rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact.
Vulnerability ID: CVE-2017-11176
CWE: CWE-416
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2017-07-11
File: ipc/mqueue.c
Commit message: mqueue: fix a use-after-free in sys_mq_notify()

The retry logic for netlink_attachskb() inside sys_mq_notify()
is nasty and vulnerable:

1) The sock refcnt is already released when retry is needed
2) The fd is controllable by user-space because we already
   release the file refcnt

so we when retry but the fd has been just closed by user-space
during this small window, we end up calling netlink_detachskb()
on the error path which releases the sock again, later when
the user-space closes this socket a use-after-free could be
triggered.

Setting 'sock' to NULL here should be sufficient to fix it.

Reported-by: GeneBlue <geneblue.mail@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Manfred Spraul <manfred@colorfullife.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Cong Wang

Vulnerable version (before fix):
 static int do_mq_notify(mqd_t mqdes, const struct sigevent *notification)  			timeo = MAX_SCHEDULE_TIMEOUT; 			ret = netlink_attachskb(sock, nc, &timeo, NULL); 			if (ret == 1) 				goto retry; 			if (ret) { 				sock = NULL; 				nc = NULL;

Fixed version (after fix):
 static int do_mq_notify(mqd_t mqdes, const struct sigevent *notification)  			timeo = MAX_SCHEDULE_TIMEOUT; 			ret = netlink_attachskb(sock, nc, &timeo, NULL); 			if (ret == 1) { 				sock = NULL; 				goto retry; 			} 			if (ret) { 				sock = NULL; 				nc = NULL;

Patch:
patch: @@ -1270,8 +1270,10 @@ static int do_mq_notify(mqd_t mqdes, const struct sigevent *notification)
 
 			timeo = MAX_SCHEDULE_TIMEOUT;
 			ret = netlink_attachskb(sock, nc, &timeo, NULL);
-			if (ret == 1)
+			if (ret == 1) {
+				sock = NULL;
 				goto retry;
+			}
 			if (ret) {
 				sock = NULL;
 				nc = NULL;
path: ipc/mqueue.c
Vulnerability: components/filemanager/class.filemanager.php in Codiad before 2.8.4 is vulnerable to remote command execution because shell commands can be embedded in parameter values, as demonstrated by search_file_type.
Vulnerability ID: CVE-2017-11366
CWE: CWE-78
Severity score: 6.4
Project: https://github.com/Codiad/Codiad
Published: 2017-08-21
File: components/filemanager/class.filemanager.php
Commit message: Escaping shell arguments
Commit author: sphinx

Vulnerable version (before fix):
 public function __construct($get, $post, $files)             $this->rel_path .= "/";         }         if (!empty($get['query'])) {             $this->query = $get['query'];         }         if (!empty($get['options'])) {             $this->foptions = $get['options']; public function __construct($get, $post, $files)         }         // Search         if (!empty($post['search_string'])) {             $this->search_string = $post['search_string'];         }         if (!empty($post['search_file_type'])) {             $this->search_file_type = $post['search_file_type'];         }         // Create         if (!empty($get['type'])) {

Fixed version (after fix):
 public function __construct($get, $post, $files)             $this->rel_path .= "/";         }         if (!empty($get['query'])) {             $this->query = escapeshellarg($get['query']);         }         if (!empty($get['options'])) {             $this->foptions = $get['options']; public function __construct($get, $post, $files)         }         // Search         if (!empty($post['search_string'])) {             $this->search_string = escapeshellarg($post['search_string']);         }         if (!empty($post['search_file_type'])) {             $this->search_file_type = escapeshellarg($post['search_file_type']);         }         // Create         if (!empty($get['type'])) {

Patch:
patch: @@ -57,7 +57,7 @@ public function __construct($get, $post, $files)
             $this->rel_path .= "/";
         }
         if (!empty($get['query'])) {
-            $this->query = $get['query'];
+            $this->query = escapeshellarg($get['query']);
         }
         if (!empty($get['options'])) {
             $this->foptions = $get['options'];
@@ -71,10 +71,10 @@ public function __construct($get, $post, $files)
         }
         // Search
         if (!empty($post['search_string'])) {
-            $this->search_string = $post['search_string'];
+            $this->search_string = escapeshellarg($post['search_string']);
         }
         if (!empty($post['search_file_type'])) {
-            $this->search_file_type = $post['search_file_type'];
+            $this->search_file_type = escapeshellarg($post['search_file_type']);
         }
         // Create
         if (!empty($get['type'])) {
path: components/filemanager/class.filemanager.php
Vulnerability: The ReadJPEGImage function in coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted file.
Vulnerability ID: CVE-2017-11448
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-07-19
File: coders/jpeg.c
Commit message: Zero pixel buffer
Commit author: Cristy

Vulnerable version (before fix):
 static Image *ReadJPEGImage(const ImageInfo *image_info,       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");     }   jpeg_pixels=(JSAMPLE *) GetVirtualMemoryBlob(memory_info);   /*     Convert JPEG pixels to pixel packets.   */

Fixed version (after fix):
 static Image *ReadJPEGImage(const ImageInfo *image_info,       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");     }   jpeg_pixels=(JSAMPLE *) GetVirtualMemoryBlob(memory_info);   (void) ResetMagickMemory(jpeg_pixels,0,image->columns*     jpeg_info.output_components*sizeof(*jpeg_pixels));   /*     Convert JPEG pixels to pixel packets.   */

Patch:
patch: @@ -1318,6 +1318,8 @@ static Image *ReadJPEGImage(const ImageInfo *image_info,
       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
     }
   jpeg_pixels=(JSAMPLE *) GetVirtualMemoryBlob(memory_info);
+  (void) ResetMagickMemory(jpeg_pixels,0,image->columns*
+    jpeg_info.output_components*sizeof(*jpeg_pixels));
   /*
     Convert JPEG pixels to pixel packets.
   */
path: coders/jpeg.c
Vulnerability: The WriteOnePNGImage function in coders/png.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.
Vulnerability ID: CVE-2017-11522
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-07-22
File: coders/png.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/58
Commit author: Cristy

Vulnerable version (before fix):
 static MagickBooleanType WriteOnePNGImage(MngInfo *mng_info,     "  Enter WriteOnePNGImage()");    image = CloneImage(IMimage,0,0,MagickFalse,exception);   image_info=(ImageInfo *) CloneImageInfo(IMimage_info);   if (image_info == (ImageInfo *) NULL)      ThrowWriterException(ResourceLimitError, "MemoryAllocationFailed");    /* Define these outside of the following "if logging()" block so they will    * show in debuggers.

Fixed version (after fix):
 static MagickBooleanType WriteOnePNGImage(MngInfo *mng_info,     "  Enter WriteOnePNGImage()");    image = CloneImage(IMimage,0,0,MagickFalse,exception);   if (image == (Image *) NULL)     return(MagickFalse);   image_info=(ImageInfo *) CloneImageInfo(IMimage_info);   if (image_info == (ImageInfo *) NULL)     ThrowWriterException(ResourceLimitError, "MemoryAllocationFailed");    /* Define these outside of the following "if logging()" block so they will    * show in debuggers.

Patch:
patch: @@ -8270,9 +8270,11 @@ static MagickBooleanType WriteOnePNGImage(MngInfo *mng_info,
     "  Enter WriteOnePNGImage()");
 
   image = CloneImage(IMimage,0,0,MagickFalse,exception);
+  if (image == (Image *) NULL)
+    return(MagickFalse);
   image_info=(ImageInfo *) CloneImageInfo(IMimage_info);
   if (image_info == (ImageInfo *) NULL)
-     ThrowWriterException(ResourceLimitError, "MemoryAllocationFailed");
+    ThrowWriterException(ResourceLimitError, "MemoryAllocationFailed");
 
   /* Define these outside of the following "if logging()" block so they will
    * show in debuggers.
path: coders/png.c
Vulnerability: An XSS issue was discovered in manage_user_page.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled.
Vulnerability ID: CVE-2017-12062
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/mantisbt/mantisbt
Published: 2017-08-01
File: manage_user_page.php
Commit message: Fix XSS in manage_user_page.php (CVE-2017-12062)

trichimtrich (https://twitter.com/trichimtrich) reported this
vulnerability, allowing an attacker to inject arbitrary code through a
crafted 'filter' form variable.

Prevent the attack by sanitizing the variable before output.

Fixes #23166

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Commit author: Roland Becker

Vulnerable version (before fix):
 			<input type="hidden" name="sort" value="<?php echo $c_sort ?>" /> 			<input type="hidden" name="dir" value="<?php echo $c_dir ?>" /> 			<input type="hidden" name="save" value="1" /> 			<input type="hidden" name="filter" value="<?php echo $f_filter ?>" /> 			<label class="inline"> 			<input type="checkbox" class="ace" name="hideinactive" value="<?php echo ON ?>" <?php check_checked( (int)$c_hide_inactive, ON ); ?> /> 			<span class="lbl"> <?php echo lang_get( 'hide_inactive' ) ?></span>

Fixed version (after fix):
 			<input type="hidden" name="sort" value="<?php echo $c_sort ?>" /> 			<input type="hidden" name="dir" value="<?php echo $c_dir ?>" /> 			<input type="hidden" name="save" value="1" /> 			<input type="hidden" name="filter" value="<?php echo string_attribute( $f_filter ); ?>" /> 			<label class="inline"> 			<input type="checkbox" class="ace" name="hideinactive" value="<?php echo ON ?>" <?php check_checked( (int)$c_hide_inactive, ON ); ?> /> 			<span class="lbl"> <?php echo lang_get( 'hide_inactive' ) ?></span>

Patch:
patch: @@ -272,7 +272,7 @@
 			<input type="hidden" name="sort" value="<?php echo $c_sort ?>" />
 			<input type="hidden" name="dir" value="<?php echo $c_dir ?>" />
 			<input type="hidden" name="save" value="1" />
-			<input type="hidden" name="filter" value="<?php echo $f_filter ?>" />
+			<input type="hidden" name="filter" value="<?php echo string_attribute( $f_filter ); ?>" />
 			<label class="inline">
 			<input type="checkbox" class="ace" name="hideinactive" value="<?php echo ON ?>" <?php check_checked( (int)$c_hide_inactive, ON ); ?> />
 			<span class="lbl"> <?php echo lang_get( 'hide_inactive' ) ?></span>
path: manage_user_page.php
Vulnerability: In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors. This crosses a privilege boundary in, for example, certain web-hosting environments in which a Control Panel allows an unprivileged user account to create subaccounts.
Vulnerability ID: CVE-2017-12424
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/shadow-maint/shadow
Published: 2017-08-04
File: lib/commonio.c
Commit message: Fix buffer overflow if NULL line is present in db.

If ptr->line == NULL for an entry, the first cycle will exit,
but the second one will happily write past entries buffer.
We actually do not want to exit the first cycle prematurely
on ptr->line == NULL.
Signed-off-by: Tomas Mraz <tmraz@fedoraproject.org>
Commit author: Tomas Mraz

Vulnerable version (before fix):
 commonio_sort (struct commonio_db *db, int (*cmp) (const void *, const void *)) 	for (ptr = db->head; 	        (NULL != ptr) #if KEEP_NIS_AT_END 	     && (NULL != ptr->line) 	     && (   ('+' != ptr->line[0]) 	         && ('-' != ptr->line[0])) #endif 	     ; 	     ptr = ptr->next) { 		n++; 	} #if KEEP_NIS_AT_END 	if ((NULL != ptr) && (NULL != ptr->line)) { 		nis = ptr; 	} #endif

Fixed version (after fix):
 commonio_sort (struct commonio_db *db, int (*cmp) (const void *, const void *)) 	for (ptr = db->head; 	        (NULL != ptr) #if KEEP_NIS_AT_END 	     && ((NULL == ptr->line) 	         || (('+' != ptr->line[0]) 	             && ('-' != ptr->line[0]))) #endif 	     ; 	     ptr = ptr->next) { 		n++; 	} #if KEEP_NIS_AT_END 	if (NULL != ptr) { 		nis = ptr; 	} #endif

Patch:
patch: @@ -751,16 +751,16 @@ commonio_sort (struct commonio_db *db, int (*cmp) (const void *, const void *))
 	for (ptr = db->head;
 	        (NULL != ptr)
 #if KEEP_NIS_AT_END
-	     && (NULL != ptr->line)
-	     && (   ('+' != ptr->line[0])
-	         && ('-' != ptr->line[0]))
+	     && ((NULL == ptr->line)
+	         || (('+' != ptr->line[0])
+	             && ('-' != ptr->line[0])))
 #endif
 	     ;
 	     ptr = ptr->next) {
 		n++;
 	}
 #if KEEP_NIS_AT_END
-	if ((NULL != ptr) && (NULL != ptr->line)) {
+	if (NULL != ptr) {
 		nis = ptr;
 	}
 #endif
path: lib/commonio.c
Vulnerability: ImageMagick 7.0.6-1 has an out-of-bounds read vulnerability in ReadOneMNGImage in coders/png.c.
Vulnerability ID: CVE-2017-12640
CWE: CWE-125
Severity score: 6.4
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-08-07
File: coders/png.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/542
Commit author: Cristy

Vulnerable version (before fix):
 static Image *ReadOneMNGImage(MngInfo* mng_info, const ImageInfo *image_info,                for (i=(ssize_t) first_object; i <= (ssize_t) last_object; i++)               {                 if (mng_info->exists[i] && !mng_info->frozen[i] &&                     (p-chunk) < (ssize_t) (length-8))                   {

Fixed version (after fix):
 static Image *ReadOneMNGImage(MngInfo* mng_info, const ImageInfo *image_info,                for (i=(ssize_t) first_object; i <= (ssize_t) last_object; i++)               {                 if ((i < 0) || (i >= MNG_MAX_OBJECTS))                   continue;                 if (mng_info->exists[i] && !mng_info->frozen[i] &&                     (p-chunk) < (ssize_t) (length-8))                   {

Patch:
patch: @@ -5968,6 +5968,8 @@ static Image *ReadOneMNGImage(MngInfo* mng_info, const ImageInfo *image_info,
 
               for (i=(ssize_t) first_object; i <= (ssize_t) last_object; i++)
               {
+                if ((i < 0) || (i >= MNG_MAX_OBJECTS))
+                  continue;
                 if (mng_info->exists[i] && !mng_info->frozen[i] &&
                     (p-chunk) < (ssize_t) (length-8))
                   {
path: coders/png.c
Vulnerability: In TagLib 1.11.1, the rebuildAggregateFrames function in id3v2framefactory.cpp has a pointer to cast vulnerability, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted audio file.
Vulnerability ID: CVE-2017-12678
CWE: CWE-434
Severity score: 6.4
Project: https://github.com/taglib/taglib
Published: 2017-08-08
File: taglib/mpeg/id3v2/id3v2framefactory.cpp
Commit message: Don't assume TDRC is an instance of TextIdentificationFrame (#831)

If TDRC is encrypted, FrameFactory::createFrame() returns UnknownFrame
which causes problems in rebuildAggregateFrames() when it is assumed
that TDRC is a TextIdentificationFrame
Commit author: Stephen F. Booth

Vulnerable version (before fix):
 void FrameFactory::rebuildAggregateFrames(ID3v2::Tag *tag) const      tag->frameList("TDAT").size() == 1)   {     TextIdentificationFrame *tdrc =       static_cast<TextIdentificationFrame *>(tag->frameList("TDRC").front());     UnknownFrame *tdat = static_cast<UnknownFrame *>(tag->frameList("TDAT").front());      if(tdrc->fieldList().size() == 1 &&        tdrc->fieldList().front().size() == 4 &&        tdat->data().size() >= 5)     {

Fixed version (after fix):
 void FrameFactory::rebuildAggregateFrames(ID3v2::Tag *tag) const      tag->frameList("TDAT").size() == 1)   {     TextIdentificationFrame *tdrc =       dynamic_cast<TextIdentificationFrame *>(tag->frameList("TDRC").front());     UnknownFrame *tdat = static_cast<UnknownFrame *>(tag->frameList("TDAT").front());      if(tdrc &&        tdrc->fieldList().size() == 1 &&        tdrc->fieldList().front().size() == 4 &&        tdat->data().size() >= 5)     {

Patch:
patch: @@ -334,10 +334,11 @@ void FrameFactory::rebuildAggregateFrames(ID3v2::Tag *tag) const
      tag->frameList("TDAT").size() == 1)
   {
     TextIdentificationFrame *tdrc =
-      static_cast<TextIdentificationFrame *>(tag->frameList("TDRC").front());
+      dynamic_cast<TextIdentificationFrame *>(tag->frameList("TDRC").front());
     UnknownFrame *tdat = static_cast<UnknownFrame *>(tag->frameList("TDAT").front());
 
-    if(tdrc->fieldList().size() == 1 &&
+    if(tdrc &&
+       tdrc->fieldList().size() == 1 &&
        tdrc->fieldList().front().size() == 4 &&
        tdat->data().size() >= 5)
     {
path: taglib/mpeg/id3v2/id3v2framefactory.cpp
Vulnerability: OpenMRS openmrs-module-htmlformentry 3.3.2 is affected by: (Improper Input Validation).
Vulnerability ID: CVE-2017-12795
CWE: CWE-20
Severity score: 6.4
Project: https://github.com/openmrs/openmrs-module-htmlformentry
Published: 2019-05-10
File: omod/src/main/java/org/openmrs/module/htmlformentry/web/controller/HtmlFormFromFileController.java
Commit message: Added privilege check when previewing an uploaded html form
Commit author: wyclif

Vulnerable version (before fix):
 public void handleRequest(Model model, @RequestParam(value = "filePath", require 	                          @RequestParam(value = "patientId", required = false) Integer pId, 	                          @RequestParam(value = "isFileUpload", required = false) boolean isFileUpload, 	                          HttpServletRequest request) throws Exception { 		 		if (log.isDebugEnabled()) 			log.debug("In reference data...");

Fixed version (after fix):
 public void handleRequest(Model model, @RequestParam(value = "filePath", require 	                          @RequestParam(value = "patientId", required = false) Integer pId, 	                          @RequestParam(value = "isFileUpload", required = false) boolean isFileUpload, 	                          HttpServletRequest request) throws Exception {          Context.requirePrivilege("Manage Forms"); 		 		if (log.isDebugEnabled()) 			log.debug("In reference data...");

Patch:
patch: @@ -44,6 +44,8 @@ public void handleRequest(Model model, @RequestParam(value = "filePath", require
 	                          @RequestParam(value = "patientId", required = false) Integer pId,
 	                          @RequestParam(value = "isFileUpload", required = false) boolean isFileUpload,
 	                          HttpServletRequest request) throws Exception {
+
+        Context.requirePrivilege("Manage Forms");
 		
 		if (log.isDebugEnabled())
 			log.debug("In reference data...");
path: omod/src/main/java/org/openmrs/module/htmlformentry/web/controller/HtmlFormFromFileController.java
Vulnerability: Use-after-free vulnerability in the DestroyImage function in image.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted file.
Vulnerability ID: CVE-2017-12877
CWE: CWE-416
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-08-28
File: coders/mat.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/662
Commit author: Cristy

Vulnerable version (before fix):
 RestoreMSCWarning   if (quantum_info != (QuantumInfo *) NULL)     quantum_info=DestroyQuantumInfo(quantum_info); END_OF_READING:   if (clone_info)     clone_info=DestroyImageInfo(clone_info);   CloseBlob(image);   RestoreMSCWarning         Image *tmp=p;         if ((p->rows == 0) || (p->columns == 0)) {           p=p->previous;           DeleteImageFromList(&tmp);         } else {           image=p;

Fixed version (after fix):
 RestoreMSCWarning   if (quantum_info != (QuantumInfo *) NULL)     quantum_info=DestroyQuantumInfo(quantum_info); END_OF_READING:   CloseBlob(image);   RestoreMSCWarning         Image *tmp=p;         if ((p->rows == 0) || (p->columns == 0)) {           p=p->previous;           if (tmp == image2)             image2=(Image *) NULL;           DeleteImageFromList(&tmp);         } else {           image=p;

Patch:
patch: @@ -1330,8 +1330,6 @@ RestoreMSCWarning
   if (quantum_info != (QuantumInfo *) NULL)
     quantum_info=DestroyQuantumInfo(quantum_info);
 END_OF_READING:
-  if (clone_info)
-    clone_info=DestroyImageInfo(clone_info);
   CloseBlob(image);
 
 
@@ -1349,6 +1347,8 @@ RestoreMSCWarning
         Image *tmp=p;
         if ((p->rows == 0) || (p->columns == 0)) {
           p=p->previous;
+          if (tmp == image2)
+            image2=(Image *) NULL;
           DeleteImageFromList(&tmp);
         } else {
           image=p;
path: coders/mat.c
Vulnerability: The bmp_read_info_header function in bin/jp2/convertbmp.c in OpenJPEG 2.2.0 does not reject headers with a zero biBitCount, which allows remote attackers to cause a denial of service (memory allocation failure) in the opj_image_create function in lib/openjp2/image.c, related to the opj_aligned_alloc_n function in opj_malloc.c.
Vulnerability ID: CVE-2017-12982
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/uclouvain/openjpeg
Published: 2017-08-21
File: src/bin/jp2/convertbmp.c
Commit message: bmp_read_info_header(): reject bmp files with biBitCount == 0 (#983)
Commit author: Even Rouault

Vulnerable version (before fix):
 static OPJ_BOOL bmp_read_info_header(FILE* IN, OPJ_BITMAPINFOHEADER* header)      header->biBitCount  = (OPJ_UINT16)getc(IN);     header->biBitCount |= (OPJ_UINT16)((OPJ_UINT32)getc(IN) << 8);      if (header->biSize >= 40U) {         header->biCompression  = (OPJ_UINT32)getc(IN);

Fixed version (after fix):
 static OPJ_BOOL bmp_read_info_header(FILE* IN, OPJ_BITMAPINFOHEADER* header)      header->biBitCount  = (OPJ_UINT16)getc(IN);     header->biBitCount |= (OPJ_UINT16)((OPJ_UINT32)getc(IN) << 8);     if (header->biBitCount == 0) {         fprintf(stderr, "Error, invalid biBitCount %d\n", 0);         return OPJ_FALSE;     }      if (header->biSize >= 40U) {         header->biCompression  = (OPJ_UINT32)getc(IN);

Patch:
patch: @@ -392,6 +392,10 @@ static OPJ_BOOL bmp_read_info_header(FILE* IN, OPJ_BITMAPINFOHEADER* header)
 
     header->biBitCount  = (OPJ_UINT16)getc(IN);
     header->biBitCount |= (OPJ_UINT16)((OPJ_UINT32)getc(IN) << 8);
+    if (header->biBitCount == 0) {
+        fprintf(stderr, "Error, invalid biBitCount %d\n", 0);
+        return OPJ_FALSE;
+    }
 
     if (header->biSize >= 40U) {
         header->biCompression  = (OPJ_UINT32)getc(IN);
path: src/bin/jp2/convertbmp.c