rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused.
Vulnerability ID: CVE-2019-8906
CWE: CWE-125
Severity score: 4.9
Project: https://github.com/file/file
Published: 2019-02-18
File: src/readelf.c
Commit message: Avoid OOB read (found by ASAN reported by F. Alonso)
Commit author: Christos Zoulas

Vulnerable version (before fix):
 #include "file.h"  #ifndef lint FILE_RCSID("@(#)$File: readelf.c,v 1.156 2018/10/19 00:33:04 christos Exp $") #endif  #ifdef BUILTIN_ELF do_core_note(struct magic_set *ms, unsigned char *nbuf, uint32_t type, 			char sbuf[512]; 			struct NetBSD_elfcore_procinfo pi; 			memset(&pi, 0, sizeof(pi)); 			memcpy(&pi, nbuf + doff, descsz);  			if (file_printf(ms, ", from '%.31s', pid=%u, uid=%u, " 			    "gid=%u, nlwps=%u, lwp=%u (signal %u/code %u)",

Fixed version (after fix):
 #include "file.h"  #ifndef lint FILE_RCSID("@(#)$File: readelf.c,v 1.157 2019/01/02 19:44:14 christos Exp $") #endif  #ifdef BUILTIN_ELF do_core_note(struct magic_set *ms, unsigned char *nbuf, uint32_t type, 			char sbuf[512]; 			struct NetBSD_elfcore_procinfo pi; 			memset(&pi, 0, sizeof(pi)); 			memcpy(&pi, nbuf + doff, MIN(descsz, sizeof(pi)));  			if (file_printf(ms, ", from '%.31s', pid=%u, uid=%u, " 			    "gid=%u, nlwps=%u, lwp=%u (signal %u/code %u)",

Patch:
patch: @@ -27,7 +27,7 @@
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: readelf.c,v 1.156 2018/10/19 00:33:04 christos Exp $")
+FILE_RCSID("@(#)$File: readelf.c,v 1.157 2019/01/02 19:44:14 christos Exp $")
 #endif
 
 #ifdef BUILTIN_ELF
@@ -752,7 +752,7 @@ do_core_note(struct magic_set *ms, unsigned char *nbuf, uint32_t type,
 			char sbuf[512];
 			struct NetBSD_elfcore_procinfo pi;
 			memset(&pi, 0, sizeof(pi));
-			memcpy(&pi, nbuf + doff, descsz);
+			memcpy(&pi, nbuf + doff, MIN(descsz, sizeof(pi)));
 
 			if (file_printf(ms, ", from '%.31s', pid=%u, uid=%u, "
 			    "gid=%u, nlwps=%u, lwp=%u (signal %u/code %u)",
path: src/readelf.c
Vulnerability: In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task.
Vulnerability ID: CVE-2019-9213
CWE: CWE-476
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-03-05
File: mm/mmap.c
Commit message: mm: enforce min addr even if capable() in expand_downwards()

security_mmap_addr() does a capability check with current_cred(), but
we can reach this code from contexts like a VFS write handler where
current_cred() must not be used.

This can be abused on systems without SMAP to make NULL pointer
dereferences exploitable again.

Fixes: 8869477a49c3 ("security: protect from stack expansion into low vm addresses")
Cc: stable@kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Jann Horn

Vulnerable version (before fix):
 int expand_downwards(struct vm_area_struct *vma, { 	struct mm_struct *mm = vma->vm_mm; 	struct vm_area_struct *prev; 	int error;  	address &= PAGE_MASK; 	error = security_mmap_addr(address); 	if (error) 		return error;  	/* Enforce stack_guard_gap */ 	prev = vma->vm_prev;

Fixed version (after fix):
 int expand_downwards(struct vm_area_struct *vma, { 	struct mm_struct *mm = vma->vm_mm; 	struct vm_area_struct *prev; 	int error = 0;  	address &= PAGE_MASK; 	if (address < mmap_min_addr) 		return -EPERM;  	/* Enforce stack_guard_gap */ 	prev = vma->vm_prev;

Patch:
patch: @@ -2426,12 +2426,11 @@ int expand_downwards(struct vm_area_struct *vma,
 {
 	struct mm_struct *mm = vma->vm_mm;
 	struct vm_area_struct *prev;
-	int error;
+	int error = 0;
 
 	address &= PAGE_MASK;
-	error = security_mmap_addr(address);
-	if (error)
-		return error;
+	if (address < mmap_min_addr)
+		return -EPERM;
 
 	/* Enforce stack_guard_gap */
 	prev = vma->vm_prev;
path: mm/mmap.c
Vulnerability: Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL.
Vulnerability ID: CVE-2019-9841
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/serghey-rodin/vesta
Published: 2019-04-19
File: web/file_manager/fm_api.php
Commit message: setting content type to fix possible XSS attack vector
Commit author: Serghey Rodin

Vulnerable version (before fix):
 <?php  // Init //error_reporting(NULL);   include($_SERVER['DOCUMENT_ROOT']."/inc/main.php"); include($_SERVER['DOCUMENT_ROOT']."/file_manager/fm_core.php");

Fixed version (after fix):
 <?php // Init //error_reporting(NULL);  header('Content-Type: application/json');  include($_SERVER['DOCUMENT_ROOT']."/inc/main.php"); include($_SERVER['DOCUMENT_ROOT']."/file_manager/fm_core.php");

Patch:
patch: @@ -1,8 +1,8 @@
 <?php
-
 // Init
 //error_reporting(NULL);
 
+header('Content-Type: application/json');
 
 include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 include($_SERVER['DOCUMENT_ROOT']."/file_manager/fm_core.php");
path: web/file_manager/fm_api.php
Vulnerability: The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relative path.
Vulnerability ID: CVE-2019-9960
CWE: CWE-22
Severity score: 6.4
Project: https://github.com/LimeSurvey/LimeSurvey
Published: 2019-03-24
File: application/controllers/admin/export.php
Commit message: [security] Fixed issue #14617: relative path allowed in lsa multiple download
Commit author: LouisGac

Vulnerable version (before fix):
 public function exportMultipleSurveys($sSurveys, $sExportType)     public function downloadZip($sZip)     {         $sTempDir     = Yii::app()->getConfig("tempdir");         $aZIPFileName = $sTempDir.DIRECTORY_SEPARATOR.$sZip;          if (is_file($aZIPFileName)) {

Fixed version (after fix):
 public function exportMultipleSurveys($sSurveys, $sExportType)     public function downloadZip($sZip)     {         $sTempDir     = Yii::app()->getConfig("tempdir");         $sZip         = get_absolute_path($sZip);         $aZIPFileName = $sTempDir.DIRECTORY_SEPARATOR.$sZip;          if (is_file($aZIPFileName)) {

Patch:
patch: @@ -919,6 +919,7 @@ public function exportMultipleSurveys($sSurveys, $sExportType)
     public function downloadZip($sZip)
     {
         $sTempDir     = Yii::app()->getConfig("tempdir");
+        $sZip         = get_absolute_path($sZip);
         $aZIPFileName = $sTempDir.DIRECTORY_SEPARATOR.$sZip;
 
         if (is_file($aZIPFileName)) {
path: application/controllers/admin/export.php
Vulnerability: In the Zephyr Project MQTT code, improper bounds checking can result in memory corruption and possibly remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.
Vulnerability ID: CVE-2020-10070
CWE: CWE-120
Severity score: 6.4
Project: https://github.com/zephyrproject-rtos/zephyr
Published: 2020-06-05
File: subsys/net/lib/mqtt/mqtt_rx.c
Commit message: net: mqtt: Improve buffer bounds validation in mqtt_read_message_chunk

Verify more strictly that data read from the transport fits into RX
buffer. Switch to unsigned integers, where possible, to prevent
unnecessary signed/unsigned operations.

Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
Commit author: Robert Lubos

Vulnerable version (before fix):
 static int mqtt_handle_packet(struct mqtt_client *client, static int mqtt_read_message_chunk(struct mqtt_client *client, 				   struct buf_ctx *buf, u32_t length) { 	int remaining; 	int len;  	/* Calculate how much data we need to read from the transport, 	 * given the already buffered data. 	 */ 	remaining = length - (buf->end - buf->cur); 	if (remaining <= 0) { 		return 0; 	}  	/* Check if read does not exceed the buffer. */ 	if (buf->end + remaining > client->rx_buf + client->rx_buf_size) { 		MQTT_ERR("[CID %p]: Buffer too small to receive the message", 			 client); 		return -ENOMEM; 	}

Fixed version (after fix):
 static int mqtt_handle_packet(struct mqtt_client *client, static int mqtt_read_message_chunk(struct mqtt_client *client, 				   struct buf_ctx *buf, u32_t length) { 	u32_t remaining; 	int len;  	/* In case all data requested has already been buffered, return. */ 	if (length <= (buf->end - buf->cur)) { 		return 0; 	}  	/* Calculate how much data we need to read from the transport, 	 * given the already buffered data. 	 */ 	remaining = length - (buf->end - buf->cur);  	/* Check if read does not exceed the buffer. */ 	if ((buf->end + remaining > client->rx_buf + client->rx_buf_size) || 	    (buf->end + remaining < client->rx_buf)) { 		MQTT_ERR("[CID %p]: Read would exceed RX buffer bounds.", 			 client); 		return -ENOMEM; 	}

Patch:
patch: @@ -146,20 +146,23 @@ static int mqtt_handle_packet(struct mqtt_client *client,
 static int mqtt_read_message_chunk(struct mqtt_client *client,
 				   struct buf_ctx *buf, u32_t length)
 {
-	int remaining;
+	u32_t remaining;
 	int len;
 
+	/* In case all data requested has already been buffered, return. */
+	if (length <= (buf->end - buf->cur)) {
+		return 0;
+	}
+
 	/* Calculate how much data we need to read from the transport,
 	 * given the already buffered data.
 	 */
 	remaining = length - (buf->end - buf->cur);
-	if (remaining <= 0) {
-		return 0;
-	}
 
 	/* Check if read does not exceed the buffer. */
-	if (buf->end + remaining > client->rx_buf + client->rx_buf_size) {
-		MQTT_ERR("[CID %p]: Buffer too small to receive the message",
+	if ((buf->end + remaining > client->rx_buf + client->rx_buf_size) ||
+	    (buf->end + remaining < client->rx_buf)) {
+		MQTT_ERR("[CID %p]: Read would exceed RX buffer bounds.",
 			 client);
 		return -ENOMEM;
 	}
path: subsys/net/lib/mqtt/mqtt_rx.c
Vulnerability: In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a stack buffer overflow vulnerability in the YAFFS file timestamp parsing logic in yaffsfs_istat() in fs/yaffs.c.
Vulnerability ID: CVE-2020-10232
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/sleuthkit/sleuthkit
Published: 2020-03-09
File: tsk/fs/yaffs.cpp
Commit message: Fix stack buffer overflow in yaffsfs_istat

Prevent a stack buffer overflow in yaffsfs_istat by increasing the buffer size to the size required by tsk_fs_time_to_str.
Commit author: micrictor

Vulnerable version (before fix):
 static uint8_t     YAFFSFS_INFO *yfs = (YAFFSFS_INFO *)fs;     char ls[12];     YAFFSFS_PRINT_ADDR print;     char timeBuf[32];     YaffsCacheObject * obj = NULL;     YaffsCacheVersion * version = NULL;     YaffsHeader * header = NULL;

Fixed version (after fix):
 static uint8_t     YAFFSFS_INFO *yfs = (YAFFSFS_INFO *)fs;     char ls[12];     YAFFSFS_PRINT_ADDR print;     char timeBuf[128];     YaffsCacheObject * obj = NULL;     YaffsCacheVersion * version = NULL;     YaffsHeader * header = NULL;

Patch:
patch: @@ -2439,7 +2439,7 @@ static uint8_t
     YAFFSFS_INFO *yfs = (YAFFSFS_INFO *)fs;
     char ls[12];
     YAFFSFS_PRINT_ADDR print;
-    char timeBuf[32];
+    char timeBuf[128];
     YaffsCacheObject * obj = NULL;
     YaffsCacheVersion * version = NULL;
     YaffsHeader * header = NULL;
path: tsk/fs/yaffs.cpp
Vulnerability: Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.
Vulnerability ID: CVE-2020-10543
CWE: CWE-787
Severity score: 4.9
Project: https://github.com/perl/perl5
Published: 2020-06-05
File: regcomp.c
Commit message: regcomp.c: Prevent integer overflow from nested regex quantifiers.

(CVE-2020-10543) On 32bit systems the size calculations for nested regular
expression quantifiers could overflow causing heap memory corruption.

Fixes: Perl/perl5-security#125
(cherry picked from commit bfd31397db5dc1a5c5d3e0a1f753a4f89a736e71)
Commit author: John Lightsey

Vulnerable version (before fix):
 S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, 				  RExC_precomp)));                 }  		min += minnext * mincount; 		is_inf_internal |= deltanext == SSize_t_MAX                          || (maxcount == REG_INFTY && minnext + deltanext > 0);

Fixed version (after fix):
 S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, 				  RExC_precomp)));                 }                  if ( ( minnext > 0 && mincount >= SSize_t_MAX / minnext )                     || min >= SSize_t_MAX - minnext * mincount )                 {                     FAIL("Regexp out of space");                 }  		min += minnext * mincount; 		is_inf_internal |= deltanext == SSize_t_MAX                          || (maxcount == REG_INFTY && minnext + deltanext > 0);

Patch:
patch: @@ -5489,6 +5489,12 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
 				  RExC_precomp)));
                 }
 
+                if ( ( minnext > 0 && mincount >= SSize_t_MAX / minnext )
+                    || min >= SSize_t_MAX - minnext * mincount )
+                {
+                    FAIL("Regexp out of space");
+                }
+
 		min += minnext * mincount;
 		is_inf_internal |= deltanext == SSize_t_MAX
                          || (maxcount == REG_INFTY && minnext + deltanext > 0);
path: regcomp.c
Vulnerability: Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.
Vulnerability ID: CVE-2020-10543
CWE: CWE-190
Severity score: 4.9
Project: https://github.com/perl/perl5
Published: 2020-06-05
File: regcomp.c
Commit message: regcomp.c: Prevent integer overflow from nested regex quantifiers.

(CVE-2020-10543) On 32bit systems the size calculations for nested regular
expression quantifiers could overflow causing heap memory corruption.

Fixes: Perl/perl5-security#125
(cherry picked from commit bfd31397db5dc1a5c5d3e0a1f753a4f89a736e71)
Commit author: John Lightsey

Vulnerable version (before fix):
 S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, 				  RExC_precomp)));                 }  		min += minnext * mincount; 		is_inf_internal |= deltanext == SSize_t_MAX                          || (maxcount == REG_INFTY && minnext + deltanext > 0);

Fixed version (after fix):
 S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, 				  RExC_precomp)));                 }                  if ( ( minnext > 0 && mincount >= SSize_t_MAX / minnext )                     || min >= SSize_t_MAX - minnext * mincount )                 {                     FAIL("Regexp out of space");                 }  		min += minnext * mincount; 		is_inf_internal |= deltanext == SSize_t_MAX                          || (maxcount == REG_INFTY && minnext + deltanext > 0);

Patch:
patch: @@ -5489,6 +5489,12 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
 				  RExC_precomp)));
                 }
 
+                if ( ( minnext > 0 && mincount >= SSize_t_MAX / minnext )
+                    || min >= SSize_t_MAX - minnext * mincount )
+                {
+                    FAIL("Regexp out of space");
+                }
+
 		min += minnext * mincount;
 		is_inf_internal |= deltanext == SSize_t_MAX
                          || (maxcount == REG_INFTY && minnext + deltanext > 0);
path: regcomp.c
Vulnerability: Memcached 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted binary protocol header to try_read_command_binary in memcached.c.
Vulnerability ID: CVE-2020-10931
CWE: CWE-120
Severity score: 2.9
Project: https://github.com/memcached/memcached
Published: 2020-03-24
File: memcached.c
Commit message: Fix security issue reported by someone.

someone will get their name attributed for future issues if they bother
following procedure.
Commit author: dormando

Vulnerable version (before fix):
 static int try_read_command_binary(conn *c) {         // want to refactor a ton of code either. Header is only ever used out         // of c->binary_header, but the extlen stuff is used for the latter         // bytes. Just wastes 24 bytes on the stack this way.         char extbuf[sizeof(c->binary_header) + BIN_MAX_EXTLEN];         memcpy(extbuf + sizeof(c->binary_header), c->rcurr + sizeof(c->binary_header), extlen);         c->rbytes -= sizeof(c->binary_header) + extlen + keylen;         c->rcurr += sizeof(c->binary_header) + extlen + keylen; 

Fixed version (after fix):
 static int try_read_command_binary(conn *c) {         // want to refactor a ton of code either. Header is only ever used out         // of c->binary_header, but the extlen stuff is used for the latter         // bytes. Just wastes 24 bytes on the stack this way.         char extbuf[sizeof(c->binary_header) + BIN_MAX_EXTLEN+1];         memcpy(extbuf + sizeof(c->binary_header), c->rcurr + sizeof(c->binary_header),                 extlen > BIN_MAX_EXTLEN ? BIN_MAX_EXTLEN : extlen);         c->rbytes -= sizeof(c->binary_header) + extlen + keylen;         c->rcurr += sizeof(c->binary_header) + extlen + keylen; 

Patch:
patch: @@ -6175,8 +6175,9 @@ static int try_read_command_binary(conn *c) {
         // want to refactor a ton of code either. Header is only ever used out
         // of c->binary_header, but the extlen stuff is used for the latter
         // bytes. Just wastes 24 bytes on the stack this way.
-        char extbuf[sizeof(c->binary_header) + BIN_MAX_EXTLEN];
-        memcpy(extbuf + sizeof(c->binary_header), c->rcurr + sizeof(c->binary_header), extlen);
+        char extbuf[sizeof(c->binary_header) + BIN_MAX_EXTLEN+1];
+        memcpy(extbuf + sizeof(c->binary_header), c->rcurr + sizeof(c->binary_header),
+                extlen > BIN_MAX_EXTLEN ? BIN_MAX_EXTLEN : extlen);
         c->rbytes -= sizeof(c->binary_header) + extlen + keylen;
         c->rcurr += sizeof(c->binary_header) + extlen + keylen;
path: memcached.c
Vulnerability: SQL Injection was discovered in Admidio before version 3.3.13. The main cookie parameter is concatenated into a SQL query without any input validation/sanitization, thus an attacker without logging in, can send a GET request with arbitrary SQL queries appended to the cookie parameter and execute SQL queries. The vulnerability impacts the confidentiality of the system. This has been patched in version 3.3.13.
Vulnerability ID: CVE-2020-11004
CWE: CWE-89
Severity score: 2.9
Project: https://github.com/Admidio/admidio
Published: 2020-04-24
File: adm_program/system/classes/TableAccess.php
Commit message: Unauthenticated Blind SQL injection #908
Commit author: Markus Faßbender

Vulnerable version (before fix):
 public function readDataByColumns(array $columnArray)         // add every array element as a sql condition to the condition string         foreach ($columnArray as $columnName => $columnValue)         {             $sqlWhereCondition .= ' AND ' . $columnName . ' = \'' . $columnValue . '\' ';         }          // call method to read data out of database         $returnCode = $this->readData($sqlWhereCondition);          // save the array fields in the object         if (!$returnCode)

Fixed version (after fix):
 public function readDataByColumns(array $columnArray)         // add every array element as a sql condition to the condition string         foreach ($columnArray as $columnName => $columnValue)         {             $sqlWhereCondition .= ' AND ' . $columnName . ' = ? ';         }          // call method to read data out of database         $returnCode = $this->readData($sqlWhereCondition, array_values($columnArray));          // save the array fields in the object         if (!$returnCode)

Patch:
patch: @@ -444,11 +444,11 @@ public function readDataByColumns(array $columnArray)
         // add every array element as a sql condition to the condition string
         foreach ($columnArray as $columnName => $columnValue)
         {
-            $sqlWhereCondition .= ' AND ' . $columnName . ' = \'' . $columnValue . '\' ';
+            $sqlWhereCondition .= ' AND ' . $columnName . ' = ? ';
         }
 
         // call method to read data out of database
-        $returnCode = $this->readData($sqlWhereCondition);
+        $returnCode = $this->readData($sqlWhereCondition, array_values($columnArray));
 
         // save the array fields in the object
         if (!$returnCode)
path: adm_program/system/classes/TableAccess.php
Vulnerability: In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipulated server is parsed. This has been patched in 2.0.0.
Vulnerability ID: CVE-2020-11044
CWE: CWE-415
Severity score: 2.9
Project: https://github.com/FreeRDP/FreeRDP
Published: 2020-05-07
File: libfreerdp/core/orders.c
Commit message: Fixed #6013: Check new length is > 0
Commit author: akallabeth

Vulnerable version (before fix):
 static CACHE_BITMAP_V3_ORDER* update_read_cache_bitmap_v3_order(rdpUpdate* updat 	Stream_Read_UINT16(s, bitmapData->height); /* height (2 bytes) */ 	Stream_Read_UINT32(s, new_len);            /* length (4 bytes) */  	if (Stream_GetRemainingLength(s) < new_len) 		goto fail;  	new_data = (BYTE*)realloc(bitmapData->data, new_len);

Fixed version (after fix):
 static CACHE_BITMAP_V3_ORDER* update_read_cache_bitmap_v3_order(rdpUpdate* updat 	Stream_Read_UINT16(s, bitmapData->height); /* height (2 bytes) */ 	Stream_Read_UINT32(s, new_len);            /* length (4 bytes) */  	if ((new_len == 0) || (Stream_GetRemainingLength(s) < new_len)) 		goto fail;  	new_data = (BYTE*)realloc(bitmapData->data, new_len);

Patch:
patch: @@ -2161,7 +2161,7 @@ static CACHE_BITMAP_V3_ORDER* update_read_cache_bitmap_v3_order(rdpUpdate* updat
 	Stream_Read_UINT16(s, bitmapData->height); /* height (2 bytes) */
 	Stream_Read_UINT32(s, new_len);            /* length (4 bytes) */
 
-	if (Stream_GetRemainingLength(s) < new_len)
+	if ((new_len == 0) || (Stream_GetRemainingLength(s) < new_len))
 		goto fail;
 
 	new_data = (BYTE*)realloc(bitmapData->data, new_len);
path: libfreerdp/core/orders.c
Vulnerability: In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that allows client memory to be read to an image buffer. The result displayed on screen as colour.
Vulnerability ID: CVE-2020-11045
CWE: CWE-125
Severity score: 4.9
Project: https://github.com/FreeRDP/FreeRDP
Published: 2020-05-07
File: libfreerdp/core/update.c
Commit message: Fixed #6005: Bounds checks in update_read_bitmap_data
Commit author: akallabeth

Vulnerable version (before fix):
 static BOOL update_read_bitmap_data(rdpUpdate* update, wStream* s, BITMAP_DATA* 	{ 		if (!(bitmapData->flags & NO_BITMAP_COMPRESSION_HDR)) 		{ 			Stream_Read_UINT16(s, 			                   bitmapData->cbCompFirstRowSize); /* cbCompFirstRowSize (2 bytes) */ 			Stream_Read_UINT16(s,

Fixed version (after fix):
 static BOOL update_read_bitmap_data(rdpUpdate* update, wStream* s, BITMAP_DATA* 	{ 		if (!(bitmapData->flags & NO_BITMAP_COMPRESSION_HDR)) 		{ 			if (Stream_GetRemainingLength(s) < 8) 				return FALSE;  			Stream_Read_UINT16(s, 			                   bitmapData->cbCompFirstRowSize); /* cbCompFirstRowSize (2 bytes) */ 			Stream_Read_UINT16(s,

Patch:
patch: @@ -103,6 +103,9 @@ static BOOL update_read_bitmap_data(rdpUpdate* update, wStream* s, BITMAP_DATA*
 	{
 		if (!(bitmapData->flags & NO_BITMAP_COMPRESSION_HDR))
 		{
+			if (Stream_GetRemainingLength(s) < 8)
+				return FALSE;
+
 			Stream_Read_UINT16(s,
 			                   bitmapData->cbCompFirstRowSize); /* cbCompFirstRowSize (2 bytes) */
 			Stream_Read_UINT16(s,
path: libfreerdp/core/update.c