rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because lookup failures are mishandled.
Vulnerability ID: CVE-2018-15859
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/xkbcommon/libxkbcommon
Published: 2018-08-25
File: src/xkbcomp/expr.c
Commit message: Fail expression lookup on invalid atoms

If we fail atom lookup, then we should not claim that we successfully
looked up the expression.

Signed-off-by: Daniel Stone <daniels@collabora.com>
Commit author: Daniel Stone

Vulnerable version (before fix):
 ExprResolveLhs(struct xkb_context *ctx, const ExprDef *expr,         *elem_rtrn = xkb_atom_text(ctx, expr->field_ref.element);         *field_rtrn = xkb_atom_text(ctx, expr->field_ref.field);         *index_rtrn = NULL;         return true;     case EXPR_ARRAY_REF:         *elem_rtrn = xkb_atom_text(ctx, expr->array_ref.element);         *field_rtrn = xkb_atom_text(ctx, expr->array_ref.field);         *index_rtrn = expr->array_ref.entry;         return true;     default:         break;

Fixed version (after fix):
 ExprResolveLhs(struct xkb_context *ctx, const ExprDef *expr,         *elem_rtrn = xkb_atom_text(ctx, expr->field_ref.element);         *field_rtrn = xkb_atom_text(ctx, expr->field_ref.field);         *index_rtrn = NULL;         return (*elem_rtrn != NULL && *field_rtrn != NULL);     case EXPR_ARRAY_REF:         *elem_rtrn = xkb_atom_text(ctx, expr->array_ref.element);         *field_rtrn = xkb_atom_text(ctx, expr->array_ref.field);         *index_rtrn = expr->array_ref.entry; 	if (expr->array_ref.element != XKB_ATOM_NONE && *elem_rtrn == NULL) 		return false; 	if (*field_rtrn == NULL) 		return false;         return true;     default:         break;

Patch:
patch: @@ -47,11 +47,15 @@ ExprResolveLhs(struct xkb_context *ctx, const ExprDef *expr,
         *elem_rtrn = xkb_atom_text(ctx, expr->field_ref.element);
         *field_rtrn = xkb_atom_text(ctx, expr->field_ref.field);
         *index_rtrn = NULL;
-        return true;
+        return (*elem_rtrn != NULL && *field_rtrn != NULL);
     case EXPR_ARRAY_REF:
         *elem_rtrn = xkb_atom_text(ctx, expr->array_ref.element);
         *field_rtrn = xkb_atom_text(ctx, expr->array_ref.field);
         *index_rtrn = expr->array_ref.entry;
+	if (expr->array_ref.element != XKB_ATOM_NONE && *elem_rtrn == NULL)
+		return false;
+	if (*field_rtrn == NULL)
+		return false;
         return true;
     default:
         break;
path: src/xkbcomp/expr.c
Vulnerability: Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file that triggers an xkb_intern_atom failure.
Vulnerability ID: CVE-2018-15861
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/xkbcommon/libxkbcommon
Published: 2018-08-25
File: src/xkbcomp/expr.c
Commit message: xkbcomp: Don't falsely promise from ExprResolveLhs

Every user of ExprReturnLhs goes on to unconditionally dereference the
field return, which can be NULL if xkb_intern_atom fails. Return false
if this is the case, so we fail safely.

testcase: splice geometry data into interp

Signed-off-by: Daniel Stone <daniels@collabora.com>
Commit author: Daniel Stone

Vulnerable version (before fix):
 ExprResolveLhs(struct xkb_context *ctx, const ExprDef *expr,         *elem_rtrn = NULL;         *field_rtrn = xkb_atom_text(ctx, expr->ident.ident);         *index_rtrn = NULL;         return true;     case EXPR_FIELD_REF:         *elem_rtrn = xkb_atom_text(ctx, expr->field_ref.element);         *field_rtrn = xkb_atom_text(ctx, expr->field_ref.field);

Fixed version (after fix):
 ExprResolveLhs(struct xkb_context *ctx, const ExprDef *expr,         *elem_rtrn = NULL;         *field_rtrn = xkb_atom_text(ctx, expr->ident.ident);         *index_rtrn = NULL;         return (*field_rtrn != NULL);     case EXPR_FIELD_REF:         *elem_rtrn = xkb_atom_text(ctx, expr->field_ref.element);         *field_rtrn = xkb_atom_text(ctx, expr->field_ref.field);

Patch:
patch: @@ -42,7 +42,7 @@ ExprResolveLhs(struct xkb_context *ctx, const ExprDef *expr,
         *elem_rtrn = NULL;
         *field_rtrn = xkb_atom_text(ctx, expr->ident.ident);
         *index_rtrn = NULL;
-        return true;
+        return (*field_rtrn != NULL);
     case EXPR_FIELD_REF:
         *elem_rtrn = xkb_atom_text(ctx, expr->field_ref.element);
         *field_rtrn = xkb_atom_text(ctx, expr->field_ref.field);
path: src/xkbcomp/expr.c
Vulnerability: Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with invalid virtual modifiers.
Vulnerability ID: CVE-2018-15862
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/xkbcommon/libxkbcommon
Published: 2018-08-25
File: src/xkbcomp/expr.c
Commit message: xkbcomp: Don't explode on invalid virtual modifiers

testcase: 'virtualModifiers=LevelThreC'

Signed-off-by: Daniel Stone <daniels@collabora.com>
Commit author: Daniel Stone

Vulnerable version (before fix):
 LookupModMask(struct xkb_context *ctx, const void *priv, xkb_atom_t field,         return false;      str = xkb_atom_text(ctx, field);      if (istreq(str, "all")) {         *val_rtrn  = MOD_REAL_MASK_ALL;

Fixed version (after fix):
 LookupModMask(struct xkb_context *ctx, const void *priv, xkb_atom_t field,         return false;      str = xkb_atom_text(ctx, field);     if (!str)         return false;      if (istreq(str, "all")) {         *val_rtrn  = MOD_REAL_MASK_ALL;

Patch:
patch: @@ -101,6 +101,8 @@ LookupModMask(struct xkb_context *ctx, const void *priv, xkb_atom_t field,
         return false;
 
     str = xkb_atom_text(ctx, field);
+    if (!str)
+        return false;
 
     if (istreq(str, "all")) {
         *val_rtrn  = MOD_REAL_MASK_ALL;
path: src/xkbcomp/expr.c
Vulnerability: Unchecked NULL pointer usage in ResolveStateAndPredicate in xkbcomp/compat.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with a no-op modmask expression.
Vulnerability ID: CVE-2018-15863
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/xkbcommon/libxkbcommon
Published: 2018-08-25
File: src/xkbcomp/compat.c
Commit message: xkbcomp: Don't crash on no-op modmask expressions

If we have an expression of the form 'l1' in an interp section, we
unconditionally try to dereference its args, even if it has none.

Signed-off-by: Daniel Stone <daniels@collabora.com>
Commit author: Daniel Stone

Vulnerable version (before fix):
 ResolveStateAndPredicate(ExprDef *expr, enum xkb_match_operation *pred_rtrn,     *pred_rtrn = MATCH_EXACTLY;     if (expr->expr.op == EXPR_ACTION_DECL) {         const char *pred_txt = xkb_atom_text(info->ctx, expr->action.name);         if (!LookupString(symInterpretMatchMaskNames, pred_txt, pred_rtrn)) {             log_err(info->ctx,                     "Illegal modifier predicate \"%s\"; Ignored\n", pred_txt);             return false;

Fixed version (after fix):
 ResolveStateAndPredicate(ExprDef *expr, enum xkb_match_operation *pred_rtrn,     *pred_rtrn = MATCH_EXACTLY;     if (expr->expr.op == EXPR_ACTION_DECL) {         const char *pred_txt = xkb_atom_text(info->ctx, expr->action.name);         if (!LookupString(symInterpretMatchMaskNames, pred_txt, pred_rtrn) ||             !expr->action.args) {             log_err(info->ctx,                     "Illegal modifier predicate \"%s\"; Ignored\n", pred_txt);             return false;

Patch:
patch: @@ -264,7 +264,8 @@ ResolveStateAndPredicate(ExprDef *expr, enum xkb_match_operation *pred_rtrn,
     *pred_rtrn = MATCH_EXACTLY;
     if (expr->expr.op == EXPR_ACTION_DECL) {
         const char *pred_txt = xkb_atom_text(info->ctx, expr->action.name);
-        if (!LookupString(symInterpretMatchMaskNames, pred_txt, pred_rtrn)) {
+        if (!LookupString(symInterpretMatchMaskNames, pred_txt, pred_rtrn) ||
+            !expr->action.args) {
             log_err(info->ctx,
                     "Illegal modifier predicate \"%s\"; Ignored\n", pred_txt);
             return false;
path: src/xkbcomp/compat.c
Vulnerability: ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that has a negative pixel value. If the affected code is used as a library loaded into a process that includes sensitive information, that information sometimes can be leaked via the image data.
Vulnerability ID: CVE-2018-16323
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2018-09-01
File: coders/xbm.c
Commit message: XBM coder leaves the hex image data uninitialized if hex value of the pixel is negative
Commit author: Cristy

Vulnerable version (before fix):
 static Image *ReadXBMImage(const ImageInfo *image_info,ExceptionInfo *exception)     {       c=XBMInteger(image,hex_digits);       if (c < 0)         break;       *p++=(unsigned char) c;       if ((padding == 0) || (((i+2) % bytes_per_line) != 0))         *p++=(unsigned char) (c >> 8); static Image *ReadXBMImage(const ImageInfo *image_info,ExceptionInfo *exception)     {       c=XBMInteger(image,hex_digits);       if (c < 0)         break;       *p++=(unsigned char) c;     }   if (EOFBlob(image) != MagickFalse)

Fixed version (after fix):
 static Image *ReadXBMImage(const ImageInfo *image_info,ExceptionInfo *exception)     {       c=XBMInteger(image,hex_digits);       if (c < 0)         {           data=(unsigned char *) RelinquishMagickMemory(data);           ThrowReaderException(CorruptImageError,"ImproperImageHeader");         }       *p++=(unsigned char) c;       if ((padding == 0) || (((i+2) % bytes_per_line) != 0))         *p++=(unsigned char) (c >> 8); static Image *ReadXBMImage(const ImageInfo *image_info,ExceptionInfo *exception)     {       c=XBMInteger(image,hex_digits);       if (c < 0)         {           data=(unsigned char *) RelinquishMagickMemory(data);           ThrowReaderException(CorruptImageError,"ImproperImageHeader");         }       *p++=(unsigned char) c;     }   if (EOFBlob(image) != MagickFalse)

Patch:
patch: @@ -351,7 +351,10 @@ static Image *ReadXBMImage(const ImageInfo *image_info,ExceptionInfo *exception)
     {
       c=XBMInteger(image,hex_digits);
       if (c < 0)
-        break;
+        {
+          data=(unsigned char *) RelinquishMagickMemory(data);
+          ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+        }
       *p++=(unsigned char) c;
       if ((padding == 0) || (((i+2) % bytes_per_line) != 0))
         *p++=(unsigned char) (c >> 8);
@@ -361,7 +364,10 @@ static Image *ReadXBMImage(const ImageInfo *image_info,ExceptionInfo *exception)
     {
       c=XBMInteger(image,hex_digits);
       if (c < 0)
-        break;
+        {
+          data=(unsigned char *) RelinquishMagickMemory(data);
+          ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+        }
       *p++=(unsigned char) c;
     }
   if (EOFBlob(image) != MagickFalse)
path: coders/xbm.c
Vulnerability: e107_web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type.
Vulnerability ID: CVE-2018-16388
CWE: CWE-434
Severity score: 6.4
Project: https://github.com/e107inc/e107
Published: 2018-09-12
File: e107_web/js/plupload/upload.php
Commit message: plupload fix.
Commit author: Cameron

Vulnerable version (before fix):
 	$chunks = isset($_REQUEST["chunks"]) ? intval($_REQUEST["chunks"]) : 0; 	$fileName = isset($_REQUEST["name"]) ? $_REQUEST["name"] : '';    // Clean the fileName for security reasons 	$fileName = preg_replace('/[^\w\._]+/', '_', $fileName);  	$fileName= 'hello.jpg';  	if(!empty($_FILES['file']['name'])) // dropzone support v2.1.9 	{ 		$fileName = $_FILES['file']['name'];  	$filePath = str_replace('//','/',$filePath); // cleanup .  	$convertToJpeg = e107::getPref('convert_to_jpeg', 0); 	$fileSize = filesize($filePath);   	}  	if($_GET['for'] != '') // leave in upload directory if no category given. 	{ 		$uploadPath = varset($_GET['path'],null);

Fixed version (after fix):
 	$chunks = isset($_REQUEST["chunks"]) ? intval($_REQUEST["chunks"]) : 0; 	$fileName = isset($_REQUEST["name"]) ? $_REQUEST["name"] : '';  // Clean the fileName for security reasons 	$fileName = preg_replace('/[^\w\._]+/', '_', $fileName);  	if(!empty($_FILES['file']['name'])) // dropzone support v2.1.9 	{ 		$fileName = $_FILES['file']['name'];  	$filePath = str_replace('//','/',$filePath); // cleanup .   	if(e107::getFile()->isClean($filePath) !== true) 	{ 		@unlink($filePath); 		die('{"jsonrpc" : "2.0", "error" : {"code": 103, "message": "Bad File Detected."}, "id" : "id"}'); 	}   	$convertToJpeg = e107::getPref('convert_to_jpeg', 0); 	$fileSize = filesize($filePath);   	}     	if($_GET['for'] != '') // leave in upload directory if no category given. 	{ 		$uploadPath = varset($_GET['path'],null);

Patch:
patch: @@ -46,13 +46,9 @@
 	$chunks = isset($_REQUEST["chunks"]) ? intval($_REQUEST["chunks"]) : 0;
 	$fileName = isset($_REQUEST["name"]) ? $_REQUEST["name"] : '';
 
-
-
 // Clean the fileName for security reasons
 	$fileName = preg_replace('/[^\w\._]+/', '_', $fileName);
 
-	$fileName= 'hello.jpg';
-
 	if(!empty($_FILES['file']['name'])) // dropzone support v2.1.9
 	{
 		$fileName = $_FILES['file']['name'];
@@ -195,6 +191,14 @@
 
 	$filePath = str_replace('//','/',$filePath); // cleanup .
 
+
+	if(e107::getFile()->isClean($filePath) !== true)
+	{
+		@unlink($filePath);
+		die('{"jsonrpc" : "2.0", "error" : {"code": 103, "message": "Bad File Detected."}, "id" : "id"}');
+	}
+
+
 	$convertToJpeg = e107::getPref('convert_to_jpeg', 0);
 	$fileSize = filesize($filePath);
 
@@ -209,6 +213,9 @@
 
 	}
 
+
+
+
 	if($_GET['for'] != '') // leave in upload directory if no category given.
 	{
 		$uploadPath = varset($_GET['path'],null);
path: e107_web/js/plupload/upload.php
Vulnerability: The SMB parser in tcpdump before 4.9.3 has buffer over-reads in print-smb.c:print_trans() for \MAILSLOT\BROWSE and \PIPE\LANMAN.
Vulnerability ID: CVE-2018-16451
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/the-tcpdump-group/tcpdump
Published: 2019-10-03
File: print-smb.c
Commit message: (for 4.9.3) SMB: Add two missing bounds checks
Commit author: Francois-Xavier Le Bail

Vulnerable version (before fix):
 print_trans(netdissect_options *ndo,     ND_PRINT((ndo, "smb_bcc=%u\n", bcc));     if (bcc > 0) { 	smb_fdata(ndo, data1 + 2, f2, maxbuf - (paramlen + datalen), unicodestr);  	if (strcmp((const char *)(data1 + 2), "\\MAILSLOT\\BROWSE") == 0) { 	    print_browse(ndo, param, paramlen, data, datalen); 	    return; 	}  	if (strcmp((const char *)(data1 + 2), "\\PIPE\\LANMAN") == 0) { 	    print_ipc(ndo, param, paramlen, data, datalen); 	    return; 	}  	if (paramlen) 	    smb_fdata(ndo, param, f3, min(param + paramlen, maxbuf), unicodestr);

Fixed version (after fix):
 print_trans(netdissect_options *ndo,     ND_PRINT((ndo, "smb_bcc=%u\n", bcc));     if (bcc > 0) { 	smb_fdata(ndo, data1 + 2, f2, maxbuf - (paramlen + datalen), unicodestr); #define MAILSLOT_BROWSE_STR "\\MAILSLOT\\BROWSE" 	ND_TCHECK2(*(data1 + 2), strlen(MAILSLOT_BROWSE_STR) + 1); 	if (strcmp((const char *)(data1 + 2), MAILSLOT_BROWSE_STR) == 0) { 	    print_browse(ndo, param, paramlen, data, datalen); 	    return; 	} #undef MAILSLOT_BROWSE_STR  #define PIPE_LANMAN_STR "\\PIPE\\LANMAN" 	ND_TCHECK2(*(data1 + 2), strlen(PIPE_LANMAN_STR) + 1); 	if (strcmp((const char *)(data1 + 2), PIPE_LANMAN_STR) == 0) { 	    print_ipc(ndo, param, paramlen, data, datalen); 	    return; 	} #undef PIPE_LANMAN_STR  	if (paramlen) 	    smb_fdata(ndo, param, f3, min(param + paramlen, maxbuf), unicodestr);

Patch:
patch: @@ -371,16 +371,21 @@ print_trans(netdissect_options *ndo,
     ND_PRINT((ndo, "smb_bcc=%u\n", bcc));
     if (bcc > 0) {
 	smb_fdata(ndo, data1 + 2, f2, maxbuf - (paramlen + datalen), unicodestr);
-
-	if (strcmp((const char *)(data1 + 2), "\\MAILSLOT\\BROWSE") == 0) {
+#define MAILSLOT_BROWSE_STR "\\MAILSLOT\\BROWSE"
+	ND_TCHECK2(*(data1 + 2), strlen(MAILSLOT_BROWSE_STR) + 1);
+	if (strcmp((const char *)(data1 + 2), MAILSLOT_BROWSE_STR) == 0) {
 	    print_browse(ndo, param, paramlen, data, datalen);
 	    return;
 	}
+#undef MAILSLOT_BROWSE_STR
 
-	if (strcmp((const char *)(data1 + 2), "\\PIPE\\LANMAN") == 0) {
+#define PIPE_LANMAN_STR "\\PIPE\\LANMAN"
+	ND_TCHECK2(*(data1 + 2), strlen(PIPE_LANMAN_STR) + 1);
+	if (strcmp((const char *)(data1 + 2), PIPE_LANMAN_STR) == 0) {
 	    print_ipc(ndo, param, paramlen, data, datalen);
 	    return;
 	}
+#undef PIPE_LANMAN_STR
 
 	if (paramlen)
 	    smb_fdata(ndo, param, f3, min(param + paramlen, maxbuf), unicodestr);
path: print-smb.c
Vulnerability: An issue was discovered in the Linux kernel before 4.18.6. An information leak in cdrom_ioctl_drive_status in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940.
Vulnerability ID: CVE-2018-16658
CWE: CWE-200
Severity score: 4.9
Project: https://github.com/torvalds/linux
Published: 2018-09-07
File: drivers/cdrom/cdrom.c
Commit message: cdrom: Fix info leak/OOB read in cdrom_ioctl_drive_status

Like d88b6d04: "cdrom: information leak in cdrom_ioctl_media_changed()"

There is another cast from unsigned long to int which causes
a bounds check to fail with specially crafted input. The value is
then used as an index in the slot array in cdrom_slot_status().

Signed-off-by: Scott Bauer <scott.bauer@intel.com>
Signed-off-by: Scott Bauer <sbauer@plzdonthack.me>
Cc: stable@vger.kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Commit author: Scott Bauer

Vulnerable version (before fix):
 static int cdrom_ioctl_drive_status(struct cdrom_device_info *cdi, 	if (!CDROM_CAN(CDC_SELECT_DISC) || 	    (arg == CDSL_CURRENT || arg == CDSL_NONE)) 		return cdi->ops->drive_status(cdi, CDSL_CURRENT); 	if (((int)arg >= cdi->capacity)) 		return -EINVAL; 	return cdrom_slot_status(cdi, arg); }

Fixed version (after fix):
 static int cdrom_ioctl_drive_status(struct cdrom_device_info *cdi, 	if (!CDROM_CAN(CDC_SELECT_DISC) || 	    (arg == CDSL_CURRENT || arg == CDSL_NONE)) 		return cdi->ops->drive_status(cdi, CDSL_CURRENT); 	if (arg >= cdi->capacity) 		return -EINVAL; 	return cdrom_slot_status(cdi, arg); }

Patch:
patch: @@ -2546,7 +2546,7 @@ static int cdrom_ioctl_drive_status(struct cdrom_device_info *cdi,
 	if (!CDROM_CAN(CDC_SELECT_DISC) ||
 	    (arg == CDSL_CURRENT || arg == CDSL_NONE))
 		return cdi->ops->drive_status(cdi, CDSL_CURRENT);
-	if (((int)arg >= cdi->capacity))
+	if (arg >= cdi->capacity)
 		return -EINVAL;
 	return cdrom_slot_status(cdi, arg);
 }
path: drivers/cdrom/cdrom.c
Vulnerability: In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted file.
Vulnerability ID: CVE-2018-16749
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick6
Published: 2018-09-09
File: coders/png.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1119
Commit author: Cristy

Vulnerable version (before fix):
 static Image *ReadOneJNGImage(MngInfo *mng_info,           (void) LogMagickEvent(CoderEvent,GetMagickModule(),             "    Copying JDAT chunk data to color_blob.");          if (length != 0)           {             (void) WriteBlob(color_image,length,chunk);             chunk=(unsigned char *) RelinquishMagickMemory(chunk);

Fixed version (after fix):
 static Image *ReadOneJNGImage(MngInfo *mng_info,           (void) LogMagickEvent(CoderEvent,GetMagickModule(),             "    Copying JDAT chunk data to color_blob.");          if ((length != 0) && (color_image != (Image *) NULL))           {             (void) WriteBlob(color_image,length,chunk);             chunk=(unsigned char *) RelinquishMagickMemory(chunk);

Patch:
patch: @@ -4584,7 +4584,7 @@ static Image *ReadOneJNGImage(MngInfo *mng_info,
           (void) LogMagickEvent(CoderEvent,GetMagickModule(),
             "    Copying JDAT chunk data to color_blob.");
 
-        if (length != 0)
+        if ((length != 0) && (color_image != (Image *) NULL))
           {
             (void) WriteBlob(color_image,length,chunk);
             chunk=(unsigned char *) RelinquishMagickMemory(chunk);
path: coders/png.c
Vulnerability: Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.
Vulnerability ID: CVE-2018-16839
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/curl/curl
Published: 2018-10-31
File: lib/vauth/cleartext.c
Commit message: Curl_auth_create_plain_message: fix too-large-input-check

CVE-2018-16839
Reported-by: Harry Sintonen
Bug: https://curl.haxx.se/docs/CVE-2018-16839.html
Commit author: Daniel Stenberg

Vulnerable version (before fix):
 CURLcode Curl_auth_create_plain_message(struct Curl_easy *data,   plen = strlen(passwdp);    /* Compute binary message length. Check for overflows. */   if((ulen > SIZE_T_MAX/2) || (plen > (SIZE_T_MAX/2 - 2)))     return CURLE_OUT_OF_MEMORY;   plainlen = 2 * ulen + plen + 2; 

Fixed version (after fix):
 CURLcode Curl_auth_create_plain_message(struct Curl_easy *data,   plen = strlen(passwdp);    /* Compute binary message length. Check for overflows. */   if((ulen > SIZE_T_MAX/4) || (plen > (SIZE_T_MAX/2 - 2)))     return CURLE_OUT_OF_MEMORY;   plainlen = 2 * ulen + plen + 2; 

Patch:
patch: @@ -74,7 +74,7 @@ CURLcode Curl_auth_create_plain_message(struct Curl_easy *data,
   plen = strlen(passwdp);
 
   /* Compute binary message length. Check for overflows. */
-  if((ulen > SIZE_T_MAX/2) || (plen > (SIZE_T_MAX/2 - 2)))
+  if((ulen > SIZE_T_MAX/4) || (plen > (SIZE_T_MAX/2 - 2)))
     return CURLE_OUT_OF_MEMORY;
   plainlen = 2 * ulen + plen + 2;
path: lib/vauth/cleartext.c