hitoshura25/cvefixes huggingface dataset:
CVE-2017-9520 (C, published 2017-06-08T14:29Z)
Description: value: The r_config_set function in libr/config/config.c in radare2 1.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted DEX file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/radare/radare2
Files changed:
libr/config/config.c
libr/core/cbin.c
Commit message: Fix #7698 - UAF in r_config_set when loading a dex


Vulnerable code:
				free (node->value);
		const char * arch = info->arch;
		if (info->cpu && *info->cpu) {
			r_config_set (r->config, "anal.cpu", info->cpu);

Fixed code:
				char *tmp = node->value;
				free (tmp);
		char * arch = strdup(info->arch);
		char * cpu = info->cpu? strdup(info->cpu): NULL;
		if (cpu && *cpu) {
			r_config_set (r->config, "anal.cpu", cpu);
		free (cpu);
		free (arch);
CVE-2017-9761 (C, published 2017-06-19T16:29Z)
Description: value: The find_eoq function in libr/core/cmd.c in radare2 1.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/radare/radare2
Files changed:
libr/core/cmd.c
libr/core/cmd_info.c
Commit message: Fix #7727 - undefined pointers and out of band string access fixes


Vulnerable code:
				p = find_eoq (cmd + 1);
		case 'l': RBININFO ("libs", R_CORE_BIN_ACC_LIBS, NULL, obj? r_list_length (obj->libs): 0); break;
		case 'i': RBININFO ("imports",R_CORE_BIN_ACC_IMPORTS, NULL, obj? r_list_length (obj->imports): 0); break;

Fixed code:
				p = cmd[0] ? find_eoq (cmd + 1) : NULL;
		case 'l': 
			  {
				  RBinObject *obj = r_bin_cur_object (core->bin);
				  RBININFO ("libs", R_CORE_BIN_ACC_LIBS, NULL, obj? r_list_length (obj->libs): 0); 
			  }
			  break;
		case 'i': {
				  RBinObject *obj = r_bin_cur_object (core->bin);
				  RBININFO ("imports", R_CORE_BIN_ACC_IMPORTS, NULL,
						  obj? r_list_length (obj->imports): 0);
			  }
			  break;
CVE-2017-9949 (C, published 2017-06-26T20:29Z)
Description: value: The grub_memmove function in shlr/grub/kern/misc.c in radare2 1.5.0 allows remote attackers to cause a denial of service (stack-based buffer underflow and application crash) or possibly have unspecified other impact via a crafted binary file, possibly related to a buffer underflow in fs/ext2.c in GNU GRUB 2.02.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radare/radare2
Files changed:
shlr/Makefile
shlr/gdb/src/gdbserver/core.c
shlr/grub/fs/ext2.c
shlr/grub/fs/fshelp.c
sys/rebuild.sh
Commit message: Fix ext2 buffer overflow in r2_sbu_grub_memmove


Vulnerable code:
CS_UPD=20170529
CS_TIP=7982670984222e2d3bb8117da6225e06d119f56f
  if (fileblock < INDIRECT_BLOCKS)
  else if (fileblock < INDIRECT_BLOCKS + blksz / 4)
#ifndef _MSC_VER
	  char filename[dirent.namelen + 1]; 
#else
#endif
	  if (grub_errno)
	  if (! fdiro)
	      if (grub_errno)
		{
	  if (hook (filename, type, fdiro, closure))

Fixed code:
CS_UPD=20170605
CS_TIP=1910fd563539fba8498f07a36a0e74cfbdf42a7f
	return -1;
  if (fileblock < INDIRECT_BLOCKS) {
  } else if (fileblock < INDIRECT_BLOCKS + blksz / 4)
if (!filename) {
break;
}
	  if (grub_errno) {
            free (filename);
	  }
	  if (! fdiro) {
            free (filename);
          }
	      if (grub_errno) {
                  free (filename);
	  if (hook (filename, type, fdiro, closure)) {
            free (filename);
          }
          free (filename);
  if (len < 1 || len == 0xffffffff) {
    return -1;
  }

RebuildFs() {
	Rebuild shlr/grub
	Rebuild libr/fs
}

fs)     RebuildFs; ;;
CVE-2018-11375 (C, published 2018-05-22T19:29Z)
Description: value: The _inst__lds() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radare/radare2
Files changed:
libr/anal/p/anal_avr.c
Commit message: Fix crash in anal.avr


Vulnerable code:

Fixed code:
	if (len < 4) {
		return;
	}
CVE-2018-11376 (C, published 2018-05-22T19:29Z)
Description: value: The r_read_le32() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted ELF file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radare/radare2
Files changed:
libr/bin/p/bin_elf.c
libr/core/cbin.c
Commit message: Fix #9904 - crash in r2_hoobr_r_read_le32 (over 9000 entrypoints) and read_le oobread (#9923)



Vulnerable code:
				for (i = 0; i < sec->size; i += 4) {
				for (i = 0; i < sec->size; i += 8) {

Fixed code:
				for (i = 0; (i + 3) < sec->size; i += 4) {
				for (i = 0; (i + 7) < sec->size; i += 8) {
	if (r_list_length (entries) > 1024) {
		eprintf ("Too many entrypoints (%d)\n", r_list_length (entries));
		return false;
	}
CVE-2018-11377 (C, published 2018-05-22T19:29Z)
Description: value: The avr_op_analyze() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radare/radare2
Files changed:
libr/anal/p/anal_avr.c
Commit message: Fix oobread in avr


Vulnerable code:

Fixed code:
	if (len < 2) {
		return NULL;
	}
CVE-2018-11377 (C, published 2018-05-22T19:29Z)
Description: value: The avr_op_analyze() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radare/radare2
Files changed:
libr/anal/p/anal_avr.c
Commit message: Fix invalid free in RAnal.avr


Vulnerable code:
	RAnalOp next_op;

Fixed code:
	RAnalOp next_op = {0};
CVE-2018-11378 (C, published 2018-05-22T19:29Z)
Description: value: The wasm_dis() function in libr/asm/arch/wasm/wasm.c in or possibly have unspecified other impact via a crafted WASM file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/radare/radare2
Files changed:
libr/asm/arch/wasm/wasm.c
Commit message: Fix #9969 - Stack overflow in wasm disassembler


Vulnerable code:
			for (i = 0; i < count && strlen (op->txt) + 10 < R_ASM_BUFSIZE; i++) {
				int optxtlen = strlen (op->txt);
				snprintf (op->txt + optxtlen, R_ASM_BUFSIZE - optxtlen, "%d ", table[i]);
			snprintf (op->txt + strlen (op->txt), R_ASM_BUFSIZE, "%d", def);
			beach:

Fixed code:
			char *txt = op->txt;
			int txtLen = strlen (op->txt);
			int txtLeft = R_ASM_BUFSIZE - txtLen;
			txt += txtLen;
			for (i = 0; i < count && txtLen + 10 < R_ASM_BUFSIZE; i++) {
				snprintf (txt, txtLeft, "%d ", table[i]);
				txtLen = strlen (txt);
				txt += txtLen;
				txtLeft -= txtLen;
			snprintf (txt, txtLeft - 1, "%d", def);
		beach:
CVE-2018-11379 (C, published 2018-05-22T19:29Z)
Description: value: The get_debug_info() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted PE file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radare/radare2
Files changed:
libr/bin/format/pe/pe.c
Commit message: Fix crash in pe


Vulnerable code:
	memcpy (res, dbg_data, nb10sz);
	res->file_name = (ut8*) strdup ((const char*) dbg_data + nb10sz);
			SCV_NB10_HEADER nb10_hdr;
			strncpy (res->file_name, (const char*)
				nb10_hdr.file_name, sizeof(res->file_name) - 1);

Fixed code:
	// memcpy (res, dbg_data, nb10sz);
	// res->file_name = (ut8*) strdup ((const char*) dbg_data + nb10sz);
			if (dbg_data_len < 20) {
				eprintf ("Truncated NB10 entry, not enough data to parse\n");
				return 0;
			}
			SCV_NB10_HEADER nb10_hdr = {{0}};
			res->file_name[0] = 0;
			if (nb10_hdr.file_name) {
				strncpy (res->file_name, (const char*)
						nb10_hdr.file_name, sizeof (res->file_name) - 1);
			}
CVE-2018-11380 (C, published 2018-05-22T19:29Z)
Description: value: The parse_import_ptr() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted Mach-O file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radare/radare2
Files changed:
libr/bin/format/mach0/mach0.c
Commit message: Fix #9970 - heap oobread in mach0 parser (#10026)



Vulnerable code:
		if (parse_import_stub(bin, &symbols[j], i))
			for (j=0, sym=-1; bin->sects[i].reserved1+j < bin->nindirectsyms; j++)
				if (idx == bin->indirectsyms[bin->sects[i].reserved1 + j]) {

	if (!bin->symtab || !bin->symstr || !bin->sects || !bin->indirectsyms)

Fixed code:
		if (parse_import_stub(bin, &symbols[j], i)) {
		}
			for (j = 0, sym = -1; bin->sects[i].reserved1 + j < bin->nindirectsyms; j++) {
				int indidx = bin->sects[i].reserved1 + j;
				if (indidx < 0 || indidx >= bin->nindirectsyms) {
					break;
				}
				if (idx == bin->indirectsyms[indidx]) {
			}
	if (!bin->symtab || !bin->symstr || !bin->sects || !bin->indirectsyms) {
	}
CVE-2018-11381 (C, published 2018-05-22T19:29Z)
Description: value: The string_scan_range() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radare/radare2
Files changed:
libr/bin/file.c
Commit message: Fix #9902 - Fix oobread in RBin.string_scan_range


Vulnerable code:
	ut8 *buf = calloc (to - from, 1);
	r_buf_read_at (bf->buf, from, buf, to - from);
			if ((to - needle) > 5) {
				bool is_wide32 = needle + rc + 2 < to && !w[0] && !w[1] && !w[2] && w[3] && !w[4];

Fixed code:
	int len = to - from;
	ut8 *buf = calloc (len, 1);
	r_buf_read_at (bf->buf, from, buf, len);
			if ((to - needle) > 5 + rc) {
				bool is_wide32 = (needle + rc + 2 < to) && (!w[0] && !w[1] && !w[2] && w[3] && !w[4]);
CVE-2018-11382 (C, published 2018-05-22T19:29Z)
Description: value: The _inst__sts() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radare/radare2
Files changed:
libr/anal/p/anal_avr.c
Commit message: Fix #10091 - crash in AVR analysis


Vulnerable code:

Fixed code:
	if (len < 4) {
		return;
	}
CVE-2018-11383 (C, published 2018-05-22T19:29Z)
Description: value: The r_strbuf_fini() function in radare2 2.5.0 allows remote attackers to cause a denial of service (invalid free and application crash) via a crafted ELF file because of an uninitialized variable in the CPSE handler in libr/anal/p/anal_avr.c.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-908 \u2014 Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
Repository: https://github.com/radare/radare2
Files changed:
libr/anal/p/anal_avr.c
libr/core/cmd_anal.c
Commit message: Fix #9943 - Invalid free on RAnal.avr


Vulnerable code:
	RAnalOp next_op;
			if (!esil)

Fixed code:
	RAnalOp next_op = {0};
			if (!esil) {
			}
CVE-2018-11384 (C, published 2018-05-22T19:29Z)
Description: value: The sh_op() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted ELF file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radare/radare2
Files changed:
libr/anal/p/anal_sh.c
Commit message: Fix #9903 - oobread in RAnal.sh


Vulnerable code:
	if (!data)

Fixed code:
	if (!data || len < 2) {
	}
CVE-2018-12320 (C, published 2018-06-13T16:29Z)
Description: value: There is a use after free in radare2 2.6.0 in r_anal_bb_free() in libr/anal/bb.c via a crafted Java binary file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/radare/radare2
Files changed:
libr/anal/bb.c
Commit message: Fix #10293 - Use-after-free in r_anal_bb_free()


Vulnerable code:
	R_FREE (bb);

Fixed code:
	if (bb->next) {
		// avoid double free
		bb->next->prev = NULL;
	}
	R_FREE (bb); // double free
CVE-2018-12321 (C, published 2018-06-13T16:29Z)
Description: value: There is a heap out of bounds read in radare2 2.6.0 in java_switch_op() in libr/anal/p/anal_java.c via a crafted Java binary file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radare/radare2
Files changed:
libr/anal/p/anal_java.c
Commit message: Fix #10296 - Heap out of bounds read in java_switch_op()


Vulnerable code:
		if (pos + 8 > len) {
		int min_val = (ut32)(UINT (data, pos + 4)),
			max_val = (ut32)(UINT (data, pos + 8));

Fixed code:
		if (pos + 8 + 8 > len) {
		const int min_val = (ut32)(UINT (data, pos + 4));
		const int max_val = (ut32)(UINT (data, pos + 8));
CVE-2018-12322 (C, published 2018-06-13T16:29Z)
Description: value: There is a heap out of bounds read in radare2 2.6.0 in _6502_op() in libr/anal/p/anal_6502.c via a crafted iNES ROM binary file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radare/radare2
Files changed:
libr/anal/p/anal_6502.c
Commit message: Fix #10294 - crash in r2_hoobr__6502_op


Vulnerable code:
		if (data[1] <= 127)
			op->jump = addr + data[1] + op->size;
		else	op->jump = addr - (256 - data[1]) + op->size;

Fixed code:
		if (len > 1) {
			if (data[1] <= 127) {
				op->jump = addr + data[1] + op->size;
			} else {
				op->jump = addr - (256 - data[1]) + op->size;
			}
		} else {
			op->jump = addr;
		}
CVE-2018-19842 (C, published 2018-12-04T09:29Z)
Description: value: getToken in libr/asm/p/asm_x86_nz.c in radare2 before 3.1.0 allows attackers to cause a denial of service (stack-based buffer over-read) via crafted x86 assembly data, as demonstrated by rasm2.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radare/radare2
Files changed:
libr/asm/p/asm_x86_nz.c
Commit message: Fix #12239 - crash in the x86.nz assembler ##asm (#12252)



Vulnerable code:
	while (begin && isspace ((ut8)str[*begin])) {
	} else if (isalpha ((ut8)str[*begin])) {   // word token
		while (end && isalnum ((ut8)str[*end])) {
	} else if (isdigit ((ut8)str[*begin])) {   // number token

Fixed code:
	if (*begin > strlen (str)) {
		return TT_EOF;
	}
	while (begin && str[*begin] && isspace ((ut8)str[*begin])) {
	}
	if (isalpha ((ut8)str[*begin])) {   // word token
		while (end && str[*end] && isalnum ((ut8)str[*end])) {
	}
	if (isdigit ((ut8)str[*begin])) {   // number token
CVE-2018-19843 (C, published 2018-12-04T09:29Z)
Description: value: opmov in libr/asm/p/asm_x86_nz.c in radare2 before 3.1.0 allows attackers to cause a denial of service (buffer over-read) via crafted x86 assembly data, as demonstrated by rasm2.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radare/radare2
Files changed:
libr/asm/p/asm_x86_nz.c
Commit message: Fix #12242 - Crash in x86.nz assembler (#12266)



Vulnerable code:
			data[l++] = SEG_REG_PREFIXES[op->operands[1].regs[0]];
			data[l++] = op->operands[0].reg << 3 | 0x5;

Fixed code:
			data[l++] = SEG_REG_PREFIXES[op->operands[1].regs[0] % 6];
			data[l++] = (((ut32)op->operands[0].reg) << 3) | 0x5;
CVE-2018-20455 (C, published 2018-12-25T19:29Z)
Description: value: In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asm_x86_nz.c may allow attackers to cause a denial of service (application crash via a stack-based buffer overflow) by crafting an input file, a related issue to CVE-2018-20456.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radare/radare2
Files changed:
libr/asm/p/asm_x86_nz.c
Commit message: Fix #12372 and #12373 - Crash in x86 assembler (#12380)

0 ,0,[bP-bL-bP-bL-bL-r-bL-bP-bL-bL-
mov ,0,[ax+Bx-ax+Bx-ax+ax+Bx-ax+Bx--
leA ,0,[bP-bL-bL-bP-bL-bP-bL-60@bL-
leA ,0,[bP-bL-r-bP-bL-bP-bL-60@bL-
mov ,0,[ax+Bx-ax+Bx-ax+ax+Bx-ax+Bx--

Vulnerable code:
						op->regs[reg_index] = reg;
						op->scale[reg_index] = temp;
						op->regs[reg_index] = X86R_UNDEFINED;


Fixed code:
						if (reg_index < 2) {
							op->regs[reg_index] = reg;
							op->scale[reg_index] = temp;
						}
						if (reg_index < 2) {
							op->regs[reg_index] = X86R_UNDEFINED;
						}
CVE-2018-20456 (C, published 2018-12-25T19:29Z)
Description: value: In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asm_x86_nz.c may allow attackers to cause a denial of service (application crash in libr/util/strbuf.c via a stack-based buffer over-read) by crafting an input file, a related issue to CVE-2018-20455.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radare/radare2
Files changed:
libr/asm/p/asm_x86_nz.c
Commit message: Fix #12372 and #12373 - Crash in x86 assembler (#12380)

0 ,0,[bP-bL-bP-bL-bL-r-bL-bP-bL-bL-
mov ,0,[ax+Bx-ax+Bx-ax+ax+Bx-ax+Bx--
leA ,0,[bP-bL-bL-bP-bL-bP-bL-60@bL-
leA ,0,[bP-bL-r-bP-bL-bP-bL-60@bL-
mov ,0,[ax+Bx-ax+Bx-ax+ax+Bx-ax+Bx--

Vulnerable code:
						op->regs[reg_index] = reg;
						op->scale[reg_index] = temp;
						op->regs[reg_index] = X86R_UNDEFINED;


Fixed code:
						if (reg_index < 2) {
							op->regs[reg_index] = reg;
							op->scale[reg_index] = temp;
						}
						if (reg_index < 2) {
							op->regs[reg_index] = X86R_UNDEFINED;
						}
CVE-2018-20460 (C, published 2018-12-25T19:29Z)
Description: value: In radare2 prior to 3.1.2, the parseOperands function in libr/asm/arch/arm/armass64.c allows attackers to cause a denial-of-service (application crash caused by stack-based buffer overflow) by crafting an input file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radare/radare2
Files changed:
libr/asm/arch/arm/armass64.c
Commit message: Fix #12376 - crash in: rasm2 -a arm -b 64 '0 ,0,0,0,0,0,0,'


Vulnerable code:

Fixed code:
		if (operand >= MAX_OPERANDS) {
			eprintf ("Too many operands\n");
			return false;
		}
CVE-2018-20461 (C, published 2018-12-25T19:29Z)
Description: value: In radare2 prior to 3.1.1, core_anal_bytes in libr/core/cmd_anal.c allows attackers to cause a denial-of-service (application crash caused by out-of-bounds read) by crafting a binary file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radare/radare2
Files changed:
libr/core/cmd_anal.c
Commit message: Fix #12375 - Crash in bd+ao (#12382)



Vulnerable code:
			for (j = 0; j < size; j++) {
				r_cons_printf ("%02x", buf[j + idx]);
			if (op.val != UT64_MAX)
			if (op.ptr != UT64_MAX)
			if (op.refptr != -1)

Fixed code:
			int minsz = R_MIN (len, size);
			minsz = R_MAX (minsz, 0);
			for (j = 0; j < minsz; j++) {
				ut8 ch = ((j + idx - 1) > minsz)? 0xff: buf[j + idx];
				r_cons_printf ("%02x", ch);
			if (op.val != UT64_MAX) {
			}
			if (op.ptr != UT64_MAX) {
			}
			if (op.refptr != -1) {
			}
CVE-2019-19954 (Unknown, published 2019-12-24T15:15Z)
Description: value: Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating a Trojan horse %SYSTEMDRIVE%\node_modules\.bin\wmic.exe file.
Severity: MEDIUM (CVSS v3 base score: 7.3)
Weakness: CWE-427 \u2014 Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
Repository: https://github.com/signalapp/Signal-Desktop
Files changed:
Commit message: os-locale: Include 'preferLocal: false' option when using execa

Thanks to Rich Mirch for pointing this out.


Vulnerable code:

Fixed code: