hitoshura25/cvefixes huggingface dataset:
CVE-2022-4065 (Unknown, published 2022-11-19T19:15Z)
Description: value: A vulnerability was found in cbeust testng 7.5.0/7.6.0/7.6.1/7.7.0. It has been declared as critical. Affected by this vulnerability is the function testngXmlExistsInJar of the file testng-core/src/main/java/org/testng/JarFileUtils.java of the component XML File Parser. The manipulation leads to path traversal. The attack can be launched remotely. Upgrading to version 7.5.1 and 7.7.1 is able to address this issue. The patch is named 9150736cd2c123a6a3b60e6193630859f9f0422b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-214027.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/cbeust/testng
Files changed:
Commit message: Merge pull request #2806 from BulkSecurityGeneratorProjectV2/fix/JLL/zip-slip-vulnerability

[SECURITY] Fix Zip Slip Vulnerability


Vulnerable code:

Fixed code:
CVE-2021-27097 (C, published 2021-02-17T23:15Z)
Description: value: The boot loader in Das U-Boot before 2021.04-rc2 mishandles a modified FIT.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/u-boot/u-boot
Files changed:
common/Kconfig.boot
common/image-fit.c
Commit message: image: Add an option to do a full check of the FIT

Some strange modifications of the FIT can introduce security risks. Add an
option to check it thoroughly, using libfdt's fdt_check_full() function.

Enable this by default if signature verification is enabled.

CVE-2021-27097

Signed-off-by: Simon Glass <sjg@chromium.org>
Reported-by: Bruce Monroe <bruce.monroe@intel.com>
Reported-by: Arie Haenel <arie.haenel@intel.com>
Reported-by: Julien Lenoir <julien.lenoir@intel.com>


Vulnerable code:

Fixed code:
config FIT_FULL_CHECK
	bool "Do a full check of the FIT before using it"
	default y
	help
	  Enable this do a full check of the FIT to make sure it is valid. This
	  helps to protect against carefully crafted FITs which take advantage
	  of bugs or omissions in the code. This includes a bad structure,
	  multiple root nodes and the like.

	select FIT_FULL_CHECK
config SPL_FIT_FULL_CHECK
	bool "Do a full check of the FIT before using it"
	help
	  Enable this do a full check of the FIT to make sure it is valid. This
	  helps to protect against carefully crafted FITs which take advantage
	  of bugs or omissions in the code. This includes a bad structure,
	  multiple root nodes and the like.


	select SPL_FIT_FULL_CHECK
	if (CONFIG_IS_ENABLED(FIT_FULL_CHECK)) {
		/*
		 * If we are not given the size, make do wtih calculating it.
		 * This is not as secure, so we should consider a flag to
		 * control this.
		 */
		if (size == IMAGE_SIZE_INVAL)
			size = fdt_totalsize(fit);
		ret = fdt_check_full(fit, size);

		if (ret) {
			log_debug("FIT check error %d\n", ret);
			return -EINVAL;
		}
	}
CVE-2021-27097 (Unknown, published 2021-02-17T23:15Z)
Description: value: The boot loader in Das U-Boot before 2021.04-rc2 mishandles a modified FIT.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/u-boot/u-boot
Files changed:
Commit message: Merge branch '2021-02-15-fix-CVE-2021-27097-CVE-2021-27138'

Fix CVE-2021-27097 and CVE-2021-27138.  For more details see
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27097 and
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27138


Vulnerable code:

Fixed code:
CVE-2021-27097 (C, published 2021-02-17T23:15Z)
Description: value: The boot loader in Das U-Boot before 2021.04-rc2 mishandles a modified FIT.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/u-boot/u-boot
Files changed:
common/fdt_region.c
Commit message: fdt_region: Check for a single root node of the correct name

At present fdt_find_regions() assumes that the FIT is a valid devicetree.
If the FIT has two root nodes this is currently not detected in this
function, nor does libfdt's fdt_check_full() notice. Also it is possible
for the root node to have a name even though it should not.

Add checks for these and return -FDT_ERR_BADSTRUCTURE if a problem is
detected.

CVE-2021-27097

Signed-off-by: Simon Glass <sjg@chromium.org>
Reported-by: Bruce Monroe <bruce.monroe@intel.com>
Reported-by: Arie Haenel <arie.haenel@intel.com>
Reported-by: Julien Lenoir <julien.lenoir@intel.com>


Vulnerable code:

Fixed code:
	bool expect_end = false;
		/* If we see two root nodes, something is wrong */
		if (expect_end && tag != FDT_END)
			return -FDT_ERR_BADLAYOUT;


			/* The root node must have an empty name */
			if (!depth && *name)
				return -FDT_ERR_BADLAYOUT;
			if (depth == -1)
				expect_end = true;
CVE-2021-27138 (C, published 2021-02-17T23:15Z)
Description: value: The boot loader in Das U-Boot before 2021.04-rc2 mishandles use of unit addresses in a FIT.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/u-boot/u-boot
Files changed:
common/image-fit.c
test/py/tests/test_vboot.py
Commit message: image: Check for unit addresses in FITs

Using unit addresses in a FIT is a security risk. Add a check for this
and disallow it.

CVE-2021-27138

Signed-off-by: Simon Glass <sjg@chromium.org>
Reported-by: Bruce Monroe <bruce.monroe@intel.com>
Reported-by: Arie Haenel <arie.haenel@intel.com>
Reported-by: Julien Lenoir <julien.lenoir@intel.com>


Vulnerable code:
			return -EINVAL;
	if (fit_check_format(fit, IMAGE_SIZE_INVAL)) {
		printf("Bad FIT %s image format!\n", prop_name);
		return -ENOEXEC;
            # Make sure that U-Boot checks that the config is in the list of hashed
            # nodes. If it isn't, a security bypass is possible.
                1, 'Node name contains @')
            run_bootm(sha_algo, 'evil kernel@', 'Bad Data Hash', False, efit)

Fixed code:
/**
 * fdt_check_no_at() - Check for nodes whose names contain '@'
 *
 * This checks the parent node and all subnodes recursively
 *
 * @fit: FIT to check
 * @parent: Parent node to check
 * @return 0 if OK, -EADDRNOTAVAIL is a node has a name containing '@'
 */
static int fdt_check_no_at(const void *fit, int parent)
{
	const char *name;
	int node;
	int ret;

	name = fdt_get_name(fit, parent, NULL);
	if (!name || strchr(name, '@'))
		return -EADDRNOTAVAIL;

	fdt_for_each_subnode(node, fit, parent) {
		ret = fdt_check_no_at(fit, node);
		if (ret)
			return ret;
	}

	return 0;
}

		if (ret)
			ret = -EINVAL;

		/*
		 * U-Boot stopped using unit addressed in 2017. Since libfdt
		 * can match nodes ignoring any unit address, signature
		 * verification can see the wrong node if one is inserted with
		 * the same name as a valid node but with a unit address
		 * attached. Protect against this by disallowing unit addresses.
		 */
		if (!ret && CONFIG_IS_ENABLED(FIT_SIGNATURE)) {
			ret = fdt_check_no_at(fit, 0);
			if (ret) {
				log_debug("FIT check error %d\n", ret);
				return ret;
			}
		}
			return ret;
	ret = fit_check_format(fit, IMAGE_SIZE_INVAL);
	if (ret) {
		printf("Bad FIT %s image format! (err=%d)\n", prop_name, ret);
		if (CONFIG_IS_ENABLED(FIT_SIGNATURE) && ret == -EADDRNOTAVAIL)
			printf("Signature checking prevents use of unit addresses (@) in nodes\n");
		return ret;
            # Make sure that U-Boot checks that the config is in the list of
            # hashed nodes. If it isn't, a security bypass is possible.
            msg = 'Signature checking prevents use of unit addresses (@) in nodes'
                1, msg)
            run_bootm(sha_algo, 'evil kernel@', msg, False, efit)
CVE-2021-27138 (Unknown, published 2021-02-17T23:15Z)
Description: value: The boot loader in Das U-Boot before 2021.04-rc2 mishandles use of unit addresses in a FIT.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/u-boot/u-boot
Files changed:
Commit message: Merge branch '2021-02-15-fix-CVE-2021-27097-CVE-2021-27138'

Fix CVE-2021-27097 and CVE-2021-27138.  For more details see
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27097 and
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27138


Vulnerable code:

Fixed code:
CVE-2022-30767 (C, published 2022-05-16T03:15Z)
Description: value: nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has an unbounded memcpy with a failed length check, leading to a buffer overflow. NOTE: this issue exists because of an incorrect fix for CVE-2019-14196.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/u-boot/u-boot
Files changed:
net/nfs.c
Commit message: CVE-2019-14196: nfs: fix unbounded memcpy with a failed length check at nfs_lookup_reply

This patch adds a check to rpc_pkt.u.reply.data at nfs_lookup_reply.

Signed-off-by: Cheng Liu <liucheng32@huawei.com>
Reported-by: Fermín Serna <fermin@semmle.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>


Vulnerable code:

Fixed code:
		if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + NFS_FHSIZE) > len)
			return -NFS_RPC_DROP;
		if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + filefh3_length) > len)
			return -NFS_RPC_DROP;
CVE-2022-34835 (C, published 2022-06-30T00:15Z)
Description: value: In Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer overflow in the "i2c md" command enables the corruption of the return address pointer of the do_i2c_md function.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/u-boot/u-boot
Files changed:
cmd/i2c.c
Commit message: i2c: fix stack buffer overflow vulnerability in i2c md command

When running "i2c md 0 0 80000100", the function do_i2c_md parses the
length into an unsigned int variable named length. The value is then
moved to a signed variable:

    int nbytes = length;
    #define DISP_LINE_LEN 16
    int linebytes = (nbytes > DISP_LINE_LEN) ? DISP_LINE_LEN : nbytes;
    ret = dm_i2c_read(dev, addr, linebuf, linebytes);

On systems where integers are 32 bits wide, 0x80000100 is a negative
value to "nbytes > DISP_LINE_LEN" is false and linebytes gets assigned
0x80000100 instead of 16.

The consequence is that the function which reads from the i2c device
(dm_i2c_read or i2c_read) is called with a 16-byte stack buffer to fill
but with a size parameter which is too large. In some cases, this could
trigger a crash. But with some i2c drivers, such as drivers/i2c/nx_i2c.c
(used with "nexell,s5pxx18-i2c" bus), the size is actually truncated to
a 16-bit integer. This is because function i2c_transfer expects an
unsigned short length. In such a case, an attacker who can control the
response of an i2c device can overwrite the return address of a function
and execute arbitrary code through Return-Oriented Programming.

Fix this issue by using unsigned integers types in do_i2c_md. While at
it, make also alen unsigned, as signed sizes can cause vulnerabilities
when people forgot to check that they can be negative.

Signed-off-by: Nicolas Iooss <nicolas.iooss+uboot@ledger.fr>
Reviewed-by: Heiko Schocher <hs@denx.de>


Vulnerable code:
static uint get_alen(char *arg, int default_len)
	int	j;
	int	alen;
	int alen;
	int alen;
	int alen;
	int	j, nbytes, linebytes;
	int	alen;
	int	count;
	int	alen;
	int	count;
	int alen;

Fixed code:
static uint get_alen(char *arg, uint default_len)
	uint	j;
	uint	alen;
	uint	alen;
	uint	alen;
	uint	alen;
	uint	j, nbytes, linebytes;
	uint	alen;
	uint	count;
	uint	alen;
	uint	count;
	uint	alen;
CVE-2010-10009 (PHP, published 2023-01-18T21:15Z)
Description: value: A vulnerability was found in frioux ptome. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The patch is named 26829bba67858ca0bd4ce49ad50e7ce653914276. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218519.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/frioux/ptome
Files changed:
OpenSiteAdmin/scripts/classes/Field.php
OpenSiteAdmin/scripts/classes/LoginManager.php
Commit message: Security update to thwart SQL injection (previously, magic_quotes_gpc was saving us)

Vulnerable code:
			$ret = $this->value;

Fixed code:
            $ret = SecurityManager::formPrep($this->value);
            $value = SecurityManager::SQLPrep($value);
            $user = htmlspecialchars(addslashes($user));
            $pass = htmlspecialchars(addslashes($pass));
CVE-2023-50917 (PHP, published 2023-12-15T17:15Z)
Description: value: MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/sergejey/majordomo
Files changed:
modules/thumb/thumb.php
Commit message: Update thumb.php


Vulnerable code:
            $stream_options = '-v verbose ' . escapeshellarg($stream_options);
            $stream_options = '-rtsp_transport ' . escapeshellarg($transport) . ' ' . escapeshellarg($stream_options);

Fixed code:
            $stream_options = '-v verbose ' . $stream_options;
            $stream_options = '-rtsp_transport ' . escapeshellarg($transport) . ' ' . $stream_options;
CVE-2019-25090 (Unknown, published 2022-12-27T13:15Z)
Description: value: A vulnerability was found in FreePBX arimanager up to 13.0.5.3 and classified as problematic. Affected by this issue is some unknown functionality of the component Views Handler. The manipulation of the argument dataurl leads to cross site scripting. The attack may be launched remotely. Upgrading to version 13.0.5.4 is able to address this issue. The name of the patch is 199dea7cc7020d3c469a86a39fbd80f5edd3c5ab. It is recommended to upgrade the affected component. VDB-216878 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/FreePBX/arimanager
Files changed:
Commit message: Merge pull request #5 in FREEPBX/arimanager from bugfix/FREEI-890-fix-xss-bootstrap-datatable-issues to release/13.0

* commit 'b48d2605e2214f5137867b6cf4854f9ce56ca669':
  FREEI-890 Fix XSS Bootstrap Datatable Issues


Vulnerable code:

Fixed code:
CVE-2023-45197 (PHP, published 2024-06-21T15:15Z)
Description: value: The file upload plugin in Adminer and AdminerEvo allows an attacker to upload a file with a table name of “..” to the root of the Adminer directory. The attacker can effectively guess the name of the uploaded file and execute it. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.3.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/adminerevo/adminerevo
Files changed:
plugins/file-upload.php
Commit message: Plugin file-upload generate temp filename no extension + prevent file to be located elsewhere then under upload path


Vulnerable code:
			if ($_FILES[$name]["error"] || !preg_match("~(\\.($this->extensions))?\$~", $_FILES[$name]["name"], $regs2)) {
			//! unlink old
			$filename = uniqid() . $regs2[0];
			if (!move_uploaded_file($_FILES[$name]["tmp_name"], "$this->uploadPath$table/$regs[1]-$filename")) {

Fixed code:
			if ($_FILES["fields"]["error"][$field["field"]] || !preg_match("~(\\.($this->extensions))?\$~", $_FILES["fields"]["name"][$field["field"]], $regs2)) {
			// create sub-directory if needed
			if (file_exists(__DIR__ . '/' . $this->uploadPath . '/' . $table) === false) {
				mkdir(__DIR__ . '/' . $this->uploadPath . '/' . $table);
			}
			// generate filename
			$filename = realpath(tempnam(__DIR__ . '/' . $this->uploadPath . '/' . $table, ''));
			
			// prevent the final to be anywhere else then under the upload directory
			if (strpos($filename, realpath(__DIR__ . '/' . $this->uploadPath)) !== 0) {
				return false;
			}
			// move file to its final location
			if (!move_uploaded_file($_FILES["fields"]["tmp_name"][$field["field"]], $filename)) {
CVE-2020-26239 (JavaScript, published 2020-11-23T19:15Z)
Description: value: Scratch Addons is a WebExtension that supports both Chrome and Firefox. Scratch Addons before version 1.3.2 is vulnerable to DOM-based XSS. If the victim visited a specific website, the More Links addon of the Scratch Addons extension used incorrect regular expression which caused the HTML-escaped values to be unescaped, leading to XSS. Scratch Addons version 1.3.2 fixes the bug. The extension will be automatically updated by the browser. More Links addon can be disabled via the option of the extension.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ScratchAddons/ScratchAddons
Files changed:
addons/more-links/userscript.js
Commit message: SECURITY: Fix DOM XSS in More Links addon


Vulnerable code:
            if (/\d+/.test(element.textContent)) element.outerHTML = element.textContent;

Fixed code:
              if (/^#\d+$/.test(element.textContent) && element.previousSibling instanceof Text) {
                  element.previousSibling.textContent += element.textContent;
                  element.remove();
              }
CVE-2014-3576 (Java, published 2015-08-14T18:59Z)
Description: value: The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0 allows remote attackers to cause a denial of service (shutdown) via a shutdown command.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/apache/activemq
Files changed:
activemq-broker/src/main/java/org/apache/activemq/broker/TransportConnection.java
Commit message: Remove unused ConnectionControl handling. 

Vulnerable code:
        String control = command.getCommand();
        if (control != null && control.equals("shutdown")) {
            System.exit(0);
        }

Fixed code:
CVE-2019-10672 (C, published 2019-03-31T17:29Z)
Description: value: treeRead in hdf/btree.c in libmysofa before 0.7 does not properly validate multiplications and additions.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/hoene/libmysofa
Files changed:
src/hdf/btree.c
Commit message: Fixed security issue 1


Vulnerable code:
					if (x < sx) {
						j = x * size + b;
					if (y < sy && x < sx) {
						j = ((x * sy + y) * size) + b;
					if (z < sz && y < sy && x < sx) {
						j = (x * szy + y * sz + z) * size + b;

Fixed code:
					j = x * size + b;
					if (j>=0 && j < elements * size) {
					j = ((x * sy + y) * size) + b;
					if (j>=0 && j < elements * size) {
					j = (x * szy + y * sz + z) * size + b;
					if (j>=0 && j < elements * size) {
CVE-2019-20016 (C, published 2019-12-27T02:15Z)
Description: value: libmysofa before 2019-11-24 does not properly restrict recursive function calls, as demonstrated by reports of stack consumption in readOHDRHeaderMessageDatatype in dataobject.c and directblockRead in fractalhead.c. NOTE: a download of v0.9 after 2019-12-06 should fully remediate this issue.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/hoene/libmysofa
Files changed:
src/hdf/fractalhead.c
src/hdf/reader.h
src/hrtf/reader.c
Commit message: Fixed recursive function calls


Vulnerable code:
	log("%08" PRIX64 " %.4s\n", (uint64_t )ftell(reader->fhd) - 4, buf);

Fixed code:
	if(reader->recursive_counter >= 10)
		return MYSOFA_INVALID_FORMAT;
	else
		reader->recursive_counter++;

	log("%08" PRIX64 " %.4s stack %d\n", (uint64_t )ftell(reader->fhd) - 4, buf, reader->recursive_counter);
	reader->recursive_counter--;

	int recursive_counter;
	reader.recursive_counter = 0;
CVE-2021-3756 (C, published 2021-10-29T16:15Z)
Description: value: libmysofa is vulnerable to Heap-based Buffer Overflow
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/hoene/libmysofa
Files changed:
src/hdf/dataobject.c
Commit message: Fix for issue 163


Vulnerable code:
      if (!data->data) {
        if (data_size > 0x10000000)
          return MYSOFA_INVALID_FORMAT;
        data->data_len = data_size;
        data->data = calloc(1, data_size);
        if (!data->data)
          return MYSOFA_NO_MEMORY; // LCOV_EXCL_LINE

Fixed code:
      if (data->data) {
        free(data->data);
        data->data = NULL;
      if (data_size > 0x10000000)
        return MYSOFA_INVALID_FORMAT;
      data->data_len = data_size;
      data->data = calloc(1, data_size);
      if (!data->data)
        return MYSOFA_NO_MEMORY; // LCOV_EXCL_LINE