hitoshura25/cvefixes huggingface dataset:
CVE-2015-1191 (C, published 2015-01-21T18:59Z)
Description: value: Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/madler/pigz
Files changed:
pigz.c
Commit message: When decompressing with -N or -NT, strip any path from header name.

This uses the path of the compressed file combined with the name
from the header as the name of the decompressed output file.  Any
path information in the header name is stripped.  This avoids a
possible vulnerability where absolute or descending paths are put
in the gzip header.


Vulnerable code:
        char *to, *repl;

        /* use header name for output when decompressing with -N */
        to = g.inf;
        if (g.decode && (g.headis & 1) != 0 && g.hname != NULL) {
            to = g.hname;
            len = strlen(g.hname);

        /* replace .tgz with .tar when decoding */
        repl = g.decode && strcmp(to + len, ".tgz") ? "" : ".tar";
        g.outf = MALLOC(len + (g.decode ? strlen(repl) : strlen(g.sufx)) + 1);
        memcpy(g.outf, to, len);
        strcpy(g.outf + len, g.decode ? repl : g.sufx);
                             (g.force ? 0 : O_EXCL), 0600);

Fixed code:
        char *to = g.inf, *sufx = "";
        size_t pre = 0;

        /* select parts of the output file name */
        if (g.decode) {
            /* for -dN or -dNT, use the path from the input file and the name
               from the header, stripping any path in the header name */
            if ((g.headis & 1) != 0 && g.hname != NULL) {
                pre = justname(g.inf) - g.inf;
                to = justname(g.hname);
                len = strlen(to);
            }
            /* for -d or -dNn, replace abbreviated suffixes */
            else if (strcmp(to + len, ".tgz") == 0)
                sufx = ".tar";
        else
            /* add appropriate suffix when compressing */
            sufx = g.sufx;
        g.outf = MALLOC(pre + len + strlen(sufx) + 1);
        memcpy(g.outf, g.inf, pre);
        memcpy(g.outf + pre, to, len);
        strcpy(g.outf + pre + len, sufx);
                              (g.force ? 0 : O_EXCL), 0600);
CVE-2014-125054 (Ruby, published 2023-01-07T09:15Z)
Description: value: A vulnerability classified as critical was found in koroket RedditOnRails. This vulnerability affects unknown code of the component Vote Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The patch is identified as 7f3c7407d95d532fcc342b00d68d0ea09ca71030. It is recommended to apply a patch to fix this issue. VDB-217594 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/koroket/RedditOnRails
Files changed:
app/controllers/comments_controller.rb
app/controllers/posts_controller.rb
Commit message: Solved duplicate votes issue; Discovered karma exploitation
Exploit - Currently even if you already upvoted you can click the upvote button again, which doesn't add a new vote to the post/comment but *does* add more to the user's karma since there's no check for existing vote value to only add karma for actual changes to votes


Vulnerable code:
      @vote = current_user.votes.find_by(comment_id: params[:id])
      @vote = current_user.votes.find_by(post_id: params[:id])

Fixed code:
      @vote = current_user.votes.find_by(votable_id: params[:id])
      # @vote = current_user.votes.find_by(post_id: params[:id])
      @vote = current_user.votes.find_by(votable_id: params[:id])
CVE-2020-36762 (YAML, published 2023-07-18T15:15Z)
Description: value: A vulnerability was found in ONS Digital RAS Collection Instrument up to 2.0.27 and classified as critical. Affected by this issue is the function jobs of the file .github/workflows/comment.yml. The manipulation of the argument $COMMENT_BODY leads to os command injection. Upgrading to version 2.0.28 is able to address this issue. The name of the patch is dcaad2540f7d50c512ff2e031d3778dd9337db2b. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-234248.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/ONSdigital/ras-collection-instrument
Files changed:
.github/workflows/comment.yml
_infra/helm/collection-instrument/Chart.yaml
Commit message: Fix bash injection vulnerability (#199)

* Fix bash injection vulnerability

* [ci skip] auto patch increment
skip-checks: true

Co-authored-by: ras-rm-bot <65395820+ras-rm-bot@users.noreply.github.com>

Vulnerable code:
          echo NAMESPACE=$(echo ${{ github.event.comment.body }} | cut -d' ' -f2) >> $GITHUB_ENV
appVersion: 2.0.27

Fixed code:
        env:
          COMMENT_BODY: ${{ github.event.comment.body }}
          echo NAMESPACE=$(echo $COMMENT_BODY | cut -d' ' -f2) >> $GITHUB_ENV
appVersion: 2.0.28
CVE-2011-4341 (PHP, published 2012-02-12T22:55Z)
Description: value: Multiple SQL injection vulnerabilities in symphony/content/content.publish.php in Symphony CMS 2.2.3 and possibly other versions before 2.2.4 allow remote authenticated users with Author permissions to execute arbitrary SQL commands via the filter parameter to (1) symphony/publish/comments or (2) symphony/publish/images.  NOTE: this issue can be leveraged to perform cross-site scripting (XSS) attacks via error messages.  NOTE: some of these details are obtained from third party information.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/symphonycms/symphony-2
Files changed:
symphony/content/content.publish.php
symphony/lib/toolkit/class.devkit.php
Commit message: Fix potential security holes reported by Mavituna Security.


Vulnerable code:

					$field_id = Symphony::Database()->fetchVar('id', 0, sprintf(
						"SELECT `f`.`id`
						FROM `tbl_fields` AS `f`, `tbl_sections` AS `s`
						WHERE `s`.`id` = `f`.`parent_section`
						AND f.`element_name` = '%s'
						LIMIT 1",
						$handle,


Fixed code:
					$field_id = Symphony::Database()->fetchVar('id', 0, sprintf("
						SELECT `f`.`id`
						FROM `tbl_fields` AS `f`
						LEFT JOIN `tbl_sections` AS `s` ON (`s`.`id` = `f`.`parent_section`)
						WHERE f.`element_name` = '%s'
						LIMIT 1
					",
						Symphony::Database()->cleanValue($handle),
			$this->_view = General::sanitize($this->_view);
CVE-2013-2559 (PHP, published 2014-03-27T16:55Z)
Description: value: SQL injection vulnerability in Symphony CMS before 2.3.2 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter to system/authors/.  NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/symphonycms/symphony-2
Files changed:
symphony/lib/toolkit/class.authormanager.php
Commit message: Fix potential autheticated SQL injection attack on the Authors page


Vulnerable code:
				'a.'.$sortby, $sortdirection,

Fixed code:
			$sortby = is_null($sortby) ? 'id' : Symphony::Database()->cleanValue($sortby);
			$sortdirection = $sortdirection === 'ASC' ? 'ASC' : 'DESC';
				'a.'. $sortby, $sortdirection,
CVE-2015-8766 (PHP, published 2016-01-08T21:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in content/content.systempreferences.php in Symphony CMS before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via the (1) email_sendmail[from_name], (2) email_sendmail[from_address], (3) email_smtp[from_name], (4) email_smtp[from_address], (5) email_smtp[host], (6) email_smtp[port], (7) jit_image_manipulation[trusted_external_sites], or (8) maintenance_mode[ip_whitelist] parameters to system/preferences.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/symphonycms/symphony-2
Files changed:
symphony/content/content.systempreferences.php
Commit message: Sanitize the POST for the system/preferences/


Vulnerable code:
            $settings = $_POST['settings'];
            Symphony::ExtensionManager()->notifyMembers('Save', '/system/preferences/', array('settings' => &$settings, 'errors' => &$this->_errors));

Fixed code:
            $settings = filter_var_array($_POST['settings'], FILTER_SANITIZE_STRING);
            Symphony::ExtensionManager()->notifyMembers('Save', '/system/preferences/', array(
                'settings' => &$settings,
                'errors' => &$this->_errors
            ));
CVE-2019-12347 (PHP, published 2019-05-29T19:29Z)
Description: value: In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit.php action. The vulnerability occurs due to input validation errors.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pfsense/FreeBSD-ports
Files changed:
security/pfSense-pkg-acme/Makefile
security/pfSense-pkg-acme/files/usr/local/pkg/acme/pkg_acme_tabs.inc
security/pfSense-pkg-acme/files/usr/local/www/acme/acme_accountkeys.php
security/pfSense-pkg-acme/files/usr/local/www/acme/acme_certificates.php
Commit message: ACME 0.5.8

* Fix encoding for cert/key fields in output. Fixes #9554
* Fix tab links for non-admin users. Fixes #9553


Vulnerable code:
PORTVERSION=	0.5.7
PORTREVISION=	1
$acme_tab_array['acme']['settings'] = Array('name' => "General settings", 'url' => "acme_generalsettings.php");
$acme_tab_array['acme']['certificates'] = Array('name' => "Certificates", 'url' => "acme_certificates.php");
$acme_tab_array['acme']['accountkeys'] = Array('name' => "Account keys", 'url' => "acme_accountkeys.php");
			$accountname = $accountkey['name'];
				<?=$accountkey['name'];?>
				<?=$accountkey['desc'];?>
				<?=$accountkey['acmeserver'];?>
				<?=$certificate['desc'];?>
				<?=$certificate['acmeaccount'];?>

Fixed code:
PORTVERSION=	0.5.8
$acme_tab_array['acme']['settings'] = Array('name' => "General settings", 'url' => "/acme/acme_generalsettings.php");
$acme_tab_array['acme']['certificates'] = Array('name' => "Certificates", 'url' => "/acme/acme_certificates.php");
$acme_tab_array['acme']['accountkeys'] = Array('name' => "Account keys", 'url' => "/acme/acme_accountkeys.php");
			$accountname = htmlspecialchars($accountkey['name']);
				<?=$accountname;?>
				<?=htmlspecialchars($accountkey['desc']);?>
				<?=htmlspecialchars($accountkey['acmeserver']);?>
				<?=htmlspecialchars($certificate['desc']);?>
				<?=htmlspecialchars($certificate['acmeaccount']);?>
CVE-2019-12584 (Other, published 2019-06-03T03:29Z)
Description: value: Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsd_status.php.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pfsense/FreeBSD-ports
Files changed:
sysutils/pfSense-pkg-apcupsd/Makefile
sysutils/pfSense-pkg-apcupsd/files/usr/local/www/apcupsd_status.php
Commit message: apcupsd: Validation and Encoding. Fixes #9556


Vulnerable code:
PORTREVISION=	4
	puts("<div class=\"panel panel-success responsive\"><div class=\"panel-heading\"><h2 class=\"panel-title\">Status information from apcupsd</h2></div>");
	puts("<pre>");
	puts("Running: apcaccess -h {$_POST['strapcaccess']} <br />");
	putenv("PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin");
	$ph = popen("apcaccess -h {$_POST['strapcaccess']} 2>&1", "r" );
	while ($line = fgets($ph)) {
		echo htmlspecialchars($line);
	pclose($ph);
	puts("</pre>");
	puts("</div>");

Fixed code:
PORTREVISION=	5
	if (is_hostname($_POST['strapcaccess'])) {
		puts("<div class=\"panel panel-success responsive\"><div class=\"panel-heading\"><h2 class=\"panel-title\">Status information from apcupsd</h2></div>");
		puts("<pre>");
		puts("Running: apcaccess -h " . htmlspecialchars($_POST['strapcaccess']) . " <br />");
		putenv("PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin");
		$ph = popen("apcaccess -h " . escapeshellarg($_POST['strapcaccess']) . " 2>&1", "r" );
		while ($line = fgets($ph)) {
			echo htmlspecialchars($line);
		}
		pclose($ph);
		puts("</pre>");
		puts("</div>");
	} else {
		print_input_errors(array(gettext("Invalid hostname or IP address")));
CVE-2019-12585 (Other, published 2019-06-03T03:29Z)
Description: value: Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsd_status.php.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/pfsense/FreeBSD-ports
Files changed:
sysutils/pfSense-pkg-apcupsd/Makefile
sysutils/pfSense-pkg-apcupsd/files/usr/local/www/apcupsd_status.php
Commit message: apcupsd: Validation and Encoding. Fixes #9556


Vulnerable code:
PORTREVISION=	4
	puts("<div class=\"panel panel-success responsive\"><div class=\"panel-heading\"><h2 class=\"panel-title\">Status information from apcupsd</h2></div>");
	puts("<pre>");
	puts("Running: apcaccess -h {$_POST['strapcaccess']} <br />");
	putenv("PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin");
	$ph = popen("apcaccess -h {$_POST['strapcaccess']} 2>&1", "r" );
	while ($line = fgets($ph)) {
		echo htmlspecialchars($line);
	pclose($ph);
	puts("</pre>");
	puts("</div>");

Fixed code:
PORTREVISION=	5
	if (is_hostname($_POST['strapcaccess'])) {
		puts("<div class=\"panel panel-success responsive\"><div class=\"panel-heading\"><h2 class=\"panel-title\">Status information from apcupsd</h2></div>");
		puts("<pre>");
		puts("Running: apcaccess -h " . htmlspecialchars($_POST['strapcaccess']) . " <br />");
		putenv("PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin");
		$ph = popen("apcaccess -h " . escapeshellarg($_POST['strapcaccess']) . " 2>&1", "r" );
		while ($line = fgets($ph)) {
			echo htmlspecialchars($line);
		}
		pclose($ph);
		puts("</pre>");
		puts("</div>");
	} else {
		print_input_errors(array(gettext("Invalid hostname or IP address")));
CVE-2019-18667 (Other, published 2019-11-02T16:15Z)
Description: value: /usr/local/www/freeradius_view_config.php in the freeradius3 package before 0.15.7_3 for pfSense on FreeBSD allows a user with an XSS payload as password or username to execute arbitrary javascript code on a victim browser.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pfsense/FreeBSD-ports
Files changed:
net/pfSense-pkg-freeradius3/Makefile
net/pfSense-pkg-freeradius3/files/usr/local/www/freeradius_view_config.php
Commit message: Encode FreeRADIUS config file display output. Fixes #9866


Vulnerable code:
PORTREVISION=	2
		print $files[$file] . "\n" . file_get_contents($files[$file]);

Fixed code:
PORTREVISION=	3
		print $files[$file] . "\n" . htmlspecialchars(file_get_contents($files[$file]));
CVE-2019-8953 (Other, published 2019-02-20T16:29Z)
Description: value: The HAProxy package before 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter, related to haproxy_listeners.php and haproxy_listeners_edit.php.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pfsense/FreeBSD-ports
Files changed:
net/pfSense-pkg-haproxy-devel/Makefile
net/pfSense-pkg-haproxy-devel/files/usr/local/www/haproxy/haproxy_listeners.php
net/pfSense-pkg-haproxy/Makefile
net/pfSense-pkg-haproxy/files/usr/local/www/haproxy/haproxy_listeners.php
Commit message: Encoding for haproxy_listeners.php. Fixes #9335

Encode desc and table_actionsaclN before output.


Vulnerable code:
PORTREVISION=	16
					<?=$frontend['desc'];?>
								echo "&nbsp;if({$actionitem['acl']})";
PORTREVISION=	15
					<?=$frontend['desc'];?>
								echo "&nbsp;if({$actionitem['acl']})";

Fixed code:
PORTREVISION=	17
					<?=htmlspecialchars($frontend['desc']);?>
								echo "&nbsp;if(" . htmlspecialchars($actionitem['acl']) . ")";
PORTREVISION=	16
					<?=htmlspecialchars($frontend['desc']);?>
								echo "&nbsp;if(" . htmlspecialchars($actionitem['acl']) . ")";
CVE-2020-21219 (PHP, published 2022-12-15T19:15Z)
Description: value: Cross Site Scripting (XSS) vulnerability in Netgate pf Sense 2.4.4-Release-p3 and Netgate ACME package 0.6.3 allows remote attackers to to run arbitrary code via the RootFolder field to acme_certificate_edit.php page of the ACME package.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pfsense/FreeBSD-ports
Files changed:
security/pfSense-pkg-acme/Makefile
security/pfSense-pkg-acme/files/usr/local/pkg/acme/acme_sh.inc
security/pfSense-pkg-acme/files/usr/local/www/acme/acme_accountkeys.php
security/pfSense-pkg-acme/files/usr/local/www/acme/acme_certificates.php
Commit message: Prevent ACME output from being interpreted as HTML. Fixes #9888


Vulnerable code:
			echo "<br/>\n".$command."<br/>\n";
	<div id="renewoutput" class="pull-left">
	$('#renewoutput').html(data);
	<div id="renewoutput" class="pull-left">
	$('#renewoutput').html(data.replace(/(?:\r\n|\r|\n)/g, '<br />'));

Fixed code:
PORTREVISION=	1
			echo "\n{$command}\n";
	<div id="renewoutput" class="pull-left" style="white-space: pre-wrap">
	$('#renewoutput').text(data);
	<div id="renewoutput" class="pull-left" style="white-space: pre-wrap">
	$('#renewoutput').text(data);
CVE-2020-21487 (PHP, published 2023-04-04T15:15Z)
Description: value: Cross Site Scripting vulnerability found in Netgate pfSense 2.4.4 and ACME package v.0.6.3 allows attackers to execute arbitrary code via the RootFolder field of acme_certificates.php.
Severity: nan (CVSS v3 base score: 9.6)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pfsense/FreeBSD-ports
Files changed:
security/pfSense-pkg-acme/Makefile
security/pfSense-pkg-acme/files/usr/local/pkg/acme/acme_sh.inc
security/pfSense-pkg-acme/files/usr/local/www/acme/acme_accountkeys.php
security/pfSense-pkg-acme/files/usr/local/www/acme/acme_certificates.php
Commit message: Prevent ACME output from being interpreted as HTML. Fixes #9888


Vulnerable code:
			echo "<br/>\n".$command."<br/>\n";
	<div id="renewoutput" class="pull-left">
	$('#renewoutput').html(data);
	<div id="renewoutput" class="pull-left">
	$('#renewoutput').html(data.replace(/(?:\r\n|\r|\n)/g, '<br />'));

Fixed code:
PORTREVISION=	1
			echo "\n{$command}\n";
	<div id="renewoutput" class="pull-left" style="white-space: pre-wrap">
	$('#renewoutput').text(data);
	<div id="renewoutput" class="pull-left" style="white-space: pre-wrap">
	$('#renewoutput').text(data);
CVE-2020-12268 (C, published 2020-04-27T02:15Z)
Description: value: jbig2_image_compose in jbig2_image.c in Artifex jbig2dec before 0.18 has a heap-based buffer overflow.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ArtifexSoftware/jbig2dec
Files changed:
jbig2_image.c
Commit message: Fix OSS-Fuzz issue 20332: buffer overflow in jbig2_image_compose.

With extreme values of x/y/w/h we can get overflow. Test for this
and exit safely.

Thanks for OSS-Fuzz for reporting.


Vulnerable code:

Fixed code:
#if !defined (UINT32_MAX)
#define UINT32_MAX  0xffffffffu
#endif
    if ((UINT32_MAX - src->width  < (x > 0 ? x : -x)) ||
        (UINT32_MAX - src->height < (y > 0 ? y : -y)))
    {
#ifdef JBIG2_DEBUG
        jbig2_error(ctx, JBIG2_SEVERITY_DEBUG, -1, "overflow in compose_image");
#endif
        return 0;
    }