rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: WAVE.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via vectors related to a large number of coefficients.
Vulnerability ID: CVE-2017-6837
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/antlarr/audiofile
Published: 2017-03-20
File: libaudiofile/WAVE.cpp
Commit message: Always check the number of coefficients

When building the library with NDEBUG, asserts are eliminated
so it's better to always check that the number of coefficients
is inside the array range.

This fixes the 00191-audiofile-indexoob issue in #41
Commit author: Antonio Larrosa

Vulnerable version (before fix):
 status WAVEFile::parseFormat(const Tag &id, uint32_t size)  			/* numCoefficients should be at least 7. */ 			assert(numCoefficients >= 7 && numCoefficients <= 255);  			m_msadpcmNumCoefficients = numCoefficients; 

Fixed version (after fix):
 status WAVEFile::parseFormat(const Tag &id, uint32_t size)  			/* numCoefficients should be at least 7. */ 			assert(numCoefficients >= 7 && numCoefficients <= 255); 			if (numCoefficients < 7 || numCoefficients > 255) 			{ 				_af_error(AF_BAD_HEADER, 						"Bad number of coefficients"); 				return AF_FAIL; 			}  			m_msadpcmNumCoefficients = numCoefficients; 

Patch:
patch: @@ -281,6 +281,12 @@ status WAVEFile::parseFormat(const Tag &id, uint32_t size)
 
 			/* numCoefficients should be at least 7. */
 			assert(numCoefficients >= 7 && numCoefficients <= 255);
+			if (numCoefficients < 7 || numCoefficients > 255)
+			{
+				_af_error(AF_BAD_HEADER,
+						"Bad number of coefficients");
+				return AF_FAIL;
+			}
 
 			m_msadpcmNumCoefficients = numCoefficients;
path: libaudiofile/WAVE.cpp
Vulnerability: An integer overflow error within the "foveon_load_camf()" function (dcraw_foveon.c) in LibRaw-demosaic-pack-GPL2 before 0.18.2 can be exploited to cause a heap-based buffer overflow.
Vulnerability ID: CVE-2017-6889
CWE: CWE-190
Severity score: 6.4
Project: https://github.com/LibRaw/LibRaw-demosaic-pack-GPL2
Published: 2017-05-15
File: dcraw_foveon.c
Commit message: Fixed possible foveon buffer overrun (Secunia SA750000)
Commit author: Alex Tutubalin

Vulnerable version (before fix):
 void CLASS foveon_huff (ushort *huff) void CLASS foveon_dp_load_raw() {   unsigned c, roff[4], row, col, diff;   ushort huff[512], vpred[2][2], hpred[2];    fseek (ifp, 8, SEEK_CUR);   foveon_huff (huff); void CLASS foveon_dp_load_raw() void CLASS foveon_load_camf() {   unsigned type, wide, high, i, j, row, col, diff;   ushort huff[258], vpred[2][2] = {{512,512},{512,512}}, hpred[2];    fseek (ifp, meta_offset, SEEK_SET);   type = get4();  get4();  get4();   wide = get4();   high = get4();   if (type == 2) {     fread (meta_data, 1, meta_length, ifp);     for (i=0; i < meta_length; i++) {

Fixed version (after fix):
 void CLASS foveon_huff (ushort *huff) void CLASS foveon_dp_load_raw() {   unsigned c, roff[4], row, col, diff;   ushort huff[1024], vpred[2][2], hpred[2];    fseek (ifp, 8, SEEK_CUR);   foveon_huff (huff); void CLASS foveon_dp_load_raw() void CLASS foveon_load_camf() {   unsigned type, wide, high, i, j, row, col, diff;   ushort huff[1024], vpred[2][2] = {{512,512},{512,512}}, hpred[2];    fseek (ifp, meta_offset, SEEK_SET);   type = get4();  get4();  get4();   wide = get4();   high = get4(); #ifdef LIBRAW_LIBRARY_BUILD   if(wide>32767 || high > 32767 || wide*high > 20000000)      throw LIBRAW_EXCEPTION_IO_CORRUPT; #endif   if (type == 2) {     fread (meta_data, 1, meta_length, ifp);     for (i=0; i < meta_length; i++) {

Patch:
patch: @@ -319,7 +319,7 @@ void CLASS foveon_huff (ushort *huff)
 void CLASS foveon_dp_load_raw()
 {
   unsigned c, roff[4], row, col, diff;
-  ushort huff[512], vpred[2][2], hpred[2];
+  ushort huff[1024], vpred[2][2], hpred[2];
 
   fseek (ifp, 8, SEEK_CUR);
   foveon_huff (huff);
@@ -346,12 +346,16 @@ void CLASS foveon_dp_load_raw()
 void CLASS foveon_load_camf()
 {
   unsigned type, wide, high, i, j, row, col, diff;
-  ushort huff[258], vpred[2][2] = {{512,512},{512,512}}, hpred[2];
+  ushort huff[1024], vpred[2][2] = {{512,512},{512,512}}, hpred[2];
 
   fseek (ifp, meta_offset, SEEK_SET);
   type = get4();  get4();  get4();
   wide = get4();
   high = get4();
+#ifdef LIBRAW_LIBRARY_BUILD
+  if(wide>32767 || high > 32767 || wide*high > 20000000)
+     throw LIBRAW_EXCEPTION_IO_CORRUPT;
+#endif
   if (type == 2) {
     fread (meta_data, 1, meta_length, ifp);
     for (i=0; i < meta_length; i++) {
path: dcraw_foveon.c
Vulnerability: In libsndfile version 1.0.28, an error in the "aiff_read_chanmap()" function (aiff.c) can be exploited to cause an out-of-bounds read memory access via a specially crafted AIFF file.
Vulnerability ID: CVE-2017-6892
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/erikd/libsndfile
Published: 2017-06-12
File: src/aiff.c
Commit message: src/aiff.c: Fix a buffer read overflow

Secunia Advisory SA76717.

Found by: Laurent Delosieres, Secunia Research at Flexera Software
Commit author: Erik de Castro Lopo

Vulnerable version (before fix):
 aiff_read_chanmap (SF_PRIVATE * psf, unsigned dword) 		psf_binheader_readf (psf, "j", dword - bytesread) ;  	if (map_info->channel_map != NULL) 	{	size_t chanmap_size = psf->sf.channels * sizeof (psf->channel_map [0]) ;  		free (psf->channel_map) ; 

Fixed version (after fix):
 aiff_read_chanmap (SF_PRIVATE * psf, unsigned dword) 		psf_binheader_readf (psf, "j", dword - bytesread) ;  	if (map_info->channel_map != NULL) 	{	size_t chanmap_size = SF_MIN (psf->sf.channels, layout_tag & 0xffff) * sizeof (psf->channel_map [0]) ;  		free (psf->channel_map) ; 

Patch:
patch: @@ -1759,7 +1759,7 @@ aiff_read_chanmap (SF_PRIVATE * psf, unsigned dword)
 		psf_binheader_readf (psf, "j", dword - bytesread) ;
 
 	if (map_info->channel_map != NULL)
-	{	size_t chanmap_size = psf->sf.channels * sizeof (psf->channel_map [0]) ;
+	{	size_t chanmap_size = SF_MIN (psf->sf.channels, layout_tag & 0xffff) * sizeof (psf->channel_map [0]) ;
 
 		free (psf->channel_map) ;
path: src/aiff.c
Vulnerability: Integer overflow in the cs_winkernel_malloc function in winkernel_mm.c in Capstone 3.0.4 and earlier allows attackers to cause a denial of service (heap-based buffer overflow in a kernel driver) or possibly have unspecified other impact via a large value.
Vulnerability ID: CVE-2017-6952
CWE: CWE-190
Severity score: 6.4
Project: https://github.com/aquynh/capstone
Published: 2017-03-16
File: windows/winkernel_mm.c
Commit message: provide a validity check to prevent against Integer overflow conditions (#870)

* provide a validity check to prevent against Integer overflow conditions

* fix some style issues.
Commit author: Quang Nguyễn

Vulnerable version (before fix):
  #include "winkernel_mm.h" #include <ntddk.h>  // A pool tag for memory allocation static const ULONG CS_WINKERNEL_POOL_TAG = 'kwsC'; void * CAPSTONE_API cs_winkernel_malloc(size_t size)  	// FP; a use of NonPagedPool is required for Windows 7 support #pragma prefast(suppress : 30030)		// Allocating executable POOL_TYPE memory 	CS_WINKERNEL_MEMBLOCK *block = (CS_WINKERNEL_MEMBLOCK *)ExAllocatePoolWithTag( 			NonPagedPool, size + sizeof(CS_WINKERNEL_MEMBLOCK), CS_WINKERNEL_POOL_TAG); 	if (!block) { 		return NULL; 	}

Fixed version (after fix):
  #include "winkernel_mm.h" #include <ntddk.h> #include <Ntintsafe.h>  // A pool tag for memory allocation static const ULONG CS_WINKERNEL_POOL_TAG = 'kwsC'; void * CAPSTONE_API cs_winkernel_malloc(size_t size)  	// FP; a use of NonPagedPool is required for Windows 7 support #pragma prefast(suppress : 30030)		// Allocating executable POOL_TYPE memory 	size_t number_of_bytes = 0; 	CS_WINKERNEL_MEMBLOCK *block = NULL; 	// A specially crafted size value can trigger the overflow. 	// If the sum in a value that overflows or underflows the capacity of the type, 	// the function returns NULL. 	if (!NT_SUCCESS(RtlSizeTAdd(size, sizeof(CS_WINKERNEL_MEMBLOCK), &number_of_bytes))) { 		return NULL; 	} 	block = (CS_WINKERNEL_MEMBLOCK *)ExAllocatePoolWithTag( 			NonPagedPool, number_of_bytes, CS_WINKERNEL_POOL_TAG); 	if (!block) { 		return NULL; 	}

Patch:
patch: @@ -3,6 +3,7 @@
 
 #include "winkernel_mm.h"
 #include <ntddk.h>
+#include <Ntintsafe.h>
 
 // A pool tag for memory allocation
 static const ULONG CS_WINKERNEL_POOL_TAG = 'kwsC';
@@ -33,8 +34,16 @@ void * CAPSTONE_API cs_winkernel_malloc(size_t size)
 
 	// FP; a use of NonPagedPool is required for Windows 7 support
 #pragma prefast(suppress : 30030)		// Allocating executable POOL_TYPE memory
-	CS_WINKERNEL_MEMBLOCK *block = (CS_WINKERNEL_MEMBLOCK *)ExAllocatePoolWithTag(
-			NonPagedPool, size + sizeof(CS_WINKERNEL_MEMBLOCK), CS_WINKERNEL_POOL_TAG);
+	size_t number_of_bytes = 0;
+	CS_WINKERNEL_MEMBLOCK *block = NULL;
+	// A specially crafted size value can trigger the overflow.
+	// If the sum in a value that overflows or underflows the capacity of the type,
+	// the function returns NULL.
+	if (!NT_SUCCESS(RtlSizeTAdd(size, sizeof(CS_WINKERNEL_MEMBLOCK), &number_of_bytes))) {
+		return NULL;
+	}
+	block = (CS_WINKERNEL_MEMBLOCK *)ExAllocatePoolWithTag(
+			NonPagedPool, number_of_bytes, CS_WINKERNEL_POOL_TAG);
 	if (!block) {
 		return NULL;
 	}
path: windows/winkernel_mm.c
Vulnerability: The netjoin processing in Irssi 1.x before 1.0.2 allows attackers to cause a denial of service (use-after-free) and possibly execute arbitrary code via unspecified vectors.
Vulnerability ID: CVE-2017-7191
CWE: CWE-416
Severity score: 6.4
Project: https://github.com/irssi/irssi
Published: 2017-03-27
File: src/fe-common/irc/fe-netjoin.c
Commit message: Merge branch 'netjoin-timeout' into 'master'

fe-netjoin: remove irc servers on "server disconnected" signal

Closes #7

See merge request !10
Commit author: Ailin Nemui

Vulnerable version (before fix):
 static void read_settings(void) 	} }  void fe_netjoin_init(void) { 	settings_add_bool("misc", "hide_netsplit_quits", TRUE); void fe_netjoin_init(void)  	read_settings(); 	signal_add("setup changed", (SIGNAL_FUNC) read_settings); }  void fe_netjoin_deinit(void) void fe_netjoin_deinit(void) 	}  	signal_remove("setup changed", (SIGNAL_FUNC) read_settings);  	signal_remove("message quit", (SIGNAL_FUNC) msg_quit); 	signal_remove("message join", (SIGNAL_FUNC) msg_join);

Fixed version (after fix):
 static void read_settings(void) 	} }  static void sig_server_disconnected(IRC_SERVER_REC *server) { 	NETJOIN_SERVER_REC *netjoin_server;  	g_return_if_fail(server != NULL);  	if (!IS_IRC_SERVER(server)) 		return;  	if ((netjoin_server = netjoin_find_server(server))) { 		netjoin_server_remove(netjoin_server); 	} }  void fe_netjoin_init(void) { 	settings_add_bool("misc", "hide_netsplit_quits", TRUE); void fe_netjoin_init(void)  	read_settings(); 	signal_add("setup changed", (SIGNAL_FUNC) read_settings); 	signal_add("server disconnected", (SIGNAL_FUNC) sig_server_disconnected); }  void fe_netjoin_deinit(void) void fe_netjoin_deinit(void) 	}  	signal_remove("setup changed", (SIGNAL_FUNC) read_settings); 	signal_remove("server disconnected", (SIGNAL_FUNC) sig_server_disconnected);  	signal_remove("message quit", (SIGNAL_FUNC) msg_quit); 	signal_remove("message join", (SIGNAL_FUNC) msg_join);

Patch:
patch: @@ -470,6 +470,20 @@ static void read_settings(void)
 	}
 }
 
+static void sig_server_disconnected(IRC_SERVER_REC *server)
+{
+	NETJOIN_SERVER_REC *netjoin_server;
+
+	g_return_if_fail(server != NULL);
+
+	if (!IS_IRC_SERVER(server))
+		return;
+
+	if ((netjoin_server = netjoin_find_server(server))) {
+		netjoin_server_remove(netjoin_server);
+	}
+}
+
 void fe_netjoin_init(void)
 {
 	settings_add_bool("misc", "hide_netsplit_quits", TRUE);
@@ -480,6 +494,7 @@ void fe_netjoin_init(void)
 
 	read_settings();
 	signal_add("setup changed", (SIGNAL_FUNC) read_settings);
+	signal_add("server disconnected", (SIGNAL_FUNC) sig_server_disconnected);
 }
 
 void fe_netjoin_deinit(void)
@@ -492,6 +507,7 @@ void fe_netjoin_deinit(void)
 	}
 
 	signal_remove("setup changed", (SIGNAL_FUNC) read_settings);
+	signal_remove("server disconnected", (SIGNAL_FUNC) sig_server_disconnected);
 
 	signal_remove("message quit", (SIGNAL_FUNC) msg_quit);
 	signal_remove("message join", (SIGNAL_FUNC) msg_join);
path: src/fe-common/irc/fe-netjoin.c
Vulnerability: A cross-site scripting (XSS) vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrary HTML or JavaScript (if MantisBT's CSP settings permit it) by modifying 'window_title' in the application configuration. This requires privileged access to MantisBT configuration management pages (i.e., administrator access rights) or altering the system configuration file (config_inc.php).
Vulnerability ID: CVE-2017-7222
CWE: CWE-79
Severity score: 2.9
Project: http://github.com/mantisbt/mantisbt
Published: 2017-03-22
File: core/layout_api.php
Commit message: Sanitize window title

The window title is not sanitized.  That is not an issue when CSP is enable (default),
but if disabled, it can execute javascript that is set by a user who has access
to set configuration via Manage - Manage Configuration - Configuration Report page.

Fixes #22266
Commit author: Victor Boctor

Vulnerable version (before fix):
 function layout_navbar() { 	echo '<div class="navbar-header">'; 	echo '<a href="' . $t_logo_url . '" class="navbar-brand">'; 	echo '<span class="smaller-75"> '; 	echo config_get('window_title'); 	echo ' </span>'; 	echo '</a>'; 

Fixed version (after fix):
 function layout_navbar() { 	echo '<div class="navbar-header">'; 	echo '<a href="' . $t_logo_url . '" class="navbar-brand">'; 	echo '<span class="smaller-75"> '; 	echo string_display_line( config_get('window_title') ); 	echo ' </span>'; 	echo '</a>'; 

Patch:
patch: @@ -415,7 +415,7 @@ function layout_navbar() {
 	echo '<div class="navbar-header">';
 	echo '<a href="' . $t_logo_url . '" class="navbar-brand">';
 	echo '<span class="smaller-75"> ';
-	echo config_get('window_title');
+	echo string_display_line( config_get('window_title') );
 	echo ' </span>';
 	echo '</a>';
path: core/layout_api.php
Vulnerability: The r_pkcs7_parse_cms function in libr/util/r_pkcs7.c in radare2 1.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PE file.
Vulnerability ID: CVE-2017-7274
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/radare/radare2
Published: 2017-03-27
File: libr/util/r_pkcs7.c
Commit message: Fix #7152 - Null deref in cms
Commit author: Giovanni

Vulnerable version (before fix):
 RCMS *r_pkcs7_parse_cms (const ut8 *buffer, ut32 length) { 		return NULL; 	} 	object = r_asn1_create_object (buffer, length); 	if (!object || object->list.length != 2 || !object->list.objects[0] || object->list.objects[1]->list.length != 1) { 		r_asn1_free_object (object); 		free (container); 		return NULL;

Fixed version (after fix):
 RCMS *r_pkcs7_parse_cms (const ut8 *buffer, ut32 length) { 		return NULL; 	} 	object = r_asn1_create_object (buffer, length); 	if (!object || object->list.length != 2 || !object->list.objects || 		!object->list.objects[0] || !object->list.objects[1] || 		object->list.objects[1]->list.length != 1) { 		r_asn1_free_object (object); 		free (container); 		return NULL;

Patch:
patch: @@ -284,7 +284,9 @@ RCMS *r_pkcs7_parse_cms (const ut8 *buffer, ut32 length) {
 		return NULL;
 	}
 	object = r_asn1_create_object (buffer, length);
-	if (!object || object->list.length != 2 || !object->list.objects[0] || object->list.objects[1]->list.length != 1) {
+	if (!object || object->list.length != 2 || !object->list.objects ||
+		!object->list.objects[0] || !object->list.objects[1] ||
+		object->list.objects[1]->list.length != 1) {
 		r_asn1_free_object (object);
 		free (container);
 		return NULL;
path: libr/util/r_pkcs7.c
Vulnerability: The ipxitf_ioctl function in net/ipx/af_ipx.c in the Linux kernel through 4.11.1 mishandles reference counts, which allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a failed SIOCGIFADDR ioctl call for an IPX interface.
Vulnerability ID: CVE-2017-7487
CWE: CWE-416
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2017-05-14
File: net/ipx/af_ipx.c
Commit message: ipx: call ipxitf_put() in ioctl error path

We should call ipxitf_put() if the copy_to_user() fails.

Reported-by: 李强 <liqiang6-s@360.cn>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Dan Carpenter

Vulnerable version (before fix):
 static int ipxitf_ioctl(unsigned int cmd, void __user *arg) 		sipx->sipx_network	= ipxif->if_netnum; 		memcpy(sipx->sipx_node, ipxif->if_node, 			sizeof(sipx->sipx_node)); 		rc = -EFAULT; 		if (copy_to_user(arg, &ifr, sizeof(ifr))) 			break; 		ipxitf_put(ipxif); 		rc = 0; 		break; 	} 	case SIOCAIPXITFCRT:

Fixed version (after fix):
 static int ipxitf_ioctl(unsigned int cmd, void __user *arg) 		sipx->sipx_network	= ipxif->if_netnum; 		memcpy(sipx->sipx_node, ipxif->if_node, 			sizeof(sipx->sipx_node)); 		rc = 0; 		if (copy_to_user(arg, &ifr, sizeof(ifr))) 			rc = -EFAULT; 		ipxitf_put(ipxif); 		break; 	} 	case SIOCAIPXITFCRT:

Patch:
patch: @@ -1168,11 +1168,10 @@ static int ipxitf_ioctl(unsigned int cmd, void __user *arg)
 		sipx->sipx_network	= ipxif->if_netnum;
 		memcpy(sipx->sipx_node, ipxif->if_node,
 			sizeof(sipx->sipx_node));
-		rc = -EFAULT;
+		rc = 0;
 		if (copy_to_user(arg, &ifr, sizeof(ifr)))
-			break;
+			rc = -EFAULT;
 		ipxitf_put(ipxif);
-		rc = 0;
 		break;
 	}
 	case SIOCAIPXITFCRT:
path: net/ipx/af_ipx.c
Vulnerability: The brcmf_cfg80211_mgmt_tx function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel before 4.12.3 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted NL80211_CMD_FRAME Netlink packet.
Vulnerability ID: CVE-2017-7541
CWE: CWE-119
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2017-07-25
File: drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
Commit message: brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx()

The lower level nl80211 code in cfg80211 ensures that "len" is between
25 and NL80211_ATTR_FRAME (2304).  We subtract DOT11_MGMT_HDR_LEN (24) from
"len" so thats's max of 2280.  However, the action_frame->data[] buffer is
only BRCMF_FIL_ACTION_FRAME_SIZE (1800) bytes long so this memcpy() can
overflow.

	memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
	       le16_to_cpu(action_frame->len));

Cc: stable@vger.kernel.org # 3.9.x
Fixes: 18e2f61db3b70 ("brcmfmac: P2P action frame tx.")
Reported-by: "freenerguo(郭大兴)" <freenerguo@tencent.com>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Arend van Spriel

Vulnerable version (before fix):
 brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev, 		cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true, 					GFP_KERNEL); 	} else if (ieee80211_is_action(mgmt->frame_control)) { 		af_params = kzalloc(sizeof(*af_params), GFP_KERNEL); 		if (af_params == NULL) { 			brcmf_err("unable to allocate frame\n");

Fixed version (after fix):
 brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev, 		cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true, 					GFP_KERNEL); 	} else if (ieee80211_is_action(mgmt->frame_control)) { 		if (len > BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) { 			brcmf_err("invalid action frame length\n"); 			err = -EINVAL; 			goto exit; 		} 		af_params = kzalloc(sizeof(*af_params), GFP_KERNEL); 		if (af_params == NULL) { 			brcmf_err("unable to allocate frame\n");

Patch:
patch: @@ -4934,6 +4934,11 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 		cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
 					GFP_KERNEL);
 	} else if (ieee80211_is_action(mgmt->frame_control)) {
+		if (len > BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) {
+			brcmf_err("invalid action frame length\n");
+			err = -EINVAL;
+			goto exit;
+		}
 		af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
 		if (af_params == NULL) {
 			brcmf_err("unable to allocate frame\n");
path: drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
Vulnerability: The ip6_find_1stfragopt function in net/ipv6/output_core.c in the Linux kernel through 4.12.3 allows local users to cause a denial of service (integer overflow and infinite loop) by leveraging the ability to open a raw socket.
Vulnerability ID: CVE-2017-7542
CWE: CWE-190
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2017-07-21
File: net/ipv6/output_core.c
Commit message: ipv6: avoid overflow of offset in ip6_find_1stfragopt

In some cases, offset can overflow and can cause an infinite loop in
ip6_find_1stfragopt(). Make it unsigned int to prevent the overflow, and
cap it at IPV6_MAXPLEN, since packets larger than that should be invalid.

This problem has been here since before the beginning of git history.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Sabrina Dubroca

Vulnerable version (before fix):
 EXPORT_SYMBOL(ipv6_select_ident);  int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr) { 	u16 offset = sizeof(struct ipv6hdr); 	unsigned int packet_len = skb_tail_pointer(skb) - 		skb_network_header(skb); 	int found_rhdr = 0; 	*nexthdr = &ipv6_hdr(skb)->nexthdr;  	while (offset <= packet_len) { 		struct ipv6_opt_hdr *exthdr;  		switch (**nexthdr) {  int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)  		exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) + 						 offset); 		offset += ipv6_optlen(exthdr); 		*nexthdr = &exthdr->nexthdr; 	} 

Fixed version (after fix):
 EXPORT_SYMBOL(ipv6_select_ident);  int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr) { 	unsigned int offset = sizeof(struct ipv6hdr); 	unsigned int packet_len = skb_tail_pointer(skb) - 		skb_network_header(skb); 	int found_rhdr = 0; 	*nexthdr = &ipv6_hdr(skb)->nexthdr;  	while (offset <= packet_len) { 		struct ipv6_opt_hdr *exthdr; 		unsigned int len;  		switch (**nexthdr) {  int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)  		exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) + 						 offset); 		len = ipv6_optlen(exthdr); 		if (len + offset >= IPV6_MAXPLEN) 			return -EINVAL; 		offset += len; 		*nexthdr = &exthdr->nexthdr; 	} 

Patch:
patch: @@ -78,14 +78,15 @@ EXPORT_SYMBOL(ipv6_select_ident);
 
 int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 {
-	u16 offset = sizeof(struct ipv6hdr);
+	unsigned int offset = sizeof(struct ipv6hdr);
 	unsigned int packet_len = skb_tail_pointer(skb) -
 		skb_network_header(skb);
 	int found_rhdr = 0;
 	*nexthdr = &ipv6_hdr(skb)->nexthdr;
 
 	while (offset <= packet_len) {
 		struct ipv6_opt_hdr *exthdr;
+		unsigned int len;
 
 		switch (**nexthdr) {
 
@@ -111,7 +112,10 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 
 		exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
 						 offset);
-		offset += ipv6_optlen(exthdr);
+		len = ipv6_optlen(exthdr);
+		if (len + offset >= IPV6_MAXPLEN)
+			return -EINVAL;
+		offset += len;
 		*nexthdr = &exthdr->nexthdr;
 	}
path: net/ipv6/output_core.c