rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them.
Vulnerability ID: CVE-2019-16993
CWE: CWE-352
Severity score: 6.4
Project: https://github.com/phpbb/phpbb
Published: 2019-09-30
File: phpBB/includes/acp/acp_bbcodes.php
Commit message: [ticket/security-188] Check form key in acp_bbcodes

SECURITY-188
Commit author: Marc Alexander

Vulnerable version (before fix):
 function main($id, $mode) 		// Set up general vars 		$action	= request_var('action', ''); 		$bbcode_id = request_var('bbcode', 0);  		$this->tpl_name = 'acp_bbcodes'; 		$this->page_title = 'ACP_BBCODES'; 		$form_key = 'acp_bbcodes';  		add_form_key($form_key);  		// Set up mode-specific vars 		switch ($action) 		{

Fixed version (after fix):
 function main($id, $mode) 		// Set up general vars 		$action	= request_var('action', ''); 		$bbcode_id = request_var('bbcode', 0); 		$submit = $request->is_set_post('submit');  		$this->tpl_name = 'acp_bbcodes'; 		$this->page_title = 'ACP_BBCODES'; 		$form_key = 'acp_bbcodes';  		add_form_key($form_key);  		if ($submit && !check_form_key($form_key)) 		{ 			trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING); 		}  		// Set up mode-specific vars 		switch ($action) 		{

Patch:
patch: @@ -33,13 +33,19 @@ function main($id, $mode)
 		// Set up general vars
 		$action	= request_var('action', '');
 		$bbcode_id = request_var('bbcode', 0);
+		$submit = $request->is_set_post('submit');
 
 		$this->tpl_name = 'acp_bbcodes';
 		$this->page_title = 'ACP_BBCODES';
 		$form_key = 'acp_bbcodes';
 
 		add_form_key($form_key);
 
+		if ($submit && !check_form_key($form_key))
+		{
+			trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING);
+		}
+
 		// Set up mode-specific vars
 		switch ($action)
 		{
path: phpBB/includes/acp/acp_bbcodes.php
Vulnerability: In the Linux kernel before 5.0, a memory leak exists in sit_init_net() in net/ipv6/sit.c when register_netdev() fails to register sitn->fb_tunnel_dev, which may cause denial of service, aka CID-07f12b26e21a.
Vulnerability ID: CVE-2019-16994
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-09-30
File: net/ipv6/sit.c
Commit message: net: sit: fix memory leak in sit_init_net()

If register_netdev() is failed to register sitn->fb_tunnel_dev,
it will go to err_reg_dev and forget to free netdev(sitn->fb_tunnel_dev).

BUG: memory leak
unreferenced object 0xffff888378daad00 (size 512):
  comm "syz-executor.1", pid 4006, jiffies 4295121142 (age 16.115s)
  hex dump (first 32 bytes):
    00 e6 ed c0 83 88 ff ff 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
backtrace:
    [<00000000d6dcb63e>] kvmalloc include/linux/mm.h:577 [inline]
    [<00000000d6dcb63e>] kvzalloc include/linux/mm.h:585 [inline]
    [<00000000d6dcb63e>] netif_alloc_netdev_queues net/core/dev.c:8380 [inline]
    [<00000000d6dcb63e>] alloc_netdev_mqs+0x600/0xcc0 net/core/dev.c:8970
    [<00000000867e172f>] sit_init_net+0x295/0xa40 net/ipv6/sit.c:1848
    [<00000000871019fa>] ops_init+0xad/0x3e0 net/core/net_namespace.c:129
    [<00000000319507f6>] setup_net+0x2ba/0x690 net/core/net_namespace.c:314
    [<0000000087db4f96>] copy_net_ns+0x1dc/0x330 net/core/net_namespace.c:437
    [<0000000057efc651>] create_new_namespaces+0x382/0x730 kernel/nsproxy.c:107
    [<00000000676f83de>] copy_namespaces+0x2ed/0x3d0 kernel/nsproxy.c:165
    [<0000000030b74bac>] copy_process.part.27+0x231e/0x6db0 kernel/fork.c:1919
    [<00000000fff78746>] copy_process kernel/fork.c:1713 [inline]
    [<00000000fff78746>] _do_fork+0x1bc/0xe90 kernel/fork.c:2224
    [<000000001c2e0d1c>] do_syscall_64+0xc8/0x580 arch/x86/entry/common.c:290
    [<00000000ec48bd44>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
    [<0000000039acff8a>] 0xffffffffffffffff

Signed-off-by: Mao Wenan <maowenan@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mao Wenan

Vulnerable version (before fix):
 static int __net_init sit_init_net(struct net *net)  err_reg_dev: 	ipip6_dev_free(sitn->fb_tunnel_dev); err_alloc_dev: 	return err; }

Fixed version (after fix):
 static int __net_init sit_init_net(struct net *net)  err_reg_dev: 	ipip6_dev_free(sitn->fb_tunnel_dev); 	free_netdev(sitn->fb_tunnel_dev); err_alloc_dev: 	return err; }

Patch:
patch: @@ -1873,6 +1873,7 @@ static int __net_init sit_init_net(struct net *net)
 
 err_reg_dev:
 	ipip6_dev_free(sitn->fb_tunnel_dev);
+	free_netdev(sitn->fb_tunnel_dev);
 err_alloc_dev:
 	return err;
 }
path: net/ipv6/sit.c
Vulnerability: Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.
Vulnerability ID: CVE-2019-17358
CWE: CWE-787
Severity score: 4.9
Project: https://github.com/Cacti/cacti
Published: 2019-12-12
File: lib/functions.php
Commit message: Resoving Issue #3026

Unsafe deserialization in of selected objects in Cacti
Commit author: cigamit

Vulnerable version (before fix):
 function sanitize_cdef($cdef) {  */ function sanitize_unserialize_selected_items($items) { 	if ($items != '') { 		$items = unserialize(stripslashes($items));  		if (is_array($items)) { 			foreach ($items as $item) { 				if (is_array($item)) { 					return false; 				} elseif (!is_numeric($item) && ($item != '')) { 					return false; 				} 			} 		} else { 			return false;

Fixed version (after fix):
 function sanitize_cdef($cdef) {  */ function sanitize_unserialize_selected_items($items) { 	if ($items != '') { 		$unstripped = stripslashes($items);  		// validate that sanitized string is correctly formatted 		if (preg_match('/^a:[0-9]+:{/', $unstripped) && !preg_match('/(^|;|{|})O:\+?[0-9]+:"/', $unstripped)) { 			$items = unserialize($unstripped);  			if (is_array($items)) { 				foreach ($items as $item) { 					if (is_array($item)) { 						return false; 					} elseif (!is_numeric($item) && ($item != '')) { 						return false; 					} 				} 			} else { 				return false; 			} 		} else { 			return false;

Patch:
patch: @@ -3100,15 +3100,22 @@ function sanitize_cdef($cdef) {
  */
 function sanitize_unserialize_selected_items($items) {
 	if ($items != '') {
-		$items = unserialize(stripslashes($items));
-
-		if (is_array($items)) {
-			foreach ($items as $item) {
-				if (is_array($item)) {
-					return false;
-				} elseif (!is_numeric($item) && ($item != '')) {
-					return false;
+		$unstripped = stripslashes($items);
+
+		// validate that sanitized string is correctly formatted
+		if (preg_match('/^a:[0-9]+:{/', $unstripped) && !preg_match('/(^|;|{|})O:\+?[0-9]+:"/', $unstripped)) {
+			$items = unserialize($unstripped);
+
+			if (is_array($items)) {
+				foreach ($items as $item) {
+					if (is_array($item)) {
+						return false;
+					} elseif (!is_numeric($item) && ($item != '')) {
+						return false;
+					}
 				}
+			} else {
+				return false;
 			}
 		} else {
 			return false;
path: lib/functions.php
Vulnerability: Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap-based buffer over-read in strdup_vprintf when uninitialized memory is accessed.
Vulnerability ID: CVE-2019-17533
CWE: CWE-125
Severity score: 4.9
Project: https://github.com/tbeu/matio
Published: 2019-10-13
File: src/mat4.c
Commit message: Avoid uninitialized memory

As reported by https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16856
Commit author: tbeu

Vulnerable version (before fix):
 Mat_VarReadNextInfo4(mat_t *mat)     if ( tmp != readresult ) {         Mat_VarFree(matvar);         return NULL;     }      matvar->internal->datapos = ftell((FILE*)mat->fp);

Fixed version (after fix):
 Mat_VarReadNextInfo4(mat_t *mat)     if ( tmp != readresult ) {         Mat_VarFree(matvar);         return NULL;     } else {         matvar->name[tmp - 1] = '\0';     }      matvar->internal->datapos = ftell((FILE*)mat->fp);

Patch:
patch: @@ -917,6 +917,8 @@ Mat_VarReadNextInfo4(mat_t *mat)
     if ( tmp != readresult ) {
         Mat_VarFree(matvar);
         return NULL;
+    } else {
+        matvar->name[tmp - 1] = '\0';
     }
 
     matvar->internal->datapos = ftell((FILE*)mat->fp);
path: src/mat4.c
Vulnerability: vips_foreign_load_gif_scan_image in foreign/gifload.c in libvips before 8.8.2 tries to access a color map before a DGifGetImageDesc call, leading to a use-after-free.
Vulnerability ID: CVE-2019-17534
CWE: CWE-416
Severity score: 6.4
Project: https://github.com/libvips/libvips
Published: 2019-10-13
File: libvips/foreign/gifload.c
Commit message: fetch map after DGifGetImageDesc()

Earlier refactoring broke GIF map fetch.
Commit author: John Cupitt

Vulnerable version (before fix):
 vips_foreign_load_gif_scan_image( VipsForeignLoadGif *gif ) { 	VipsObjectClass *class = VIPS_OBJECT_GET_CLASS( gif ); 	GifFileType *file = gif->file; 	ColorMapObject *map = file->Image.ColorMap ? 		file->Image.ColorMap : file->SColorMap;  	GifByteType *extension;  	if( DGifGetImageDesc( gif->file ) == GIF_ERROR ) { vips_foreign_load_gif_scan_image( VipsForeignLoadGif *gif )  	/* Test for a non-greyscale colourmap for this frame. 	 */ 	if( !gif->has_colour && 		map ) { 		int i;

Fixed version (after fix):
 vips_foreign_load_gif_scan_image( VipsForeignLoadGif *gif ) { 	VipsObjectClass *class = VIPS_OBJECT_GET_CLASS( gif ); 	GifFileType *file = gif->file;  	ColorMapObject *map; 	GifByteType *extension;  	if( DGifGetImageDesc( gif->file ) == GIF_ERROR ) { vips_foreign_load_gif_scan_image( VipsForeignLoadGif *gif )  	/* Test for a non-greyscale colourmap for this frame. 	 */ 	map = file->Image.ColorMap ? file->Image.ColorMap : file->SColorMap; 	if( !gif->has_colour && 		map ) { 		int i;

Patch:
patch: @@ -408,9 +408,8 @@ vips_foreign_load_gif_scan_image( VipsForeignLoadGif *gif )
 {
 	VipsObjectClass *class = VIPS_OBJECT_GET_CLASS( gif );
 	GifFileType *file = gif->file;
-	ColorMapObject *map = file->Image.ColorMap ?
-		file->Image.ColorMap : file->SColorMap;
 
+	ColorMapObject *map;
 	GifByteType *extension;
 
 	if( DGifGetImageDesc( gif->file ) == GIF_ERROR ) {
@@ -435,6 +434,7 @@ vips_foreign_load_gif_scan_image( VipsForeignLoadGif *gif )
 
 	/* Test for a non-greyscale colourmap for this frame.
 	 */
+	map = file->Image.ColorMap ? file->Image.ColorMap : file->SColorMap;
 	if( !gif->has_colour &&
 		map ) {
 		int i;
path: libvips/foreign/gifload.c
Vulnerability: In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer.
Vulnerability ID: CVE-2019-17539
CWE: CWE-476
Severity score: 6.4
Project: https://github.com/FFmpeg/FFmpeg
Published: 2019-10-14
File: libavcodec/utils.c
Commit message: avcodec/utils: Check close before calling it

Fixes: NULL pointer dereference
Fixes: 15733/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IDF_fuzzer-5658616977162240

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 FF_ENABLE_DEPRECATION_WARNINGS      return ret; free_and_end:     if (avctx->codec &&         (codec_init_ok ||          (avctx->codec->caps_internal & FF_CODEC_CAP_INIT_CLEANUP)))         avctx->codec->close(avctx);

Fixed version (after fix):
 FF_ENABLE_DEPRECATION_WARNINGS      return ret; free_and_end:     if (avctx->codec && avctx->codec->close &&         (codec_init_ok ||          (avctx->codec->caps_internal & FF_CODEC_CAP_INIT_CLEANUP)))         avctx->codec->close(avctx);

Patch:
patch: @@ -1024,7 +1024,7 @@ FF_ENABLE_DEPRECATION_WARNINGS
 
     return ret;
 free_and_end:
-    if (avctx->codec &&
+    if (avctx->codec && avctx->codec->close &&
         (codec_init_ok ||
          (avctx->codec->caps_internal & FF_CODEC_CAP_INIT_CLEANUP)))
         avctx->codec->close(avctx);
path: libavcodec/utils.c
Vulnerability: FFmpeg before 4.2 has a heap-based buffer overflow in vqa_decode_chunk because of an out-of-array access in vqa_decode_init in libavcodec/vqavideo.c.
Vulnerability ID: CVE-2019-17542
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/FFmpeg/FFmpeg
Published: 2019-10-14
File: libavcodec/vqavideo.c
Commit message: avcodec/vqavideo: Set video size

Fixes: out of array access
Fixes: 15919/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQA_fuzzer-5657368257363968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static av_cold int vqa_decode_init(AVCodecContext *avctx)     }     s->width = AV_RL16(&s->avctx->extradata[6]);     s->height = AV_RL16(&s->avctx->extradata[8]);     if ((ret = av_image_check_size(s->width, s->height, 0, avctx)) < 0) {         s->width= s->height= 0;         return ret;     }

Fixed version (after fix):
 static av_cold int vqa_decode_init(AVCodecContext *avctx)     }     s->width = AV_RL16(&s->avctx->extradata[6]);     s->height = AV_RL16(&s->avctx->extradata[8]);     if ((ret = ff_set_dimensions(avctx, s->width, s->height)) < 0) {         s->width= s->height= 0;         return ret;     }

Patch:
patch: @@ -147,7 +147,7 @@ static av_cold int vqa_decode_init(AVCodecContext *avctx)
     }
     s->width = AV_RL16(&s->avctx->extradata[6]);
     s->height = AV_RL16(&s->avctx->extradata[8]);
-    if ((ret = av_image_check_size(s->width, s->height, 0, avctx)) < 0) {
+    if ((ret = ff_set_dimensions(avctx, s->width, s->height)) < 0) {
         s->width= s->height= 0;
         return ret;
     }
path: libavcodec/vqavideo.c
Vulnerability: GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded.
Vulnerability ID: CVE-2019-17545
CWE: CWE-415
Severity score: 6.4
Project: https://github.com/OSGeo/gdal
Published: 2019-10-14
File: gdal/ogr/ogr_expat.cpp
Commit message: OGRExpatRealloc(): fix double-free when size to allocate is above the default 10MB threshold. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16178. Credit to OSS Fuzz
Commit author: Even Rouault

Vulnerable version (before fix):
 static void* OGRExpatRealloc( void *ptr, size_t size )     if( CanAlloc(size) )         return realloc(ptr, size);      free(ptr);     return nullptr; } 

Fixed version (after fix):
 static void* OGRExpatRealloc( void *ptr, size_t size )     if( CanAlloc(size) )         return realloc(ptr, size);      return nullptr; } 

Patch:
patch: @@ -89,7 +89,6 @@ static void* OGRExpatRealloc( void *ptr, size_t size )
     if( CanAlloc(size) )
         return realloc(ptr, size);
 
-    free(ptr);
     return nullptr;
 }
path: gdal/ogr/ogr_expat.cpp
Vulnerability: In ImageMagick before 7.0.8-62, TraceBezier in MagickCore/draw.c has a use-after-free.
Vulnerability ID: CVE-2019-17547
CWE: CWE-416
Severity score: 6.4
Project: https://github.com/ImageMagick/ImageMagick
Published: 2019-10-14
File: MagickCore/draw.c
Commit message: ...
Commit author: Cristy

Vulnerable version (before fix):
 static MagickBooleanType TraceBezier(MVGInfo *mvg_info,         quantum=(size_t) alpha;     }   }   quantum=MagickMin(quantum/number_coordinates,BezierQuantum);   primitive_info=(*mvg_info->primitive_info)+mvg_info->offset;   coefficients=(double *) AcquireQuantumMemory(number_coordinates,     sizeof(*coefficients));   points=(PointInfo *) AcquireQuantumMemory(quantum,number_coordinates* static MagickBooleanType TraceBezier(MVGInfo *mvg_info,       coefficients=(double *) RelinquishMagickMemory(coefficients);       return(MagickFalse);     }   /*     Compute bezier points.   */

Fixed version (after fix):
 static MagickBooleanType TraceBezier(MVGInfo *mvg_info,         quantum=(size_t) alpha;     }   }   primitive_info=(*mvg_info->primitive_info)+mvg_info->offset;   quantum=MagickMin(quantum/number_coordinates,BezierQuantum);   coefficients=(double *) AcquireQuantumMemory(number_coordinates,     sizeof(*coefficients));   points=(PointInfo *) AcquireQuantumMemory(quantum,number_coordinates* static MagickBooleanType TraceBezier(MVGInfo *mvg_info,       coefficients=(double *) RelinquishMagickMemory(coefficients);       return(MagickFalse);     }   primitive_info=(*mvg_info->primitive_info)+mvg_info->offset;   /*     Compute bezier points.   */

Patch:
patch: @@ -6159,8 +6159,8 @@ static MagickBooleanType TraceBezier(MVGInfo *mvg_info,
         quantum=(size_t) alpha;
     }
   }
-  quantum=MagickMin(quantum/number_coordinates,BezierQuantum);
   primitive_info=(*mvg_info->primitive_info)+mvg_info->offset;
+  quantum=MagickMin(quantum/number_coordinates,BezierQuantum);
   coefficients=(double *) AcquireQuantumMemory(number_coordinates,
     sizeof(*coefficients));
   points=(PointInfo *) AcquireQuantumMemory(quantum,number_coordinates*
@@ -6182,6 +6182,7 @@ static MagickBooleanType TraceBezier(MVGInfo *mvg_info,
       coefficients=(double *) RelinquishMagickMemory(coefficients);
       return(MagickFalse);
     }
+  primitive_info=(*mvg_info->primitive_info)+mvg_info->offset;
   /*
     Compute bezier points.
   */
path: MagickCore/draw.c
Vulnerability: idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.
Vulnerability ID: CVE-2019-18224
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/libidn/libidn2
Published: 2019-10-21
File: lib/lookup.c
Commit message: idn2_to_ascii_4i(): Restrict output length to 63
Commit author: Tim Rühsen

Vulnerable version (before fix):
 idn2_to_ascii_4i (const uint32_t * input, size_t inlen, char * output, int flags        * char * out  output zero terminated string that must have room for at        * least 63 characters plus the terminating zero.        */       if (output) 	strcpy (output, (const char *) output_u8);        free(output_u8);     }    return rc;

Fixed version (after fix):
 idn2_to_ascii_4i (const uint32_t * input, size_t inlen, char * output, int flags        * char * out  output zero terminated string that must have room for at        * least 63 characters plus the terminating zero.        */       size_t len = strlen ((char *) output_u8);        if (len > 63)         { 	  free (output_u8); 	  return IDN2_TOO_BIG_DOMAIN;         }        if (output) 	strcpy (output, (char *) output_u8);        free (output_u8);     }    return rc;

Patch:
patch: @@ -617,10 +617,18 @@ idn2_to_ascii_4i (const uint32_t * input, size_t inlen, char * output, int flags
        * char * out  output zero terminated string that must have room for at
        * least 63 characters plus the terminating zero.
        */
+      size_t len = strlen ((char *) output_u8);
+
+      if (len > 63)
+        {
+	  free (output_u8);
+	  return IDN2_TOO_BIG_DOMAIN;
+        }
+
       if (output)
-	strcpy (output, (const char *) output_u8);
+	strcpy (output, (char *) output_u8);
 
-      free(output_u8);
+      free (output_u8);
     }
 
   return rc;
path: lib/lookup.c
Vulnerability: A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat.
Vulnerability ID: CVE-2019-18397
CWE: CWE-120
Severity score: 6.4
Project: https://github.com/fribidi/fribidi
Published: 2019-11-13
File: lib/fribidi-bidi.c
Commit message: Truncate isolate_level to FRIBIDI_BIDI_MAX_EXPLICIT_LEVEL
Commit author: Dov Grobgeld

Vulnerable version (before fix):
 fribidi_get_par_embedding_levels_ex (             }  	  RL_LEVEL (pp) = level;           RL_ISOLATE_LEVEL (pp) = isolate_level++;           base_level_per_iso_level[isolate_level] = new_level;  	  if (!FRIBIDI_IS_NEUTRAL (override))

Fixed version (after fix):
 fribidi_get_par_embedding_levels_ex (             }  	  RL_LEVEL (pp) = level;           RL_ISOLATE_LEVEL (pp) = isolate_level;           if (isolate_level < FRIBIDI_BIDI_MAX_EXPLICIT_LEVEL-1)               isolate_level++;           base_level_per_iso_level[isolate_level] = new_level;  	  if (!FRIBIDI_IS_NEUTRAL (override))

Patch:
patch: @@ -747,7 +747,9 @@ fribidi_get_par_embedding_levels_ex (
             }
 
 	  RL_LEVEL (pp) = level;
-          RL_ISOLATE_LEVEL (pp) = isolate_level++;
+          RL_ISOLATE_LEVEL (pp) = isolate_level;
+          if (isolate_level < FRIBIDI_BIDI_MAX_EXPLICIT_LEVEL-1)
+              isolate_level++;
           base_level_per_iso_level[isolate_level] = new_level;
 
 	  if (!FRIBIDI_IS_NEUTRAL (override))
path: lib/fribidi-bidi.c
Vulnerability: archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol.
Vulnerability ID: CVE-2019-18408
CWE: CWE-416
Severity score: 2.9
Project: https://github.com/libarchive/libarchive
Published: 2019-10-24
File: libarchive/archive_read_support_format_rar.c
Commit message: RAR reader: fix use after free

If read_data_compressed() returns ARCHIVE_FAILED, the caller is allowed
to continue with next archive headers. We need to set rar->start_new_table
after the ppmd7_context got freed, otherwise it won't be allocated again.

Reported by: OSS-Fuzz issue 2582
Commit author: Martin Matuska

Vulnerable version (before fix):
 archive_read_format_rar_read_data(struct archive_read *a, const void **buff,   case COMPRESS_METHOD_GOOD:   case COMPRESS_METHOD_BEST:     ret = read_data_compressed(a, buff, size, offset);     if (ret != ARCHIVE_OK && ret != ARCHIVE_WARN)       __archive_ppmd7_functions.Ppmd7_Free(&rar->ppmd7_context);     break;    default:

Fixed version (after fix):
 archive_read_format_rar_read_data(struct archive_read *a, const void **buff,   case COMPRESS_METHOD_GOOD:   case COMPRESS_METHOD_BEST:     ret = read_data_compressed(a, buff, size, offset);     if (ret != ARCHIVE_OK && ret != ARCHIVE_WARN) {       __archive_ppmd7_functions.Ppmd7_Free(&rar->ppmd7_context);       rar->start_new_table = 1;     }     break;    default:

Patch:
patch: @@ -1024,8 +1024,10 @@ archive_read_format_rar_read_data(struct archive_read *a, const void **buff,
   case COMPRESS_METHOD_GOOD:
   case COMPRESS_METHOD_BEST:
     ret = read_data_compressed(a, buff, size, offset);
-    if (ret != ARCHIVE_OK && ret != ARCHIVE_WARN)
+    if (ret != ARCHIVE_OK && ret != ARCHIVE_WARN) {
       __archive_ppmd7_functions.Ppmd7_Free(&rar->ppmd7_context);
+      rar->start_new_table = 1;
+    }
     break;
 
   default:
path: libarchive/archive_read_support_format_rar.c