rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The OUGC Feedback plugin before 1.8.23 for MyBB allows XSS via the comment field of feedback during an edit operation.
Vulnerability ID: CVE-2021-28115
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/Sama34/OUGC-Feedback
Published: 2021-03-09
File: Upload/feedback.php
Commit message: XSS on edit

https://community.mybb.com/user-120436.html
Commit author: Omar Gonzalez

Vulnerable version (before fix):
 	{ 		$mybb->input['comment'] = $feedback['comment'];  		eval('$comment_row = "'.$templates->get('ougcfeedback_form_comment', 1, 0).'";'); 	} 

Fixed version (after fix):
 	{ 		$mybb->input['comment'] = $feedback['comment'];  		$mybb->input['comment'] = htmlspecialchars_uni($mybb->input['comment']);  		eval('$comment_row = "'.$templates->get('ougcfeedback_form_comment', 1, 0).'";'); 	} 

Patch:
patch: @@ -370,6 +370,8 @@
 	{
 		$mybb->input['comment'] = $feedback['comment'];
 
+		$mybb->input['comment'] = htmlspecialchars_uni($mybb->input['comment']);
+
 		eval('$comment_row = "'.$templates->get('ougcfeedback_form_comment', 1, 0).'";');
 	}
path: Upload/feedback.php
Vulnerability: web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a different origin.
Vulnerability ID: CVE-2021-28379
CWE: CWE-434
Severity score: 6.4
Project: https://github.com/myvesta/vesta
Published: 2021-03-15
File: web/upload/UploadHandler.php
Commit message: Preventing uploads from other origin

Credits to:  Fady Othman, Security Consultant # ZINAD IT
Commit author: myvesta

Vulnerable version (before fix):
  //session_start();  include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");  // Check login_as feature

Fixed version (after fix):
  //session_start();  $hostname = exec('hostname'); $port = $_SERVER['SERVER_PORT']; $expected_http_origin="https://".$hostname.":".$port; if ($_SERVER['HTTP_ORIGIN'] != $expected_http_origin) {     die ("Nope."); }  include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");  // Check login_as feature

Patch:
patch: @@ -2,6 +2,13 @@
 
 //session_start();
 
+$hostname = exec('hostname');
+$port = $_SERVER['SERVER_PORT'];
+$expected_http_origin="https://".$hostname.":".$port;
+if ($_SERVER['HTTP_ORIGIN'] != $expected_http_origin) {
+    die ("Nope.");
+}
+
 include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 
 // Check login_as feature
path: web/upload/UploadHandler.php
Vulnerability: In Deark before 1.5.8, a specially crafted input file can cause a NULL pointer dereference in the dbuf_write function (src/deark-dbuf.c).
Vulnerability ID: CVE-2021-28855
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/jsummers/deark
Published: 2021-04-14
File: modules/pict.c
Commit message: pict: Fixed a bug with ICC profile extraction

Could cause a NULL pointer dereference.

Found by F. Çelik.
Commit author: Jason Summers

Vulnerable version (before fix):
 static void do_iccprofile_item(deark *c, lctx *d, i64 pos, i64 len) 	if(selector==0 || selector==1) { 		// Beginning and Continuation segments normally have profile data. 		// End segments (selector==2) are not allowed to include data. 		dbuf_copy(c->infile, pos+4, data_len, d->iccprofile_file); 	} }

Fixed version (after fix):
 static void do_iccprofile_item(deark *c, lctx *d, i64 pos, i64 len) 	if(selector==0 || selector==1) { 		// Beginning and Continuation segments normally have profile data. 		// End segments (selector==2) are not allowed to include data.  		if(!d->iccprofile_file) { 			de_warn(c, "Bad ICC profile segment"); 			return; 		} 		dbuf_copy(c->infile, pos+4, data_len, d->iccprofile_file); 	} }

Patch:
patch: @@ -660,6 +660,11 @@ static void do_iccprofile_item(deark *c, lctx *d, i64 pos, i64 len)
 	if(selector==0 || selector==1) {
 		// Beginning and Continuation segments normally have profile data.
 		// End segments (selector==2) are not allowed to include data.
+
+		if(!d->iccprofile_file) {
+			de_warn(c, "Bad ICC profile segment");
+			return;
+		}
 		dbuf_copy(c->infile, pos+4, data_len, d->iccprofile_file);
 	}
 }
path: modules/pict.c
Vulnerability: In Deark before v1.5.8, a specially crafted input file can cause a division by zero in (src/fmtutil.c) because of the value of pixelsize.
Vulnerability ID: CVE-2021-28856
CWE: CWE-369
Severity score: 2.9
Project: https://github.com/jsummers/deark
Published: 2021-04-14
File: src/fmtutil.c
Commit message: pict,macrsrc: Fixed a bug that could cause division by 0

Found by F. Çelik.
Commit author: Jason Summers

Vulnerable version (before fix):
 void fmtutil_macbitmap_read_pixmap_only_fields(deark *c, dbuf *f, struct fmtutil 	de_dbg(c, "pixel type=%d, bits/pixel=%d, components/pixel=%d, bits/comp=%d", 		(int)bi->pixeltype, (int)bi->pixelsize, (int)bi->cmpcount, (int)bi->cmpsize);  	bi->pdwidth = (bi->rowbytes*8)/bi->pixelsize; 	if(bi->pdwidth < bi->npwidth) { 		bi->pdwidth = bi->npwidth; 	}

Fixed version (after fix):
 void fmtutil_macbitmap_read_pixmap_only_fields(deark *c, dbuf *f, struct fmtutil 	de_dbg(c, "pixel type=%d, bits/pixel=%d, components/pixel=%d, bits/comp=%d", 		(int)bi->pixeltype, (int)bi->pixelsize, (int)bi->cmpcount, (int)bi->cmpsize);  	if(bi->pixelsize>0) { 		bi->pdwidth = (bi->rowbytes*8)/bi->pixelsize; 	} 	if(bi->pdwidth < bi->npwidth) { 		bi->pdwidth = bi->npwidth; 	}

Patch:
patch: @@ -1618,7 +1618,9 @@ void fmtutil_macbitmap_read_pixmap_only_fields(deark *c, dbuf *f, struct fmtutil
 	de_dbg(c, "pixel type=%d, bits/pixel=%d, components/pixel=%d, bits/comp=%d",
 		(int)bi->pixeltype, (int)bi->pixelsize, (int)bi->cmpcount, (int)bi->cmpsize);
 
-	bi->pdwidth = (bi->rowbytes*8)/bi->pixelsize;
+	if(bi->pixelsize>0) {
+		bi->pdwidth = (bi->rowbytes*8)/bi->pixelsize;
+	}
 	if(bi->pdwidth < bi->npwidth) {
 		bi->pdwidth = bi->npwidth;
 	}
path: src/fmtutil.c
Vulnerability: SerenityOS fixed as of c9f25bca048443e317f1994ba9b106f2386688c3 contains a buffer overflow vulnerability in LibTextCode through opening a crafted file.
Vulnerability ID: CVE-2021-28874
CWE: CWE-120
Severity score: 6.4
Project: https://github.com/SerenityOS/serenity
Published: 2021-04-06
File: Userland/Libraries/LibTextCodec/Decoder.cpp
Commit message: LibTextCodec: Make UTF16BEDecoder read only up to an even offset

Reading up to the end of the input string of odd length results in
an out-of-bounds read
Commit author: Idan Horowitz

Vulnerable version (before fix):
 String UTF8Decoder::to_utf8(const StringView& input) String UTF16BEDecoder::to_utf8(const StringView& input) {     StringBuilder builder(input.length() / 2);     for (size_t i = 0; i < input.length(); i += 2) {         u16 code_point = (input[i] << 8) | input[i + 1];         builder.append_code_point(code_point);     }

Fixed version (after fix):
 String UTF8Decoder::to_utf8(const StringView& input) String UTF16BEDecoder::to_utf8(const StringView& input) {     StringBuilder builder(input.length() / 2);     size_t utf16_length = input.length() - (input.length() % 2);     for (size_t i = 0; i < utf16_length; i += 2) {         u16 code_point = (input[i] << 8) | input[i + 1];         builder.append_code_point(code_point);     }

Patch:
patch: @@ -183,7 +183,8 @@ String UTF8Decoder::to_utf8(const StringView& input)
 String UTF16BEDecoder::to_utf8(const StringView& input)
 {
     StringBuilder builder(input.length() / 2);
-    for (size_t i = 0; i < input.length(); i += 2) {
+    size_t utf16_length = input.length() - (input.length() % 2);
+    for (size_t i = 0; i < utf16_length; i += 2) {
         u16 code_point = (input[i] << 8) | input[i + 1];
         builder.append_code_point(code_point);
     }
path: Userland/Libraries/LibTextCodec/Decoder.cpp
Vulnerability: HedgeDoc (formerly known as CodiMD) is an open-source collaborative markdown editor. An attacker is able to receive arbitrary files from the file system when exporting a note to PDF. Since the code injection has to take place as note content, there fore this exploit requires the attackers ability to modify a note. This will affect all instances, which have pdf export enabled. This issue has been fixed by https://github.com/hedgedoc/hedgedoc/commit/c1789474020a6d668d616464cb2da5e90e123f65 and is available in version 1.5.0. Starting the CodiMD/HedgeDoc instance with `CMD_ALLOW_PDF_EXPORT=false` or set `"allowPDFExport": false` in config.json can mitigate this issue for those who cannot upgrade. This exploit works because while PhantomJS doesn't actually render the `file:///` references to the PDF file itself, it still uses them internally, and exfiltration is possible, and easy through JavaScript rendering. The impact is pretty bad, as the attacker is able to read the CodiMD/HedgeDoc `config.json` file as well any other files on the filesystem. Even though the suggested Docker deploy option doesn't have many interesting files itself, the `config.json` still often contains sensitive information, database credentials, and maybe OAuth secrets among other things.
Vulnerability ID: CVE-2021-29475
CWE: CWE-94
Severity score: 4.9
Project: https://github.com/hedgedoc/hedgedoc
Published: 2021-04-26
File: lib/config/index.js
Commit message: Disable PDF export due to security issue

As a temporary fix, to keep you and your users save, this patch disables
the PDF export feature. Details of the attack along with a fix for
future versions of CodiMD will be released in future.

I hope you can live with this solution for this release because I'm
super short on time and the alternative would be to ship no fix at all.
This appears to be the better solution for this release.

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Commit author: Sheogorath

Vulnerable version (before fix):
 switch (config.imageUploadType) {     ] }  // generate correct path config.sslCAPath.forEach(function (capath, i, array) {   array[i] = path.resolve(appRootPath, capath)

Fixed version (after fix):
 switch (config.imageUploadType) {     ] }  // Disable PDF export due to security issue if (config.allowPDFExport) {   config.allowPDFExport = false   logger.warn('PDF export was disabled for this release to mitigate a critical security issue. This feature will hopefully become available again in future releases.') }  // generate correct path config.sslCAPath.forEach(function (capath, i, array) {   array[i] = path.resolve(appRootPath, capath)

Patch:
patch: @@ -189,6 +189,12 @@ switch (config.imageUploadType) {
     ]
 }
 
+// Disable PDF export due to security issue
+if (config.allowPDFExport) {
+  config.allowPDFExport = false
+  logger.warn('PDF export was disabled for this release to mitigate a critical security issue. This feature will hopefully become available again in future releases.')
+}
+
 // generate correct path
 config.sslCAPath.forEach(function (capath, i, array) {
   array[i] = path.resolve(appRootPath, capath)
path: lib/config/index.js
Vulnerability: ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through the ManageWiki variable to all users. This has been patched by https://github.com/miraheze/ManageWiki/compare/99f3b2c8af18...befb83c66f5b.patch. If you are unable to patch set `$wgAPIListModules['wikiconfig'] = 'ApiQueryDisabled';` or remove private config as a workaround.
Vulnerability ID: CVE-2021-29483
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/miraheze/ManageWiki
Published: 2021-04-28
File: includes/api/ApiQueryWikiConfig.php
Commit message: Merge pull request from GHSA-jmc9-rv2f-g8vv

The ManageWiki API currently allows viewing of sensitive information set as visible to only ManageWiki right users, such as Discord and Slack webhooks. This fixes it by adding a check to the API, to hide it if the config has set `$wgManageWikiSettings[SETTING]['requires']['visibility']['permissions']` so information on sensitive settings are never displayed via the API.

See https://phabricator.miraheze.org/T7213
Commit author: Universal Omega

Vulnerable version (before fix):
 <?php class ApiQueryWikiConfig extends ApiQueryBase { 	public function __construct( $query, $moduleName ) { 		parent::__construct( $query, $moduleName, 'wcf' ); public function execute() { 			$mwSet = new ManageWikiSettings( $wiki ); 			if ( isset( $prop['settings'] ) ) { 				$wikiData['settings'] = $mwSet->list(); 			}  			$mwExt = new ManageWikiExtensions( $wiki );

Fixed version (after fix):
 <?php  use MediaWiki\MediaWikiServices;  class ApiQueryWikiConfig extends ApiQueryBase { 	public function __construct( $query, $moduleName ) { 		parent::__construct( $query, $moduleName, 'wcf' ); public function execute() { 			$mwSet = new ManageWikiSettings( $wiki ); 			if ( isset( $prop['settings'] ) ) { 				$wikiData['settings'] = $mwSet->list(); 				 				$config = MediaWikiServices::getInstance()->getConfigFactory()->makeConfig( 'managewiki' ); 	 				foreach ( $config->get( 'ManageWikiSettings' ) as $setting => $options ) { 					if ( isset( $options['requires']['visibility']['permissions'] ) ) { 						unset( $wikiData['settings'][$setting] ); 					} 				} 			}  			$mwExt = new ManageWikiExtensions( $wiki );

Patch:
patch: @@ -1,4 +1,7 @@
 <?php
+
+use MediaWiki\MediaWikiServices;
+
 class ApiQueryWikiConfig extends ApiQueryBase {
 	public function __construct( $query, $moduleName ) {
 		parent::__construct( $query, $moduleName, 'wcf' );
@@ -31,6 +34,14 @@ public function execute() {
 			$mwSet = new ManageWikiSettings( $wiki );
 			if ( isset( $prop['settings'] ) ) {
 				$wikiData['settings'] = $mwSet->list();
+				
+				$config = MediaWikiServices::getInstance()->getConfigFactory()->makeConfig( 'managewiki' );
+	
+				foreach ( $config->get( 'ManageWikiSettings' ) as $setting => $options ) {
+					if ( isset( $options['requires']['visibility']['permissions'] ) ) {
+						unset( $wikiData['settings'][$setting] );
+					}
+				}
 			}
 
 			$mwExt = new ManageWikiExtensions( $wiki );
path: includes/api/ApiQueryWikiConfig.php
Vulnerability: There is a Null Pointer Dereference in function filter_core/filter_pck.c:gf_filter_pck_new_alloc_internal in GPAC 1.0.1. The pid comes from function av1dmx_parse_flush_sample, the ctx.opid maybe NULL. The result is a crash in gf_filter_pck_new_alloc_internal.
Vulnerability ID: CVE-2021-30015
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2021-04-19
File: src/filters/reframe_av1.c
Commit message: fixed #1719
Commit author: jeanlf

Vulnerable version (before fix):
 static GF_Err av1dmx_parse_flush_sample(GF_Filter *filter, GF_AV1DmxCtx *ctx) 	GF_FilterPacket *pck; 	u8 *output;  	gf_bs_get_content_no_truncate(ctx->state.bs, &ctx->state.frame_obus, &pck_size, &ctx->state.frame_obus_alloc);  	if (!pck_size) {

Fixed version (after fix):
 static GF_Err av1dmx_parse_flush_sample(GF_Filter *filter, GF_AV1DmxCtx *ctx) 	GF_FilterPacket *pck; 	u8 *output;  	if (!ctx->opid) 		return GF_NON_COMPLIANT_BITSTREAM; 		 	gf_bs_get_content_no_truncate(ctx->state.bs, &ctx->state.frame_obus, &pck_size, &ctx->state.frame_obus_alloc);  	if (!pck_size) {

Patch:
patch: @@ -739,6 +739,9 @@ static GF_Err av1dmx_parse_flush_sample(GF_Filter *filter, GF_AV1DmxCtx *ctx)
 	GF_FilterPacket *pck;
 	u8 *output;
 
+	if (!ctx->opid)
+		return GF_NON_COMPLIANT_BITSTREAM;
+		
 	gf_bs_get_content_no_truncate(ctx->state.bs, &ctx->state.frame_obus, &pck_size, &ctx->state.frame_obus_alloc);
 
 	if (!pck_size) {
path: src/filters/reframe_av1.c
Vulnerability: In the adts_dmx_process function in filters/reframe_adts.c in GPAC 1.0.1, a crafted file may cause ctx->hdr.frame_size to be smaller than ctx->hdr.hdr_size, resulting in size to be a negative number and a heap overflow in the memcpy.
Vulnerability ID: CVE-2021-30019
CWE: CWE-787
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2021-04-19
File: src/filters/reframe_adts.c
Commit message: fixed potential crash in adts reframer with broken streams - cf #1723
Commit author: jeanlf

Vulnerable version (before fix):
 GF_Err adts_dmx_process(GF_Filter *filter) 			break; 		}  		adts_dmx_check_pid(filter, ctx);  		if (!ctx->is_playing) {

Fixed version (after fix):
 GF_Err adts_dmx_process(GF_Filter *filter) 			break; 		}  		if (ctx->hdr.frame_size < ctx->hdr.hdr_size) { 			GF_LOG(GF_LOG_WARNING, GF_LOG_PARSER, ("[ADTSDmx] Corrupted ADTS frame header, resyncing\n")); 			ctx->nb_frames = 0; 			goto drop_byte; 		}  		adts_dmx_check_pid(filter, ctx);  		if (!ctx->is_playing) {

Patch:
patch: @@ -745,6 +745,12 @@ GF_Err adts_dmx_process(GF_Filter *filter)
 			break;
 		}
 
+		if (ctx->hdr.frame_size < ctx->hdr.hdr_size) {
+			GF_LOG(GF_LOG_WARNING, GF_LOG_PARSER, ("[ADTSDmx] Corrupted ADTS frame header, resyncing\n"));
+			ctx->nb_frames = 0;
+			goto drop_byte;
+		}
+
 		adts_dmx_check_pid(filter, ctx);
 
 		if (!ctx->is_playing) {
path: src/filters/reframe_adts.c
Vulnerability: In filters/reframe_latm.c in GPAC 1.0.1 there is a Null Pointer Dereference, when gf_filter_pck_get_data is called. The first arg pck may be null with a crafted mp4 file,which results in a crash.
Vulnerability ID: CVE-2021-30199
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2021-04-19
File: src/filters/reframe_latm.c
Commit message: fixed #1728
Commit author: jeanlf

Vulnerable version (before fix):
 GF_Err latm_dmx_process(GF_Filter *filter) 	GF_LATMDmxCtx *ctx = gf_filter_get_udta(filter); 	GF_FilterPacket *pck, *dst_pck; 	u32 pos; 	u8 *data, *output; 	u32 pck_size, prev_pck_size; 	u64 cts = GF_FILTER_NO_TS;  	if (ctx->in_error) GF_Err latm_dmx_process(GF_Filter *filter) 		} else { 			return GF_OK; 		} 	}  	data = (char *) gf_filter_pck_get_data(pck, &pck_size);  	//input pid sets some timescale - we flushed pending data , update cts 	if (ctx->timescale && pck) { 		cts = gf_filter_pck_get_cts(pck);

Fixed version (after fix):
 GF_Err latm_dmx_process(GF_Filter *filter) 	GF_LATMDmxCtx *ctx = gf_filter_get_udta(filter); 	GF_FilterPacket *pck, *dst_pck; 	u32 pos; 	u8 *data=NULL, *output; 	u32 pck_size=0, prev_pck_size; 	u64 cts = GF_FILTER_NO_TS;  	if (ctx->in_error) GF_Err latm_dmx_process(GF_Filter *filter) 		} else { 			return GF_OK; 		} 	} else { 		data = (char *) gf_filter_pck_get_data(pck, &pck_size); 	}  	//input pid sets some timescale - we flushed pending data , update cts 	if (ctx->timescale && pck) { 		cts = gf_filter_pck_get_cts(pck);

Patch:
patch: @@ -448,8 +448,8 @@ GF_Err latm_dmx_process(GF_Filter *filter)
 	GF_LATMDmxCtx *ctx = gf_filter_get_udta(filter);
 	GF_FilterPacket *pck, *dst_pck;
 	u32 pos;
-	u8 *data, *output;
-	u32 pck_size, prev_pck_size;
+	u8 *data=NULL, *output;
+	u32 pck_size=0, prev_pck_size;
 	u64 cts = GF_FILTER_NO_TS;
 
 	if (ctx->in_error)
@@ -475,10 +475,10 @@ GF_Err latm_dmx_process(GF_Filter *filter)
 		} else {
 			return GF_OK;
 		}
+	} else {
+		data = (char *) gf_filter_pck_get_data(pck, &pck_size);
 	}
 
-	data = (char *) gf_filter_pck_get_data(pck, &pck_size);
-
 	//input pid sets some timescale - we flushed pending data , update cts
 	if (ctx->timescale && pck) {
 		cts = gf_filter_pck_get_cts(pck);
path: src/filters/reframe_latm.c
Vulnerability: samurai 1.2 has a NULL pointer dereference in writefile() in util.c via a crafted build file.
Vulnerability ID: CVE-2021-30218
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/michaelforney/samurai
Published: 2021-04-29
File: util.c
Commit message: util: Check for NULL string in writefile

This check was there previously, but was removed in f549b757 with
the addition of a check during parse that every rule has rspfile
if and only if it has rspfile_content. However, this fails to
consider the possibility of those variables coming from the edge
or global environment. So, re-add the check.

Fixes #67.
Commit author: Michael Forney

Vulnerable version (before fix):
 writefile(const char *name, struct string *s) 		return -1; 	} 	ret = 0; 	if (fwrite(s->s, 1, s->n, f) != s->n || fflush(f) != 0) { 		warn("write %s:", name); 		ret = -1; 	}

Fixed version (after fix):
 writefile(const char *name, struct string *s) 		return -1; 	} 	ret = 0; 	if (s && (fwrite(s->s, 1, s->n, f) != s->n || fflush(f) != 0)) { 		warn("write %s:", name); 		ret = -1; 	}

Patch:
patch: @@ -258,7 +258,7 @@ writefile(const char *name, struct string *s)
 		return -1;
 	}
 	ret = 0;
-	if (fwrite(s->s, 1, s->n, f) != s->n || fflush(f) != 0) {
+	if (s && (fwrite(s->s, 1, s->n, f) != s->n || fflush(f) != 0)) {
 		warn("write %s:", name);
 		ret = -1;
 	}
path: util.c
Vulnerability: samurai 1.2 has a NULL pointer dereference in printstatus() function in build.c via a crafted build file.
Vulnerability ID: CVE-2021-30219
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/michaelforney/samurai
Published: 2021-04-29
File: parse.c
Commit message: parse: Check for non-empty command/rspfile/rspfile_content

This matches ninja behavior and prevents the possibility of a rule
with an empty (NULL) command string.

Fixes #68.
Commit author: Michael Forney

Vulnerable version (before fix):
 parserule(struct scanner *s, struct environment *env) 		var = scanname(s); 		parselet(s, &val); 		ruleaddvar(r, var, val); 		if (strcmp(var, "command") == 0) 			hascommand = true; 		else if (strcmp(var, "rspfile") == 0)

Fixed version (after fix):
 parserule(struct scanner *s, struct environment *env) 		var = scanname(s); 		parselet(s, &val); 		ruleaddvar(r, var, val); 		if (!val) 			continue; 		if (strcmp(var, "command") == 0) 			hascommand = true; 		else if (strcmp(var, "rspfile") == 0)

Patch:
patch: @@ -42,6 +42,8 @@ parserule(struct scanner *s, struct environment *env)
 		var = scanname(s);
 		parselet(s, &val);
 		ruleaddvar(r, var, val);
+		if (!val)
+			continue;
 		if (strcmp(var, "command") == 0)
 			hascommand = true;
 		else if (strcmp(var, "rspfile") == 0)
path: parse.c
Vulnerability: An assertion abort was found in upx MemBuffer::alloc() in mem.cpp, in version UPX 4.0.0. The flow allows attackers to cause a denial of service (abort) via a crafted file.
Vulnerability ID: CVE-2021-30501
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/upx/upx
Published: 2021-05-27
File: src/p_mach.cpp
Commit message: Merge pull request #487 from chibataiki/devel

Complain when Mach_header.sizeofcmds == 0

https://github.com/upx/upx/pull/487
Commit author: John Reiser

Vulnerable version (before fix):
 int PackMachBase<T>::canUnpack()     if (2048 < headway) {         infoWarning("Mach_header.sizeofcmds(%d) > 2048", headway);     }     rawmseg_buf.alloc(mhdri.sizeofcmds);     rawmseg = (Mach_segment_command *)rawmseg_buf.getVoidPtr();     fi->readx(rawmseg, mhdri.sizeofcmds);

Fixed version (after fix):
 int PackMachBase<T>::canUnpack()     if (2048 < headway) {         infoWarning("Mach_header.sizeofcmds(%d) > 2048", headway);     }     if(!headway){         throwCantPack("Mach_header.sizeofcmds == 0");     }     rawmseg_buf.alloc(mhdri.sizeofcmds);     rawmseg = (Mach_segment_command *)rawmseg_buf.getVoidPtr();     fi->readx(rawmseg, mhdri.sizeofcmds);

Patch:
patch: @@ -1552,6 +1552,9 @@ int PackMachBase<T>::canUnpack()
     if (2048 < headway) {
         infoWarning("Mach_header.sizeofcmds(%d) > 2048", headway);
     }
+    if(!headway){
+        throwCantPack("Mach_header.sizeofcmds == 0");
+    }
     rawmseg_buf.alloc(mhdri.sizeofcmds);
     rawmseg = (Mach_segment_command *)rawmseg_buf.getVoidPtr();
     fi->readx(rawmseg, mhdri.sizeofcmds);
path: src/p_mach.cpp