rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Integer overflow in the Encode function in modules/codec/schroedinger.c in VideoLAN VLC media player before 2.1.6 and 2.2.x before 2.2.1 allows remote attackers to conduct buffer overflow attacks and execute arbitrary code via a crafted length value.
Vulnerability ID: CVE-2014-9629
CWE: CWE-120
Severity score: 6.4
Project: https://github.com/videolan/vlc
Published: 2020-01-24
File: modules/codec/schroedinger.c
Commit message: codec: schroedinger: fix potential buffer overflow.

The variable len is a raw 32 bit value read using GetDWBE. If this
value is larger than UINT32_MAX - sizeof(eos), this will cause an
integer overflow in the subsequent call to malloc, and finally a
buffer overflow when calling memcpy. We fix this by checking len
accordingly.

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
Commit author: Fabian Yamaguchi

Vulnerable version (before fix):
 static block_t *Encode( encoder_t *p_enc, picture_t *p_pic )                      * is appended to the sequence header to allow guard                      * against poor streaming servers */                     /* XXX, should this be done using the packetizer ? */                     p_enc->fmt_out.p_extra = malloc( len + sizeof( eos ) );                     if( !p_enc->fmt_out.p_extra )                         return NULL;

Fixed version (after fix):
 static block_t *Encode( encoder_t *p_enc, picture_t *p_pic )                      * is appended to the sequence header to allow guard                      * against poor streaming servers */                     /* XXX, should this be done using the packetizer ? */                      if( len > UINT32_MAX - sizeof( eos ) )                         return NULL;                      p_enc->fmt_out.p_extra = malloc( len + sizeof( eos ) );                     if( !p_enc->fmt_out.p_extra )                         return NULL;

Patch:
patch: @@ -1548,6 +1548,10 @@ static block_t *Encode( encoder_t *p_enc, picture_t *p_pic )
                      * is appended to the sequence header to allow guard
                      * against poor streaming servers */
                     /* XXX, should this be done using the packetizer ? */
+
+                    if( len > UINT32_MAX - sizeof( eos ) )
+                        return NULL;
+
                     p_enc->fmt_out.p_extra = malloc( len + sizeof( eos ) );
                     if( !p_enc->fmt_out.p_extra )
                         return NULL;
path: modules/codec/schroedinger.c
Vulnerability: The rtp_packetize_xiph_config function in modules/stream_out/rtpfmt.c in VideoLAN VLC media player before 2.1.6 uses a stack-allocation approach with a size determined by arbitrary input data, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted length value.
Vulnerability ID: CVE-2014-9630
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/videolan/vlc
Published: 2020-01-24
File: modules/stream_out/rtpfmt.c
Commit message: stream_out: rtp: don't use VLA for user controlled data

It should fix a possible invalid memory access

When streaming ogg-files via rtp, an ogg-file can trigger an invalid
write access using an overly long 'configuration' string.

The original code attemps to allocate space to hold the string on the stack
and hence, cannot verify if allocation succeeds. Instead, we now allocate the
buffer on the heap and return if allocation fails.

In detail, rtp_packetize_xiph_config allocates a buffer on the stack at (1) where
the size depends on the local variable 'len'. The variable 'len' is
calculated at (0) to be the length of a string contained in a specially
crafted Ogg Vorbis file, and therefore, it is attacker-controlled.

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
Commit author: Fabian Yamaguchi

Vulnerable version (before fix):
 int rtp_packetize_xiph_config( sout_stream_id_sys_t *id, const char *fmtp,     char *end = strchr(start, ';');     assert(end != NULL);     size_t len = end - start;     char b64[len + 1];     memcpy(b64, start, len);     b64[len] = '\0';  int rtp_packetize_xiph_config( sout_stream_id_sys_t *id, const char *fmtp,     int i_data;      i_data = vlc_b64_decode_binary(&p_orig, b64);     if (i_data <= 9)     {         free(p_orig);

Fixed version (after fix):
 int rtp_packetize_xiph_config( sout_stream_id_sys_t *id, const char *fmtp,     char *end = strchr(start, ';');     assert(end != NULL);     size_t len = end - start;      char *b64 = malloc(len + 1);     if(!b64)         return VLC_EGENERIC;      memcpy(b64, start, len);     b64[len] = '\0';  int rtp_packetize_xiph_config( sout_stream_id_sys_t *id, const char *fmtp,     int i_data;      i_data = vlc_b64_decode_binary(&p_orig, b64);     free(b64);     if (i_data <= 9)     {         free(p_orig);

Patch:
patch: @@ -559,7 +559,11 @@ int rtp_packetize_xiph_config( sout_stream_id_sys_t *id, const char *fmtp,
     char *end = strchr(start, ';');
     assert(end != NULL);
     size_t len = end - start;
-    char b64[len + 1];
+
+    char *b64 = malloc(len + 1);
+    if(!b64)
+        return VLC_EGENERIC;
+
     memcpy(b64, start, len);
     b64[len] = '\0';
 
@@ -569,6 +573,7 @@ int rtp_packetize_xiph_config( sout_stream_id_sys_t *id, const char *fmtp,
     int i_data;
 
     i_data = vlc_b64_decode_binary(&p_orig, b64);
+    free(b64);
     if (i_data <= 9)
     {
         free(p_orig);
path: modules/stream_out/rtpfmt.c
Vulnerability: Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/crypto.c in the eCryptfs subsystem in the Linux kernel before 3.18.2 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted filename.
Vulnerability ID: CVE-2014-9683
CWE: CWE-189
Severity score: 4.9
Project: https://github.com/torvalds/linux
Published: 2015-03-03
File: fs/ecryptfs/crypto.c
Commit message: eCryptfs: Remove buggy and unnecessary write in file name decode routine

Dmitry Chernenkov used KASAN to discover that eCryptfs writes past the
end of the allocated buffer during encrypted filename decoding. This
fix corrects the issue by getting rid of the unnecessary 0 write when
the current bit offset is 2.

Signed-off-by: Michael Halcrow <mhalcrow@google.com>
Reported-by: Dmitry Chernenkov <dmitryc@google.com>
Suggested-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org # v2.6.29+: 51ca58d eCryptfs: Filename Encryption: Encoding and encryption functions
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Commit author: Michael Halcrow

Vulnerable version (before fix):
 ecryptfs_decode_from_filename(unsigned char *dst, size_t *dst_size, 			break; 		case 2: 			dst[dst_byte_offset++] |= (src_byte); 			dst[dst_byte_offset] = 0; 			current_bit_offset = 0; 			break; 		}

Fixed version (after fix):
 ecryptfs_decode_from_filename(unsigned char *dst, size_t *dst_size, 			break; 		case 2: 			dst[dst_byte_offset++] |= (src_byte); 			current_bit_offset = 0; 			break; 		}

Patch:
patch: @@ -1917,7 +1917,6 @@ ecryptfs_decode_from_filename(unsigned char *dst, size_t *dst_size,
 			break;
 		case 2:
 			dst[dst_byte_offset++] |= (src_byte);
-			dst[dst_byte_offset] = 0;
 			current_bit_offset = 0;
 			break;
 		}
path: fs/ecryptfs/crypto.c
Vulnerability: The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash) via unspecified vectors related to the headindex variable.
Vulnerability ID: CVE-2014-9756
CWE: CWE-369
Severity score: 2.9
Project: https://github.com/erikd/libsndfile
Published: 2015-11-19
File: src/file_io.c
Commit message: src/file_io.c : Prevent potential divide-by-zero.

Closes: https://github.com/erikd/libsndfile/issues/92
Commit author: Erik de Castro Lopo

Vulnerable version (before fix):
 /* ** Copyright (C) 2002-2013 Erik de Castro Lopo <erikd@mega-nerd.com> ** Copyright (C) 2003 Ross Bencina <rbencina@iprimus.com.au> ** ** This program is free software; you can redistribute it and/or modify psf_fwrite (const void *ptr, sf_count_t bytes, sf_count_t items, SF_PRIVATE *psf {	sf_count_t total = 0 ; 	ssize_t	count ;  	if (psf->virtual_io) 		return psf->vio.write (ptr, bytes*items, psf->vio_user_data) / bytes ; 

Fixed version (after fix):
 /* ** Copyright (C) 2002-2014 Erik de Castro Lopo <erikd@mega-nerd.com> ** Copyright (C) 2003 Ross Bencina <rbencina@iprimus.com.au> ** ** This program is free software; you can redistribute it and/or modify psf_fwrite (const void *ptr, sf_count_t bytes, sf_count_t items, SF_PRIVATE *psf {	sf_count_t total = 0 ; 	ssize_t	count ;  	if (bytes == 0 || items == 0) 		return 0 ;  	if (psf->virtual_io) 		return psf->vio.write (ptr, bytes*items, psf->vio_user_data) / bytes ; 

Patch:
patch: @@ -1,5 +1,5 @@
 /*
-** Copyright (C) 2002-2013 Erik de Castro Lopo <erikd@mega-nerd.com>
+** Copyright (C) 2002-2014 Erik de Castro Lopo <erikd@mega-nerd.com>
 ** Copyright (C) 2003 Ross Bencina <rbencina@iprimus.com.au>
 **
 ** This program is free software; you can redistribute it and/or modify
@@ -358,6 +358,9 @@ psf_fwrite (const void *ptr, sf_count_t bytes, sf_count_t items, SF_PRIVATE *psf
 {	sf_count_t total = 0 ;
 	ssize_t	count ;
 
+	if (bytes == 0 || items == 0)
+		return 0 ;
+
 	if (psf->virtual_io)
 		return psf->vio.write (ptr, bytes*items, psf->vio_user_data) / bytes ;
path: src/file_io.c
Vulnerability: Cross-site scripting (XSS) vulnerability in the displayLogin function in html/index.php in GOsa allows remote attackers to inject arbitrary web script or HTML via the username.
Vulnerability ID: CVE-2014-9760
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/gosa-project/gosa-core
Published: 2017-02-13
File: html/index.php
Commit message: escape html entities to fix xss at the login screen


git-svn-id: https://oss.gonicus.de/repositories/gosa/trunk@21276 594d385d-05f5-0310-b6e9-bd551577e9d8
Commit author: bzapiec

Vulnerable version (before fix):
 function displayLogin()  /* Fill template with required values */ $smarty->assign ('date', gmdate("D, d M Y H:i:s")); $smarty->assign ('username', $username); $smarty->assign ('personal_img', get_template_path('images/login-head.png')); $smarty->assign ('password_img', get_template_path('images/password.png')); $smarty->assign ('directory_img', get_template_path('images/ldapserver.png'));

Fixed version (after fix):
 function displayLogin()  /* Fill template with required values */ $smarty->assign ('date', gmdate("D, d M Y H:i:s")); $smarty->assign ('username', set_post($username)); $smarty->assign ('personal_img', get_template_path('images/login-head.png')); $smarty->assign ('password_img', get_template_path('images/password.png')); $smarty->assign ('directory_img', get_template_path('images/ldapserver.png'));

Patch:
patch: @@ -388,7 +388,7 @@ function displayLogin()
 
 /* Fill template with required values */
 $smarty->assign ('date', gmdate("D, d M Y H:i:s"));
-$smarty->assign ('username', $username);
+$smarty->assign ('username', set_post($username));
 $smarty->assign ('personal_img', get_template_path('images/login-head.png'));
 $smarty->assign ('password_img', get_template_path('images/password.png'));
 $smarty->assign ('directory_img', get_template_path('images/ldapserver.png'));
path: html/index.php
Vulnerability: arch/arm/mm/dma-mapping.c in the Linux kernel before 3.13 on ARM platforms, as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, does not prevent executable DMA mappings, which might allow local users to gain privileges via a crafted application, aka Android internal bug 28803642 and Qualcomm internal bug CR642735.
Vulnerability ID: CVE-2014-9888
CWE: CWE-264
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2016-08-06
File: arch/arm/mm/dma-mapping.c
Commit message: ARM: dma-mapping: don't allow DMA mappings to be marked executable

DMA mapping permissions were being derived from pgprot_kernel directly
without using PAGE_KERNEL.  This causes them to be marked with executable
permission, which is not what we want.  Fix this.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Commit author: Russell King

Vulnerable version (before fix):
 static void *__dma_alloc(struct device *dev, size_t size, dma_addr_t *handle, void *arm_dma_alloc(struct device *dev, size_t size, dma_addr_t *handle, 		    gfp_t gfp, struct dma_attrs *attrs) { 	pgprot_t prot = __get_dma_pgprot(attrs, pgprot_kernel); 	void *memory;  	if (dma_alloc_from_coherent(dev, size, handle, &memory)) void *arm_dma_alloc(struct device *dev, size_t size, dma_addr_t *handle, static void *arm_coherent_dma_alloc(struct device *dev, size_t size, 	dma_addr_t *handle, gfp_t gfp, struct dma_attrs *attrs) { 	pgprot_t prot = __get_dma_pgprot(attrs, pgprot_kernel); 	void *memory;  	if (dma_alloc_from_coherent(dev, size, handle, &memory))

Fixed version (after fix):
 static void *__dma_alloc(struct device *dev, size_t size, dma_addr_t *handle, void *arm_dma_alloc(struct device *dev, size_t size, dma_addr_t *handle, 		    gfp_t gfp, struct dma_attrs *attrs) { 	pgprot_t prot = __get_dma_pgprot(attrs, PAGE_KERNEL); 	void *memory;  	if (dma_alloc_from_coherent(dev, size, handle, &memory)) void *arm_dma_alloc(struct device *dev, size_t size, dma_addr_t *handle, static void *arm_coherent_dma_alloc(struct device *dev, size_t size, 	dma_addr_t *handle, gfp_t gfp, struct dma_attrs *attrs) { 	pgprot_t prot = __get_dma_pgprot(attrs, PAGE_KERNEL); 	void *memory;  	if (dma_alloc_from_coherent(dev, size, handle, &memory))

Patch:
patch: @@ -687,7 +687,7 @@ static void *__dma_alloc(struct device *dev, size_t size, dma_addr_t *handle,
 void *arm_dma_alloc(struct device *dev, size_t size, dma_addr_t *handle,
 		    gfp_t gfp, struct dma_attrs *attrs)
 {
-	pgprot_t prot = __get_dma_pgprot(attrs, pgprot_kernel);
+	pgprot_t prot = __get_dma_pgprot(attrs, PAGE_KERNEL);
 	void *memory;
 
 	if (dma_alloc_from_coherent(dev, size, handle, &memory))
@@ -700,7 +700,7 @@ void *arm_dma_alloc(struct device *dev, size_t size, dma_addr_t *handle,
 static void *arm_coherent_dma_alloc(struct device *dev, size_t size,
 	dma_addr_t *handle, gfp_t gfp, struct dma_attrs *attrs)
 {
-	pgprot_t prot = __get_dma_pgprot(attrs, pgprot_kernel);
+	pgprot_t prot = __get_dma_pgprot(attrs, PAGE_KERNEL);
 	void *memory;
 
 	if (dma_alloc_from_coherent(dev, size, handle, &memory))
path: arch/arm/mm/dma-mapping.c
Vulnerability: drivers/media/media-device.c in the Linux kernel before 3.11, as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, does not properly initialize certain data structures, which allows local users to obtain sensitive information via a crafted application, aka Android internal bug 28750150 and Qualcomm internal bug CR570757, a different vulnerability than CVE-2014-1739.
Vulnerability ID: CVE-2014-9895
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2016-08-06
File: drivers/media/media-device.c
Commit message: [media] media: info leak in __media_device_enum_links()

These structs have holes and reserved struct members which aren't
cleared.  I've added a memset() so we don't leak stack information.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Commit author: Dan Carpenter

Vulnerable version (before fix):
 static long __media_device_enum_links(struct media_device *mdev,  		for (p = 0; p < entity->num_pads; p++) { 			struct media_pad_desc pad; 			media_device_kpad_to_upad(&entity->pads[p], &pad); 			if (copy_to_user(&links->pads[p], &pad, sizeof(pad))) 				return -EFAULT; static long __media_device_enum_links(struct media_device *mdev, 			if (entity->links[l].source->entity != entity) 				continue;  			media_device_kpad_to_upad(entity->links[l].source, 						  &link.source); 			media_device_kpad_to_upad(entity->links[l].sink,

Fixed version (after fix):
 static long __media_device_enum_links(struct media_device *mdev,  		for (p = 0; p < entity->num_pads; p++) { 			struct media_pad_desc pad;  			memset(&pad, 0, sizeof(pad)); 			media_device_kpad_to_upad(&entity->pads[p], &pad); 			if (copy_to_user(&links->pads[p], &pad, sizeof(pad))) 				return -EFAULT; static long __media_device_enum_links(struct media_device *mdev, 			if (entity->links[l].source->entity != entity) 				continue;  			memset(&link, 0, sizeof(link)); 			media_device_kpad_to_upad(entity->links[l].source, 						  &link.source); 			media_device_kpad_to_upad(entity->links[l].sink,

Patch:
patch: @@ -142,6 +142,8 @@ static long __media_device_enum_links(struct media_device *mdev,
 
 		for (p = 0; p < entity->num_pads; p++) {
 			struct media_pad_desc pad;
+
+			memset(&pad, 0, sizeof(pad));
 			media_device_kpad_to_upad(&entity->pads[p], &pad);
 			if (copy_to_user(&links->pads[p], &pad, sizeof(pad)))
 				return -EFAULT;
@@ -159,6 +161,7 @@ static long __media_device_enum_links(struct media_device *mdev,
 			if (entity->links[l].source->entity != entity)
 				continue;
 
+			memset(&link, 0, sizeof(link));
 			media_device_kpad_to_upad(entity->links[l].source,
 						  &link.source);
 			media_device_kpad_to_upad(entity->links[l].sink,
path: drivers/media/media-device.c
Vulnerability: The sched_read_attr function in kernel/sched/core.c in the Linux kernel 3.14-rc before 3.14-rc4 uses an incorrect size, which allows local users to obtain sensitive information from kernel stack memory via a crafted sched_getattr system call.
Vulnerability ID: CVE-2014-9903
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2016-06-27
File: kernel/sched/core.c
Commit message: sched: Fix information leak in sys_sched_getattr()

We're copying the on-stack structure to userspace, but forgot to give
the right number of bytes to copy. This allows the calling process to
obtain up to PAGE_SIZE bytes from the stack (and possibly adjacent
kernel memory).

This fix copies only as much as we actually have on the stack
(attr->size defaults to the size of the struct) and leaves the rest of
the userspace-provided buffer untouched.

Found using kmemcheck + trinity.

Fixes: d50dde5a10f30 ("sched: Add new scheduler syscalls to support an extended scheduling parameters ABI")
Cc: Dario Faggioli <raistlin@linux.it>
Cc: Juri Lelli <juri.lelli@gmail.com>
Cc: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/1392585857-10725-1-git-send-email-vegard.nossum@oracle.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Commit author: Vegard Nossum

Vulnerable version (before fix):
 static int sched_read_attr(struct sched_attr __user *uattr, 		attr->size = usize; 	}  	ret = copy_to_user(uattr, attr, usize); 	if (ret) 		return -EFAULT; 

Fixed version (after fix):
 static int sched_read_attr(struct sched_attr __user *uattr, 		attr->size = usize; 	}  	ret = copy_to_user(uattr, attr, attr->size); 	if (ret) 		return -EFAULT; 

Patch:
patch: @@ -3786,7 +3786,7 @@ static int sched_read_attr(struct sched_attr __user *uattr,
 		attr->size = usize;
 	}
 
-	ret = copy_to_user(uattr, attr, usize);
+	ret = copy_to_user(uattr, attr, attr->size);
 	if (ret)
 		return -EFAULT;
path: kernel/sched/core.c
Vulnerability: The regulator_ena_gpio_free function in drivers/regulator/core.c in the Linux kernel before 3.19 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted application.
Vulnerability ID: CVE-2014-9940
CWE: CWE-416
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2017-05-02
File: drivers/regulator/core.c
Commit message: regulator: core: Fix regualtor_ena_gpio_free not to access pin after freeing

After freeing pin from regulator_ena_gpio_free, loop can access
the pin. So this patch fixes not to access pin after freeing.

Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Commit author: Seung-Woo Kim

Vulnerable version (before fix):
 static void regulator_ena_gpio_free(struct regulator_dev *rdev) 				gpiod_put(pin->gpiod); 				list_del(&pin->list); 				kfree(pin); 			} else { 				pin->request_count--; 			}

Fixed version (after fix):
 static void regulator_ena_gpio_free(struct regulator_dev *rdev) 				gpiod_put(pin->gpiod); 				list_del(&pin->list); 				kfree(pin); 				rdev->ena_pin = NULL; 				return; 			} else { 				pin->request_count--; 			}

Patch:
patch: @@ -1713,6 +1713,8 @@ static void regulator_ena_gpio_free(struct regulator_dev *rdev)
 				gpiod_put(pin->gpiod);
 				list_del(&pin->list);
 				kfree(pin);
+				rdev->ena_pin = NULL;
+				return;
 			} else {
 				pin->request_count--;
 			}
path: drivers/regulator/core.c
Vulnerability: Multiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser.php in Collabtive before 2.1 allow remote authenticated users to execute arbitrary code by uploading a file with a (1) .php3, (2) .php4, (3) .php5, or (4) .phtml extension.
Vulnerability ID: CVE-2015-0258
CWE: CWE-434
Severity score: 6.4
Project: https://github.com/philippK-de/Collabtive
Published: 2020-02-17
File: manageuser.php
Commit message: fix code execution filter

in avatar upload
Commit author: Philipp Kiszka

Vulnerable version (before fix):
             die();         }         // don't upload php scripts         if ($erweiterung == "php" or $erweiterung == "pl") {             $loc = $url . "manageuser.php?action=profile&id=$userid";             header("Location: $loc");             die();

Fixed version (after fix):
             die();         }         // don't upload php scripts         if (stristr($erweiterung,"php") or $erweiterung == "pl") {             $loc = $url . "manageuser.php?action=profile&id=$userid";             header("Location: $loc");             die();

Patch:
patch: @@ -151,7 +151,7 @@
             die();
         }
         // don't upload php scripts
-        if ($erweiterung == "php" or $erweiterung == "pl") {
+        if (stristr($erweiterung,"php") or $erweiterung == "pl") {
             $loc = $url . "manageuser.php?action=profile&id=$userid";
             header("Location: $loc");
             die();
path: manageuser.php