rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a (1) bulk-in or (2) interrupt-in endpoint.
Vulnerability ID: CVE-2016-2782
CWE: CWE-476
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2016-04-27
File: drivers/usb/serial/visor.c
Commit message: USB: visor: fix null-deref at probe

Fix null-pointer dereference at probe should a (malicious) Treo device
lack the expected endpoints.

Specifically, the Treo port-setup hack was dereferencing the bulk-in and
interrupt-in urbs without first making sure they had been allocated by
core.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Commit author: Johan Hovold

Vulnerable version (before fix):
 static int treo_attach(struct usb_serial *serial) 		(serial->num_interrupt_in == 0)) 		return 0;  	/* 	* It appears that Treos and Kyoceras want to use the 	* 1st bulk in endpoint to communicate with the 2nd bulk out endpoint,

Fixed version (after fix):
 static int treo_attach(struct usb_serial *serial) 		(serial->num_interrupt_in == 0)) 		return 0;  	if (serial->num_bulk_in < 2 || serial->num_interrupt_in < 2) { 		dev_err(&serial->interface->dev, "missing endpoints\n"); 		return -ENODEV; 	}  	/* 	* It appears that Treos and Kyoceras want to use the 	* 1st bulk in endpoint to communicate with the 2nd bulk out endpoint,

Patch:
patch: @@ -544,6 +544,11 @@ static int treo_attach(struct usb_serial *serial)
 		(serial->num_interrupt_in == 0))
 		return 0;
 
+	if (serial->num_bulk_in < 2 || serial->num_interrupt_in < 2) {
+		dev_err(&serial->interface->dev, "missing endpoints\n");
+		return -ENODEV;
+	}
+
 	/*
 	* It appears that Treos and Kyoceras want to use the
 	* 1st bulk in endpoint to communicate with the 2nd bulk out endpoint,
path: drivers/usb/serial/visor.c
Vulnerability: The mov_read_dref function in libavformat/mov.c in Libav before 11.7 and FFmpeg before 0.11 allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via the entries value in a dref box in an MP4 file.
Vulnerability ID: CVE-2016-3062
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/FFmpeg/FFmpeg
Published: 2016-06-16
File: libavformat/mov.c
Commit message: mov: reset dref_count on realloc to keep values consistent.

This fixes a potential crash.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static int mov_read_dref(MOVContext *c, AVIOContext *pb, MOVAtom atom)     if (entries >= UINT_MAX / sizeof(*sc->drefs))         return AVERROR_INVALIDDATA;     av_free(sc->drefs);     sc->drefs = av_mallocz(entries * sizeof(*sc->drefs));     if (!sc->drefs)         return AVERROR(ENOMEM);

Fixed version (after fix):
 static int mov_read_dref(MOVContext *c, AVIOContext *pb, MOVAtom atom)     if (entries >= UINT_MAX / sizeof(*sc->drefs))         return AVERROR_INVALIDDATA;     av_free(sc->drefs);     sc->drefs_count = 0;     sc->drefs = av_mallocz(entries * sizeof(*sc->drefs));     if (!sc->drefs)         return AVERROR(ENOMEM);

Patch:
patch: @@ -401,6 +401,7 @@ static int mov_read_dref(MOVContext *c, AVIOContext *pb, MOVAtom atom)
     if (entries >= UINT_MAX / sizeof(*sc->drefs))
         return AVERROR_INVALIDDATA;
     av_free(sc->drefs);
+    sc->drefs_count = 0;
     sc->drefs = av_mallocz(entries * sizeof(*sc->drefs));
     if (!sc->drefs)
         return AVERROR(ENOMEM);
path: libavformat/mov.c
Vulnerability: Multiple integer overflows in php_zip.c in the zip extension in PHP before 7.0.6 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted call to (1) getFromIndex or (2) getFromName in the ZipArchive class.
Vulnerability ID: CVE-2016-3078
CWE: CWE-190
Severity score: 6.4
Project: https://github.com/php/php-src
Published: 2016-08-07
File: ext/zip/php_zip.c
Commit message: Fix bug #71923 - integer overflow in ZipArchive::getFrom*
Commit author: Stanislav Malyshev

Vulnerable version (before fix):
 static PHP_NAMED_FUNCTION(zif_zip_entry_read) 	}  	if (zr_rsrc->zf) { 		buffer = zend_string_alloc(len, 0); 		n = zip_fread(zr_rsrc->zf, ZSTR_VAL(buffer), ZSTR_LEN(buffer)); 		if (n > 0) { 			ZSTR_VAL(buffer)[n] = '\0'; static void php_zip_get_from(INTERNAL_FUNCTION_PARAMETERS, int type) /* {{{ */ 		RETURN_FALSE; 	}  	buffer = zend_string_alloc(len, 0); 	n = zip_fread(zf, ZSTR_VAL(buffer), ZSTR_LEN(buffer)); 	if (n < 1) { 		zend_string_free(buffer);

Fixed version (after fix):
 static PHP_NAMED_FUNCTION(zif_zip_entry_read) 	}  	if (zr_rsrc->zf) { 		buffer = zend_string_safe_alloc(1, len, 0, 0); 		n = zip_fread(zr_rsrc->zf, ZSTR_VAL(buffer), ZSTR_LEN(buffer)); 		if (n > 0) { 			ZSTR_VAL(buffer)[n] = '\0'; static void php_zip_get_from(INTERNAL_FUNCTION_PARAMETERS, int type) /* {{{ */ 		RETURN_FALSE; 	}  	buffer = zend_string_safe_alloc(1, len, 0, 0); 	n = zip_fread(zf, ZSTR_VAL(buffer), ZSTR_LEN(buffer)); 	if (n < 1) { 		zend_string_free(buffer);

Patch:
patch: @@ -1281,7 +1281,7 @@ static PHP_NAMED_FUNCTION(zif_zip_entry_read)
 	}
 
 	if (zr_rsrc->zf) {
-		buffer = zend_string_alloc(len, 0);
+		buffer = zend_string_safe_alloc(1, len, 0, 0);
 		n = zip_fread(zr_rsrc->zf, ZSTR_VAL(buffer), ZSTR_LEN(buffer));
 		if (n > 0) {
 			ZSTR_VAL(buffer)[n] = '\0';
@@ -2728,7 +2728,7 @@ static void php_zip_get_from(INTERNAL_FUNCTION_PARAMETERS, int type) /* {{{ */
 		RETURN_FALSE;
 	}
 
-	buffer = zend_string_alloc(len, 0);
+	buffer = zend_string_safe_alloc(1, len, 0, 0);
 	n = zip_fread(zf, ZSTR_VAL(buffer), ZSTR_LEN(buffer));
 	if (n < 1) {
 		zend_string_free(buffer);
path: ext/zip/php_zip.c
Vulnerability: Integer overflow in the xt_alloc_table_info function in net/netfilter/x_tables.c in the Linux kernel through 4.5.2 on 32-bit platforms allows local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call.
Vulnerability ID: CVE-2016-3135
CWE: CWE-189
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2016-04-27
File: net/netfilter/x_tables.c
Commit message: netfilter: x_tables: check for size overflow

Ben Hawkes says:
 integer overflow in xt_alloc_table_info, which on 32-bit systems can
 lead to small structure allocation and a copy_from_user based heap
 corruption.

Reported-by: Ben Hawkes <hawkes@google.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Commit author: Florian Westphal

Vulnerable version (before fix):
 struct xt_table_info *xt_alloc_table_info(unsigned int size) 	struct xt_table_info *info = NULL; 	size_t sz = sizeof(*info) + size;  	/* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */ 	if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > totalram_pages) 		return NULL;

Fixed version (after fix):
 struct xt_table_info *xt_alloc_table_info(unsigned int size) 	struct xt_table_info *info = NULL; 	size_t sz = sizeof(*info) + size;  	if (sz < sizeof(*info)) 		return NULL;  	/* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */ 	if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > totalram_pages) 		return NULL;

Patch:
patch: @@ -659,6 +659,9 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size)
 	struct xt_table_info *info = NULL;
 	size_t sz = sizeof(*info) + size;
 
+	if (sz < sizeof(*info))
+		return NULL;
+
 	/* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
 	if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > totalram_pages)
 		return NULL;
path: net/netfilter/x_tables.c
Vulnerability: The processRequest function in minissdpd.c in MiniSSDPd 1.2.20130907-3 allows local users to cause a denial of service (invalid free and daemon crash) via vectors related to error handling.
Vulnerability ID: CVE-2016-3179
CWE: CWE-416
Severity score: 2.9
Project: https://github.com/miniupnp/miniupnp
Published: 2017-03-24
File: minissdpd/minissdpd.c
Commit message: minissdpd.c: Initialize pointers to NULL (fix)
Commit author: Thomas BERNARD

Vulnerable version (before fix):
 void processRequest(struct reqelem * req) 			syslog(LOG_ERR, "cannot allocate memory"); 			goto error; 		} 		if(containsForbiddenChars(p, l)) { 			syslog(LOG_ERR, "bad request (st contains forbidden chars)"); 			goto error;

Fixed version (after fix):
 void processRequest(struct reqelem * req) 			syslog(LOG_ERR, "cannot allocate memory"); 			goto error; 		} 		memset(newserv, 0, sizeof(struct service));	/* set pointers to NULL */ 		if(containsForbiddenChars(p, l)) { 			syslog(LOG_ERR, "bad request (st contains forbidden chars)"); 			goto error;

Patch:
patch: @@ -658,6 +658,7 @@ void processRequest(struct reqelem * req)
 			syslog(LOG_ERR, "cannot allocate memory");
 			goto error;
 		}
+		memset(newserv, 0, sizeof(struct service));	/* set pointers to NULL */
 		if(containsForbiddenChars(p, l)) {
 			syslog(LOG_ERR, "bad request (st contains forbidden chars)");
 			goto error;
path: minissdpd/minissdpd.c
Vulnerability: The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux kernel before 4.5.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted length value in a USB/IP packet.
Vulnerability ID: CVE-2016-3955
CWE: CWE-119
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2016-07-03
File: drivers/usb/usbip/usbip_common.c
Commit message: USB: usbip: fix potential out-of-bounds write

Fix potential out-of-bounds write to urb->transfer_buffer
usbip handles network communication directly in the kernel. When receiving a
packet from its peer, usbip code parses headers according to protocol. As
part of this parsing urb->actual_length is filled. Since the input for
urb->actual_length comes from the network, it should be treated as untrusted.
Any entity controlling the network may put any value in the input and the
preallocated urb->transfer_buffer may not be large enough to hold the data.
Thus, the malicious entity is able to write arbitrary data to kernel memory.

Signed-off-by: Ignat Korchagin <ignat.korchagin@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Commit author: Ignat Korchagin

Vulnerable version (before fix):
 int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb) 	if (!(size > 0)) 		return 0;  	ret = usbip_recv(ud->tcp_socket, urb->transfer_buffer, size); 	if (ret != size) { 		dev_err(&urb->dev->dev, "recv xbuf, %d\n", ret);

Fixed version (after fix):
 int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb) 	if (!(size > 0)) 		return 0;  	if (size > urb->transfer_buffer_length) { 		/* should not happen, probably malicious packet */ 		if (ud->side == USBIP_STUB) { 			usbip_event_add(ud, SDEV_EVENT_ERROR_TCP); 			return 0; 		} else { 			usbip_event_add(ud, VDEV_EVENT_ERROR_TCP); 			return -EPIPE; 		} 	}  	ret = usbip_recv(ud->tcp_socket, urb->transfer_buffer, size); 	if (ret != size) { 		dev_err(&urb->dev->dev, "recv xbuf, %d\n", ret);

Patch:
patch: @@ -741,6 +741,17 @@ int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb)
 	if (!(size > 0))
 		return 0;
 
+	if (size > urb->transfer_buffer_length) {
+		/* should not happen, probably malicious packet */
+		if (ud->side == USBIP_STUB) {
+			usbip_event_add(ud, SDEV_EVENT_ERROR_TCP);
+			return 0;
+		} else {
+			usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
+			return -EPIPE;
+		}
+	}
+
 	ret = usbip_recv(ud->tcp_socket, urb->transfer_buffer, size);
 	if (ret != size) {
 		dev_err(&urb->dev->dev, "recv xbuf, %d\n", ret);
path: drivers/usb/usbip/usbip_common.c
Vulnerability: Integer overflow in the read_SubStreamsInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a 7zip file with a large number of substreams, which triggers a heap-based buffer overflow.
Vulnerability ID: CVE-2016-4300
CWE: CWE-190
Severity score: 6.4
Project: https://github.com/libarchive/libarchive
Published: 2016-09-21
File: libarchive/archive_read_support_format_7zip.c
Commit message: Issue #718: Fix TALOS-CAN-152

If a 7-Zip archive declares a rediculously large number of substreams,
it can overflow an internal counter, leading a subsequent memory
allocation to be too small for the substream data.

Thanks to the Open Source and Threat Intelligence project at Cisco
for reporting this issue.
Commit author: Tim Kientzle

Vulnerable version (before fix):
 read_SubStreamsInfo(struct archive_read *a, struct _7z_substream_info *ss, 				return (-1); 			if (UMAX_ENTRY < f[i].numUnpackStreams) 				return (-1); 			unpack_streams += (size_t)f[i].numUnpackStreams; 		} 		if ((p = header_bytes(a, 1)) == NULL)

Fixed version (after fix):
 read_SubStreamsInfo(struct archive_read *a, struct _7z_substream_info *ss, 				return (-1); 			if (UMAX_ENTRY < f[i].numUnpackStreams) 				return (-1); 			if (unpack_streams > SIZE_MAX - UMAX_ENTRY) { 				return (-1); 			} 			unpack_streams += (size_t)f[i].numUnpackStreams; 		} 		if ((p = header_bytes(a, 1)) == NULL)

Patch:
patch: @@ -2153,6 +2153,9 @@ read_SubStreamsInfo(struct archive_read *a, struct _7z_substream_info *ss,
 				return (-1);
 			if (UMAX_ENTRY < f[i].numUnpackStreams)
 				return (-1);
+			if (unpack_streams > SIZE_MAX - UMAX_ENTRY) {
+				return (-1);
+			}
 			unpack_streams += (size_t)f[i].numUnpackStreams;
 		}
 		if ((p = header_bytes(a, 1)) == NULL)
path: libarchive/archive_read_support_format_7zip.c
Vulnerability: Stack-based buffer overflow in the parse_device function in archive_read_support_format_mtree.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a crafted mtree file.
Vulnerability ID: CVE-2016-4301
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/libarchive/libarchive
Published: 2016-09-21
File: libarchive/archive_read_support_format_mtree.c
Commit message: Fix libarchive/archive_read_support_format_mtree.c:1388:11: error: array subscript is above array bounds
Commit author: mfont

Vulnerable version (before fix):
 parse_device(dev_t *pdev, struct archive *a, char *val) 				    "Missing number"); 				return ARCHIVE_WARN; 			} 			numbers[argc++] = (unsigned long)mtree_atol(&p); 			if (argc > MAX_PACK_ARGS) { 				archive_set_error(a, ARCHIVE_ERRNO_FILE_FORMAT, 				    "Too many arguments"); 				return ARCHIVE_WARN; 			} 		} 		if (argc < 2) { 			archive_set_error(a, ARCHIVE_ERRNO_FILE_FORMAT,

Fixed version (after fix):
 parse_device(dev_t *pdev, struct archive *a, char *val) 				    "Missing number"); 				return ARCHIVE_WARN; 			} 			if (argc >= MAX_PACK_ARGS) { 				archive_set_error(a, ARCHIVE_ERRNO_FILE_FORMAT, 				    "Too many arguments"); 				return ARCHIVE_WARN; 			} 			numbers[argc++] = (unsigned long)mtree_atol(&p); 		} 		if (argc < 2) { 			archive_set_error(a, ARCHIVE_ERRNO_FILE_FORMAT,

Patch:
patch: @@ -1385,12 +1385,12 @@ parse_device(dev_t *pdev, struct archive *a, char *val)
 				    "Missing number");
 				return ARCHIVE_WARN;
 			}
-			numbers[argc++] = (unsigned long)mtree_atol(&p);
-			if (argc > MAX_PACK_ARGS) {
+			if (argc >= MAX_PACK_ARGS) {
 				archive_set_error(a, ARCHIVE_ERRNO_FILE_FORMAT,
 				    "Too many arguments");
 				return ARCHIVE_WARN;
 			}
+			numbers[argc++] = (unsigned long)mtree_atol(&p);
 		}
 		if (argc < 2) {
 			archive_set_error(a, ARCHIVE_ERRNO_FILE_FORMAT,
path: libarchive/archive_read_support_format_mtree.c
Vulnerability: Heap-based buffer overflow in the parse_codes function in archive_read_support_format_rar.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a RAR file with a zero-sized dictionary.
Vulnerability ID: CVE-2016-4302
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/libarchive/libarchive
Published: 2016-09-21
File: libarchive/archive_read_support_format_rar.c
Commit message: Issue 719:  Fix for TALOS-CAN-154

A RAR file with an invalid zero dictionary size was not being
rejected, leading to a zero-sized allocation for the dictionary
storage which was then overwritten during the dictionary initialization.

Thanks to the Open Source and Threat Intelligence project at Cisco for
reporting this.
Commit author: Tim Kientzle

Vulnerable version (before fix):
 parse_codes(struct archive_read *a)       rar->range_dec.Stream = &rar->bytein;       __archive_ppmd7_functions.Ppmd7_Construct(&rar->ppmd7_context);        if (!__archive_ppmd7_functions.Ppmd7_Alloc(&rar->ppmd7_context,         rar->dictionary_size, &g_szalloc))       {

Fixed version (after fix):
 parse_codes(struct archive_read *a)       rar->range_dec.Stream = &rar->bytein;       __archive_ppmd7_functions.Ppmd7_Construct(&rar->ppmd7_context);        if (rar->dictionary_size == 0) { 	      archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,                           "Invalid zero dictionary size"); 	      return (ARCHIVE_FATAL);       }        if (!__archive_ppmd7_functions.Ppmd7_Alloc(&rar->ppmd7_context,         rar->dictionary_size, &g_szalloc))       {

Patch:
patch: @@ -2127,6 +2127,12 @@ parse_codes(struct archive_read *a)
       rar->range_dec.Stream = &rar->bytein;
       __archive_ppmd7_functions.Ppmd7_Construct(&rar->ppmd7_context);
 
+      if (rar->dictionary_size == 0) {
+	      archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
+                          "Invalid zero dictionary size");
+	      return (ARCHIVE_FATAL);
+      }
+
       if (!__archive_ppmd7_functions.Ppmd7_Alloc(&rar->ppmd7_context,
         rar->dictionary_size, &g_szalloc))
       {
path: libarchive/archive_read_support_format_rar.c
Vulnerability: Session fixation vulnerability in Symphony CMS 2.6.7, when session.use_only_cookies is disabled, allows remote attackers to hijack web sessions via the PHPSESSID parameter.
Vulnerability ID: CVE-2016-4309
CWE: CWE-362
Severity score: 10
Project: https://github.com/symphonycms/symphony-2
Published: 2016-06-30
File: symphony/lib/core/class.session.php
Commit message: Better php.ini overrides for insecure setups

This change is to protect our users against a poorly setup server. PHP
can allow pretty scary things security-wise, so it's best to make sure
things that can only have one valid setting should be enforced.

Thanks to @hyp3rlinx for this.
Commit author: nitriques

Vulnerable version (before fix):
 public static function start($lifetime = 0, $path = '/', $domain = null, $httpOn              if (session_id() == '') {                 ini_set('session.save_handler', 'user');                 ini_set('session.gc_maxlifetime', $lifetime);                 ini_set('session.gc_probability', '1');                 ini_set('session.gc_divisor', Symphony::Configuration()->get('session_gc_divisor', 'symphony'));

Fixed version (after fix):
 public static function start($lifetime = 0, $path = '/', $domain = null, $httpOn              if (session_id() == '') {                 ini_set('session.save_handler', 'user');                 ini_set('session.use_trans_sid', '0');                 ini_set('session.use_strict_mode', '1');                 ini_set('session.use_only_cookies', '1');                 ini_set('session.gc_maxlifetime', $lifetime);                 ini_set('session.gc_probability', '1');                 ini_set('session.gc_divisor', Symphony::Configuration()->get('session_gc_divisor', 'symphony'));

Patch:
patch: @@ -58,6 +58,9 @@ public static function start($lifetime = 0, $path = '/', $domain = null, $httpOn
 
             if (session_id() == '') {
                 ini_set('session.save_handler', 'user');
+                ini_set('session.use_trans_sid', '0');
+                ini_set('session.use_strict_mode', '1');
+                ini_set('session.use_only_cookies', '1');
                 ini_set('session.gc_maxlifetime', $lifetime);
                 ini_set('session.gc_probability', '1');
                 ini_set('session.gc_divisor', Symphony::Configuration()->get('session_gc_divisor', 'symphony'));
path: symphony/lib/core/class.session.php
Vulnerability: Buffer overflow in the xmlrpc_char_encode function in modules/transport/xmlrpc/xmlrpclib.c in Atheme before 7.2.7 allows remote attackers to cause a denial of service via vectors related to XMLRPC response encoding.
Vulnerability ID: CVE-2016-4478
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/atheme/atheme
Published: 2016-06-13
File: modules/transport/xmlrpc/xmlrpclib.c
Commit message: Do not copy more bytes than were allocated
Commit author: Hans-Christian Esperer

Vulnerable version (before fix):
 void xmlrpc_char_encode(char *outbuffer, const char *s1) 			s->append_char(s, c); 		} 	}  	memcpy(outbuffer, s->str, XMLRPC_BUFSIZE); }  static void xmlrpc_append_char_encode(mowgli_string_t *s, const char *s1)

Fixed version (after fix):
 void xmlrpc_char_encode(char *outbuffer, const char *s1) 			s->append_char(s, c); 		} 	} 	s->append_char(s, 0);  	strncpy(outbuffer, s->str, XMLRPC_BUFSIZE); }  static void xmlrpc_append_char_encode(mowgli_string_t *s, const char *s1)

Patch:
patch: @@ -777,8 +777,9 @@ void xmlrpc_char_encode(char *outbuffer, const char *s1)
 			s->append_char(s, c);
 		}
 	}
+	s->append_char(s, 0);
 
-	memcpy(outbuffer, s->str, XMLRPC_BUFSIZE);
+	strncpy(outbuffer, s->str, XMLRPC_BUFSIZE);
 }
 
 static void xmlrpc_append_char_encode(mowgli_string_t *s, const char *s1)
path: modules/transport/xmlrpc/xmlrpclib.c
Vulnerability: The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted USBDEVFS_CONNECTINFO ioctl call.
Vulnerability ID: CVE-2016-4482
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2016-05-23
File: drivers/usb/core/devio.c
Commit message: USB: usbfs: fix potential infoleak in devio

The stack object “ci” has a total size of 8 bytes. Its last 3 bytes
are padding bytes which are not initialized and leaked to userland
via “copy_to_user”.

Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Commit author: Kangjie Lu

Vulnerable version (before fix):
 static int proc_getdriver(struct usb_dev_state *ps, void __user *arg)  static int proc_connectinfo(struct usb_dev_state *ps, void __user *arg) { 	struct usbdevfs_connectinfo ci = { 		.devnum = ps->dev->devnum, 		.slow = ps->dev->speed == USB_SPEED_LOW 	};  	if (copy_to_user(arg, &ci, sizeof(ci))) 		return -EFAULT;

Fixed version (after fix):
 static int proc_getdriver(struct usb_dev_state *ps, void __user *arg)  static int proc_connectinfo(struct usb_dev_state *ps, void __user *arg) { 	struct usbdevfs_connectinfo ci;  	memset(&ci, 0, sizeof(ci)); 	ci.devnum = ps->dev->devnum; 	ci.slow = ps->dev->speed == USB_SPEED_LOW;  	if (copy_to_user(arg, &ci, sizeof(ci))) 		return -EFAULT;

Patch:
patch: @@ -1316,10 +1316,11 @@ static int proc_getdriver(struct usb_dev_state *ps, void __user *arg)
 
 static int proc_connectinfo(struct usb_dev_state *ps, void __user *arg)
 {
-	struct usbdevfs_connectinfo ci = {
-		.devnum = ps->dev->devnum,
-		.slow = ps->dev->speed == USB_SPEED_LOW
-	};
+	struct usbdevfs_connectinfo ci;
+
+	memset(&ci, 0, sizeof(ci));
+	ci.devnum = ps->dev->devnum;
+	ci.slow = ps->dev->speed == USB_SPEED_LOW;
 
 	if (copy_to_user(arg, &ci, sizeof(ci)))
 		return -EFAULT;
path: drivers/usb/core/devio.c