 2018-11-29T18:29Z)
Description: value: FreeRDP prior to version 2.0.0-rc4 contains a Heap-Based Buffer Overflow in function zgfx_decompress_segment() that results in a memory corruption and probably even a remote code execution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
libfreerdp/codec/zgfx.c
Commit message: Fixed CVE-2018-8784

Thanks to Eyal Itkin from Check Point Software Technologies.


Vulnerable code:
	size_t cbSegment = segmentSize - 1;
	if ((Stream_GetRemainingLength(stream) < segmentSize) || (segmentSize < 1))

Fixed code:
	return TRUE;
	size_t cbSegment;
	if (!zgfx || !stream)
		return FALSE;

	cbSegment = segmentSize - 1;

	if ((Stream_GetRemainingLength(stream) < segmentSize) || (segmentSize < 1) ||
	    (segmentSize > UINT32_MAX))

		if (cbSegment > sizeof(zgfx->OutputBuffer))
			return FALSE;

					if (zgfx->OutputCount >= sizeof(zgfx->OutputBuffer))
						return FALSE;

						if (count > sizeof(zgfx->OutputBuffer) - zgfx->OutputCount)
							return FALSE;


						if (count > sizeof(zgfx->OutputBuffer) - zgfx->OutputCount)
							return FALSE;
CVE-2018-8786 (C, published 2018-11-29T18:29Z)
Description: value: FreeRDP prior to version 2.0.0-rc4 contains an Integer Truncation that leads to a Heap-Based Buffer Overflow in function update_read_bitmap_update() and results in a memory corruption and probably even a remote code execution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-681 \u2014 Incorrect Conversion between Numeric Types
When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
libfreerdp/core/update.c
Commit message: Fixed CVE-2018-8786

Thanks to Eyal Itkin from Check Point Software Technologies.


Vulnerable code:
		UINT16 count;
		BITMAP_DATA* newdata;
		count = bitmapUpdate->number * 2;
		newdata = (BITMAP_DATA*) realloc(bitmapUpdate->rectangles,
		                                 sizeof(BITMAP_DATA) * count);

Fixed code:
		UINT32 count = bitmapUpdate->number * 2;
		BITMAP_DATA* newdata = (BITMAP_DATA*) realloc(bitmapUpdate->rectangles,
		                       sizeof(BITMAP_DATA) * count);
CVE-2018-8786 (C, published 2018-11-29T18:29Z)
Description: value: FreeRDP prior to version 2.0.0-rc4 contains an Integer Truncation that leads to a Heap-Based Buffer Overflow in function update_read_bitmap_update() and results in a memory corruption and probably even a remote code execution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
libfreerdp/core/update.c
Commit message: Fixed CVE-2018-8786

Thanks to Eyal Itkin from Check Point Software Technologies.


Vulnerable code:
		UINT16 count;
		BITMAP_DATA* newdata;
		count = bitmapUpdate->number * 2;
		newdata = (BITMAP_DATA*) realloc(bitmapUpdate->rectangles,
		                                 sizeof(BITMAP_DATA) * count);

Fixed code:
		UINT32 count = bitmapUpdate->number * 2;
		BITMAP_DATA* newdata = (BITMAP_DATA*) realloc(bitmapUpdate->rectangles,
		                       sizeof(BITMAP_DATA) * count);
CVE-2018-8787 (C, published 2018-11-29T18:29Z)
Description: value: FreeRDP prior to version 2.0.0-rc4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in function gdi_Bitmap_Decompress() and results in a memory corruption and probably even a remote code execution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
libfreerdp/gdi/graphics.c
Commit message: Fixed CVE-2018-8787

Thanks to Eyal Itkin from Check Point Software Technologies.


Vulnerable code:
	bitmap->length = DstWidth * DstHeight * GetBytesPerPixel(bitmap->format);

Fixed code:
	UINT32 size = DstWidth * DstHeight;

	if ((GetBytesPerPixel(bitmap->format) == 0) ||
	    (DstWidth == 0) || (DstHeight == 0) || (DstWidth > UINT32_MAX / DstHeight) ||
	    (size > (UINT32_MAX / GetBytesPerPixel(bitmap->format))))
		return FALSE;

	size *= GetBytesPerPixel(bitmap->format);
	bitmap->length = size;
CVE-2018-8787 (C, published 2018-11-29T18:29Z)
Description: value: FreeRDP prior to version 2.0.0-rc4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in function gdi_Bitmap_Decompress() and results in a memory corruption and probably even a remote code execution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
libfreerdp/gdi/graphics.c
Commit message: Fixed CVE-2018-8787

Thanks to Eyal Itkin from Check Point Software Technologies.


Vulnerable code:
	bitmap->length = DstWidth * DstHeight * GetBytesPerPixel(bitmap->format);

Fixed code:
	UINT32 size = DstWidth * DstHeight;

	if ((GetBytesPerPixel(bitmap->format) == 0) ||
	    (DstWidth == 0) || (DstHeight == 0) || (DstWidth > UINT32_MAX / DstHeight) ||
	    (size > (UINT32_MAX / GetBytesPerPixel(bitmap->format))))
		return FALSE;

	size *= GetBytesPerPixel(bitmap->format);
	bitmap->length = size;
CVE-2018-8789 (C, published 2018-11-29T18:29Z)
Description: value: FreeRDP prior to version 2.0.0-rc4 contains several Out-Of-Bounds Reads in the NTLM Authentication module that results in a Denial of Service (segfault).
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
winpr/libwinpr/sspi/NTLM/ntlm_message.c
Commit message: Fixed CVE-2018-8789

Thanks to Eyal Itkin from Check Point Software Technologies.


Vulnerable code:
void ntlm_print_negotiate_flags(UINT32 flags)
int ntlm_read_message_header(wStream* s, NTLM_MESSAGE_HEADER* header)
void ntlm_write_message_header(wStream* s, NTLM_MESSAGE_HEADER* header)
void ntlm_populate_message_header(NTLM_MESSAGE_HEADER* header, UINT32 MessageType)
int ntlm_read_message_fields(wStream* s, NTLM_MESSAGE_FIELDS* fields)
void ntlm_write_message_fields(wStream* s, NTLM_MESSAGE_FIELDS* fields)
int ntlm_read_message_fields_buffer(wStream* s, NTLM_MESSAGE_FIELDS* fields)
		if ((fields->BufferOffset + fields->Len) > Stream_Length(s))
void ntlm_write_message_fields_buffer(wStream* s, NTLM_MESSAGE_FIELDS* fields)
void ntlm_free_message_fields_buffer(NTLM_MESSAGE_FIELDS* fields)
void ntlm_print_message_fields(NTLM_MESSAGE_FIELDS* fields, const char* name)

Fixed code:
static void ntlm_print_negotiate_flags(UINT32 flags)
static int ntlm_read_message_header(wStream* s, NTLM_MESSAGE_HEADER* header)
static void ntlm_write_message_header(wStream* s, NTLM_MESSAGE_HEADER* header)
static void ntlm_populate_message_header(NTLM_MESSAGE_HEADER* header, UINT32 MessageType)
static int ntlm_read_message_fields(wStream* s, NTLM_MESSAGE_FIELDS* fields)
static void ntlm_write_message_fields(wStream* s, NTLM_MESSAGE_FIELDS* fields)
static int ntlm_read_message_fields_buffer(wStream* s, NTLM_MESSAGE_FIELDS* fields)
		const UINT64 offset = (UINT64)fields->BufferOffset + (UINT64)fields->Len;

		if (offset > Stream_Length(s))
static void ntlm_write_message_fields_buffer(wStream* s, NTLM_MESSAGE_FIELDS* fields)
static void ntlm_free_message_fields_buffer(NTLM_MESSAGE_FIELDS* fields)
static void ntlm_print_message_fields(NTLM_MESSAGE_FIELDS* fields, const char* name)
CVE-2019-17177 (C, published 2019-10-04T17:15Z)
Description: value: libfreerdp/codec/region.c in FreeRDP through 1.1.x and 2.x through 2.0.0-rc4 has memory leaks because a supplied realloc pointer (i.e., the first argument to realloc) is also used for a realloc return value.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
client/X11/generate_argument_docbook.c
libfreerdp/codec/region.c
winpr/libwinpr/utils/lodepng/lodepng.c
Commit message: Fixed #5645: realloc return handling


Vulnerable code:
		tmp = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				tmp = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				tmp = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				tmp = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				tmp = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				tmp = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
		int allocSize = sizeof(REGION16_DATA) + (finalNbRects * sizeof(RECTANGLE_16));
		region->data = realloc(region->data, allocSize);
	dst->data = realloc(newItems, newItems->size);
  tree->lengths = (unsigned*)realloc(tree->lengths, numcodes * sizeof(unsigned));

Fixed code:
	LPSTR tmp2 = NULL;
	{
		tmp2 = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
		if (!tmp2)
			free(tmp);
		tmp = tmp2;
	}
				tmp2 = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				if (!tmp2)
					free(tmp);
				tmp = tmp2;
				tmp2 = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				if (!tmp2)
					free(tmp);
				tmp = tmp2;
				tmp2 = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				if (!tmp2)
					free(tmp);
				tmp = tmp2;
				tmp2 = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				if (!tmp2)
					free(tmp);
				tmp = tmp2;
				tmp2 = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				if (!tmp2)
					free(tmp);
				tmp = tmp2;
		REGION16_DATA* data;
		size_t allocSize = sizeof(REGION16_DATA) + (finalNbRects * sizeof(RECTANGLE_16));
		data = realloc(region->data, allocSize);
		if (!data)
			free(region->data);
		region->data = data;
	REGION16_DATA* data;
	REGION16_DATA* tmpItems = NULL;
	tmpItems = realloc(newItems, newItems->size);
	if (!tmpItems)
		free(newItems);
	newItems = tmpItems;
	dst->data = newItems;
	REGION16_DATA* data;
	unsigned* lengths;
  lengths = (unsigned*)realloc(tree->lengths, numcodes * sizeof(unsigned));
	if (!lengths)
		free(tree->lengths);
	tree->lengths = lengths;
CVE-2019-17178 (C, published 2019-10-04T17:15Z)
Description: value: HuffmanTree_makeFromFrequencies in lodepng.c in LodePNG through 2019-09-28, as used in WinPR in FreeRDP and other products, has a memory leak because a supplied realloc pointer (i.e., the first argument to realloc) is also used for a realloc return value.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-252 \u2014 Unchecked Return Value
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
client/X11/generate_argument_docbook.c
libfreerdp/codec/region.c
winpr/libwinpr/utils/lodepng/lodepng.c
Commit message: Fixed #5645: realloc return handling


Vulnerable code:
		tmp = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				tmp = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				tmp = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				tmp = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				tmp = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				tmp = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
		int allocSize = sizeof(REGION16_DATA) + (finalNbRects * sizeof(RECTANGLE_16));
		region->data = realloc(region->data, allocSize);
	dst->data = realloc(newItems, newItems->size);
  tree->lengths = (unsigned*)realloc(tree->lengths, numcodes * sizeof(unsigned));

Fixed code:
	LPSTR tmp2 = NULL;
	{
		tmp2 = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
		if (!tmp2)
			free(tmp);
		tmp = tmp2;
	}
				tmp2 = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				if (!tmp2)
					free(tmp);
				tmp = tmp2;
				tmp2 = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				if (!tmp2)
					free(tmp);
				tmp = tmp2;
				tmp2 = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				if (!tmp2)
					free(tmp);
				tmp = tmp2;
				tmp2 = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				if (!tmp2)
					free(tmp);
				tmp = tmp2;
				tmp2 = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				if (!tmp2)
					free(tmp);
				tmp = tmp2;
		REGION16_DATA* data;
		size_t allocSize = sizeof(REGION16_DATA) + (finalNbRects * sizeof(RECTANGLE_16));
		data = realloc(region->data, allocSize);
		if (!data)
			free(region->data);
		region->data = data;
	REGION16_DATA* data;
	REGION16_DATA* tmpItems = NULL;
	tmpItems = realloc(newItems, newItems->size);
	if (!tmpItems)
		free(newItems);
	newItems = tmpItems;
	dst->data = newItems;
	REGION16_DATA* data;
	unsigned* lengths;
  lengths = (unsigned*)realloc(tree->lengths, numcodes * sizeof(unsigned));
	if (!lengths)
		free(tree->lengths);
	tree->lengths = lengths;
CVE-2019-17178 (C, published 2019-10-04T17:15Z)
Description: value: HuffmanTree_makeFromFrequencies in lodepng.c in LodePNG through 2019-09-28, as used in WinPR in FreeRDP and other products, has a memory leak because a supplied realloc pointer (i.e., the first argument to realloc) is also used for a realloc return value.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
client/X11/generate_argument_docbook.c
libfreerdp/codec/region.c
winpr/libwinpr/utils/lodepng/lodepng.c
Commit message: Fixed #5645: realloc return handling


Vulnerable code:
		tmp = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				tmp = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				tmp = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				tmp = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				tmp = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				tmp = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
		int allocSize = sizeof(REGION16_DATA) + (finalNbRects * sizeof(RECTANGLE_16));
		region->data = realloc(region->data, allocSize);
	dst->data = realloc(newItems, newItems->size);
  tree->lengths = (unsigned*)realloc(tree->lengths, numcodes * sizeof(unsigned));

Fixed code:
	LPSTR tmp2 = NULL;
	{
		tmp2 = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
		if (!tmp2)
			free(tmp);
		tmp = tmp2;
	}
				tmp2 = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				if (!tmp2)
					free(tmp);
				tmp = tmp2;
				tmp2 = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				if (!tmp2)
					free(tmp);
				tmp = tmp2;
				tmp2 = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				if (!tmp2)
					free(tmp);
				tmp = tmp2;
				tmp2 = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				if (!tmp2)
					free(tmp);
				tmp = tmp2;
				tmp2 = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
				if (!tmp2)
					free(tmp);
				tmp = tmp2;
		REGION16_DATA* data;
		size_t allocSize = sizeof(REGION16_DATA) + (finalNbRects * sizeof(RECTANGLE_16));
		data = realloc(region->data, allocSize);
		if (!data)
			free(region->data);
		region->data = data;
	REGION16_DATA* data;
	REGION16_DATA* tmpItems = NULL;
	tmpItems = realloc(newItems, newItems->size);
	if (!tmpItems)
		free(newItems);
	newItems = tmpItems;
	dst->data = newItems;
	REGION16_DATA* data;
	unsigned* lengths;
  lengths = (unsigned*)realloc(tree->lengths, numcodes * sizeof(unsigned));
	if (!lengths)
		free(tree->lengths);
	tree->lengths = lengths;
CVE-2020-11042 (C, published 2020-05-07T19:15Z)
Description: value: In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate buffer. This can be used to crash the client or store information for later retrieval. This has been patched in 2.0.0.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
libfreerdp/core/window.c
Commit message: Fix #6010: Check length in read_icon_info


Vulnerable code:
	if (Stream_GetRemainingLength(s) < iconInfo->cbBitsMask + iconInfo->cbBitsColor)
		return FALSE;


Fixed code:
	if (Stream_GetRemainingLength(s) < iconInfo->cbBitsMask)
		return FALSE;
	{
		if (Stream_GetRemainingLength(s) < iconInfo->cbColorTable)
			return FALSE;
	}
	if (Stream_GetRemainingLength(s) < iconInfo->cbBitsColor)
		return FALSE;
CVE-2020-11044 (C, published 2020-05-07T19:15Z)
Description: value: In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipulated server is parsed. This has been patched in 2.0.0.
Severity: LOW (CVSS v3 base score: 2.2)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
libfreerdp/core/orders.c
Commit message: Fixed #6013: Check new length is > 0


Vulnerable code:
	if (Stream_GetRemainingLength(s) < new_len)

Fixed code:
	if ((new_len == 0) || (Stream_GetRemainingLength(s) < new_len))
CVE-2020-11045 (C, published 2020-05-07T19:15Z)
Description: value: In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that allows client memory to be read to an image buffer. The result displayed on screen as colour.
Severity: MEDIUM (CVSS v3 base score: 3.3)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
libfreerdp/core/update.c
Commit message: Fixed #6005: Bounds checks in update_read_bitmap_data


Vulnerable code:

Fixed code:
			if (Stream_GetRemainingLength(s) < 8)
				return FALSE;
CVE-2020-11046 (C, published 2020-05-07T19:15Z)
Description: value: In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize that could lead to a later out-of-bounds read.
Severity: LOW (CVSS v3 base score: 2.2)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
libfreerdp/core/update.c
Commit message: Fixed #6006: bounds checks in update_read_synchronize


Vulnerable code:
static void update_read_synchronize(rdpUpdate* update, wStream* s)
	Stream_Seek_UINT16(s); /* pad2Octets (2 bytes) */
	                       /**
	                        * The Synchronize Update is an artifact from the
	                        * T.128 protocol and should be ignored.
	                        */
			update_read_synchronize(update, s);

Fixed code:
static BOOL update_read_synchronize(rdpUpdate* update, wStream* s)
	return Stream_SafeSeek(s, 2); /* pad2Octets (2 bytes) */
	                              /**
	                               * The Synchronize Update is an artifact from the
	                               * T.128 protocol and should be ignored.
	                               */
			if (!update_read_synchronize(update, s))
				goto fail;