rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: nopCommerce 4.50.1 is vulnerable to Directory Traversal via the backup file in the Maintenance feature.
Vulnerability ID: CVE-2022-28451
CWE: CWE-22
Severity score: 2.9
Project: https://github.com/nopSolutions/nopCommerce
Published: 2022-05-02
File: src/Presentation/Nop.Web/Areas/Admin/Controllers/CommonController.cs
Commit message: Fixed a possible issue with database backup filenames
Commit author: skoshelev

Vulnerable version (before fix):
 public virtual async Task<IActionResult> BackupAction(MaintenanceModel model)             var action = Request.Form["action"];              var fileName = Request.Form["backupFileName"];             var backupPath = _maintenanceService.GetBackupPath(fileName);              try

Fixed version (after fix):
 public virtual async Task<IActionResult> BackupAction(MaintenanceModel model)             var action = Request.Form["action"];              var fileName = Request.Form["backupFileName"];             fileName = _fileProvider.GetFileName(_fileProvider.GetAbsolutePath(fileName));              var backupPath = _maintenanceService.GetBackupPath(fileName);              try

Patch:
patch: @@ -262,6 +262,8 @@ public virtual async Task<IActionResult> BackupAction(MaintenanceModel model)
             var action = Request.Form["action"];
 
             var fileName = Request.Form["backupFileName"];
+            fileName = _fileProvider.GetFileName(_fileProvider.GetAbsolutePath(fileName));
+
             var backupPath = _maintenanceService.GetBackupPath(fileName);
 
             try
path: src/Presentation/Nop.Web/Areas/Admin/Controllers/CommonController.cs
Vulnerability: An issue was discovered in MISP before 2.4.158. There is XSS in app/Controller/OrganisationsController.php in a situation with a "weird single checkbox page."
Vulnerability ID: CVE-2022-29533
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/MISP/MISP
Published: 2022-04-20
File: app/Controller/OrganisationsController.php
Commit message: fix: [security] low probability reflected XSS fixed

- User would need to navigate to a url that contains the payload
- user needs to click on a checkbox in a weird single checkbox page to trigger the exploit

- as reported by Dawid Czarnecki of Zigrin Security on behalf of the Luxembourg Army
Commit author: iglocska

Vulnerable version (before fix):
 public function fetchSGOrgRow($id, $removable = false, $extend = false)     {         $this->layout = false;         $this->autoRender = false;         $this->set('id', $id);         $this->set('removable', $removable);         $this->set('extend', $extend);         $this->render('ajax/sg_org_row_empty');

Fixed version (after fix):
 public function fetchSGOrgRow($id, $removable = false, $extend = false)     {         $this->layout = false;         $this->autoRender = false;         $this->set('id', (int)$id);         $this->set('removable', $removable);         $this->set('extend', $extend);         $this->render('ajax/sg_org_row_empty');

Patch:
patch: @@ -392,7 +392,7 @@ public function fetchSGOrgRow($id, $removable = false, $extend = false)
     {
         $this->layout = false;
         $this->autoRender = false;
-        $this->set('id', $id);
+        $this->set('id', (int)$id);
         $this->set('removable', $removable);
         $this->set('extend', $extend);
         $this->render('ajax/sg_org_row_empty');
path: app/Controller/OrganisationsController.php
Vulnerability: Unicorn Engine v2.0.0-rc7 and below was discovered to contain a memory leak via the function uc_close at /my/unicorn/uc.c.
Vulnerability ID: CVE-2022-29693
CWE: CWE-401
Severity score: 2.9
Project: https://github.com/unicorn-engine/unicorn
Published: 2022-06-02
File: uc.c
Commit message: Merge pull request #1587 from liyansong2018/dev

Fix https://github.com/unicorn-engine/unicorn/issues/1586
Commit author: lazymio

Vulnerable version (before fix):
 uc_err uc_open(uc_arch arch, uc_mode mode, uc_engine **result)         }          if (uc->init_arch == NULL) {             return UC_ERR_ARCH;         } 

Fixed version (after fix):
 uc_err uc_open(uc_arch arch, uc_mode mode, uc_engine **result)         }          if (uc->init_arch == NULL) {             free(uc);             return UC_ERR_ARCH;         } 

Patch:
patch: @@ -388,6 +388,7 @@ uc_err uc_open(uc_arch arch, uc_mode mode, uc_engine **result)
         }
 
         if (uc->init_arch == NULL) {
+            free(uc);
             return UC_ERR_ARCH;
         }
path: uc.c
Vulnerability: ZoneMinder before 1.36.13 allows remote code execution via an invalid language. Ability to create a debug log file at an arbitrary pathname contributes to exploitability.
Vulnerability ID: CVE-2022-29806
CWE: CWE-22
Severity score: 6.4
Project: https://github.com/ZoneMinder/zoneminder
Published: 2022-04-26
File: web/includes/lang.php
Commit message: detaint language file.
Commit author: Isaac Connor

Vulnerable version (before fix):
 function translate($name) { function loadLanguage($prefix='') {   global $user;    if ( $prefix )     $prefix = $prefix.'/';    if ( isset($user['Language']) and $user['Language'] ) {     $userLangFile = $prefix.'lang/'.$user['Language'].'.php';      if ( file_exists($userLangFile) ) {       return $userLangFile;     } else {       ZM\Warning("User language file $userLangFile does not exist.");     }   }    $systemLangFile = $prefix.'lang/'.ZM_LANG_DEFAULT.'.php';   if ( file_exists($systemLangFile) ) {     return $systemLangFile;   } else {

Fixed version (after fix):
 function translate($name) { function loadLanguage($prefix='') {   global $user;    if ($prefix)     $prefix = $prefix.'/';    if (isset($user['Language']) and $user['Language']) {     # Languages can only have letters, numbers and underscore     $userLangFile = $prefix.'lang/'.preg_replace('/[^[:alnum:]_]+/', '', $user['Language']).'.php';      if (file_exists($userLangFile)) {       return $userLangFile;     } else {       ZM\Warning("User language file $userLangFile does not exist.");     }   }    $systemLangFile = $prefix.'lang/'.preg_replace('/[^[:alnum:]_]+/', '', ZM_LANG_DEFAULT).'.php';   if ( file_exists($systemLangFile) ) {     return $systemLangFile;   } else {

Patch:
patch: @@ -30,20 +30,21 @@ function translate($name) {
 function loadLanguage($prefix='') {
   global $user;
 
-  if ( $prefix )
+  if ($prefix)
     $prefix = $prefix.'/';
 
-  if ( isset($user['Language']) and $user['Language'] ) {
-    $userLangFile = $prefix.'lang/'.$user['Language'].'.php';
+  if (isset($user['Language']) and $user['Language']) {
+    # Languages can only have letters, numbers and underscore
+    $userLangFile = $prefix.'lang/'.preg_replace('/[^[:alnum:]_]+/', '', $user['Language']).'.php';
 
-    if ( file_exists($userLangFile) ) {
+    if (file_exists($userLangFile)) {
       return $userLangFile;
     } else {
       ZM\Warning("User language file $userLangFile does not exist.");
     }
   }
 
-  $systemLangFile = $prefix.'lang/'.ZM_LANG_DEFAULT.'.php';
+  $systemLangFile = $prefix.'lang/'.preg_replace('/[^[:alnum:]_]+/', '', ZM_LANG_DEFAULT).'.php';
   if ( file_exists($systemLangFile) ) {
     return $systemLangFile;
   } else {
path: web/includes/lang.php
Vulnerability: Heap-based buffer overflow in sqbaselib.cpp in SQUIRREL 3.2 due to lack of a certain sq_reservestack call.
Vulnerability ID: CVE-2022-30292
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/albertodemichelis/squirrel
Published: 2022-05-04
File: squirrel/sqbaselib.cpp
Commit message: fix in thread.call
Commit author: Alberto Demichelis

Vulnerable version (before fix):
 static SQInteger thread_call(HSQUIRRELVM v)     SQObjectPtr o = stack_get(v,1);     if(sq_type(o) == OT_THREAD) {         SQInteger nparams = sq_gettop(v);         _thread(o)->Push(_thread(o)->_roottable);         for(SQInteger i = 2; i<(nparams+1); i++)             sq_move(_thread(o),v,i);

Fixed version (after fix):
 static SQInteger thread_call(HSQUIRRELVM v)     SQObjectPtr o = stack_get(v,1);     if(sq_type(o) == OT_THREAD) {         SQInteger nparams = sq_gettop(v);         sq_reservestack(_thread(o), nparams + 3);         _thread(o)->Push(_thread(o)->_roottable);         for(SQInteger i = 2; i<(nparams+1); i++)             sq_move(_thread(o),v,i);

Patch:
patch: @@ -1149,6 +1149,7 @@ static SQInteger thread_call(HSQUIRRELVM v)
     SQObjectPtr o = stack_get(v,1);
     if(sq_type(o) == OT_THREAD) {
         SQInteger nparams = sq_gettop(v);
+        sq_reservestack(_thread(o), nparams + 3);
         _thread(o)->Push(_thread(o)->_roottable);
         for(SQInteger i = 2; i<(nparams+1); i++)
             sq_move(_thread(o),v,i);
path: squirrel/sqbaselib.cpp
Vulnerability: nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has an unbounded memcpy with a failed length check, leading to a buffer overflow. NOTE: this issue exists because of an incorrect fix for CVE-2019-14196.
Vulnerability ID: CVE-2022-30767
CWE: CWE-120
Severity score: 6.4
Project: https://github.com/u-boot/u-boot
Published: 2022-05-16
File: net/nfs.c
Commit message: CVE-2019-14196: nfs: fix unbounded memcpy with a failed length check at nfs_lookup_reply

This patch adds a check to rpc_pkt.u.reply.data at nfs_lookup_reply.

Signed-off-by: Cheng Liu <liucheng32@huawei.com>
Reported-by: Fermín Serna <fermin@semmle.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
Commit author: liucheng (G)

Vulnerable version (before fix):
 static int nfs_lookup_reply(uchar *pkt, unsigned len) 	}  	if (supported_nfs_versions & NFSV2_FLAG) { 		memcpy(filefh, rpc_pkt.u.reply.data + 1, NFS_FHSIZE); 	} else {  /* NFSV3_FLAG */ 		filefh3_length = ntohl(rpc_pkt.u.reply.data[1]); 		if (filefh3_length > NFS3_FHSIZE) 			filefh3_length  = NFS3_FHSIZE; 		memcpy(filefh, rpc_pkt.u.reply.data + 2, filefh3_length); 	} 

Fixed version (after fix):
 static int nfs_lookup_reply(uchar *pkt, unsigned len) 	}  	if (supported_nfs_versions & NFSV2_FLAG) { 		if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + NFS_FHSIZE) > len) 			return -NFS_RPC_DROP; 		memcpy(filefh, rpc_pkt.u.reply.data + 1, NFS_FHSIZE); 	} else {  /* NFSV3_FLAG */ 		filefh3_length = ntohl(rpc_pkt.u.reply.data[1]); 		if (filefh3_length > NFS3_FHSIZE) 			filefh3_length  = NFS3_FHSIZE; 		if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + filefh3_length) > len) 			return -NFS_RPC_DROP; 		memcpy(filefh, rpc_pkt.u.reply.data + 2, filefh3_length); 	} 

Patch:
patch: @@ -566,11 +566,15 @@ static int nfs_lookup_reply(uchar *pkt, unsigned len)
 	}
 
 	if (supported_nfs_versions & NFSV2_FLAG) {
+		if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + NFS_FHSIZE) > len)
+			return -NFS_RPC_DROP;
 		memcpy(filefh, rpc_pkt.u.reply.data + 1, NFS_FHSIZE);
 	} else {  /* NFSV3_FLAG */
 		filefh3_length = ntohl(rpc_pkt.u.reply.data[1]);
 		if (filefh3_length > NFS3_FHSIZE)
 			filefh3_length  = NFS3_FHSIZE;
+		if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + filefh3_length) > len)
+			return -NFS_RPC_DROP;
 		memcpy(filefh, rpc_pkt.u.reply.data + 2, filefh3_length);
 	}
path: net/nfs.c
Vulnerability: Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to FreeSWITCH, which may cause crash. This type of crash may be caused by `#define MATCH(s, m) (strncmp(s, m, n = sizeof(m) - 1) == 0)`, which will make `n` bigger and trigger out-of-bound access when `IS_NON_WS(s[n])`. Version 1.13.8 contains a patch for this issue.
Vulnerability ID: CVE-2022-31001
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/freeswitch/sofia-sip
Published: 2022-05-31
File: libsofia-sip-ua/sip/sip_parser.c
Commit message: Merge pull request from GHSA-79jq-hh82-cv9g

Fix Out-of-bound read in sip_method_d
Commit author: Andrey Volk

Vulnerable version (before fix):
 sip_method_t sip_method_d(char **ss, char const **return_name)  #undef MATCH    if (IS_NON_WS(s[n]))     /* Unknown method */     code = sip_method_unknown;

Fixed version (after fix):
 sip_method_t sip_method_d(char **ss, char const **return_name)  #undef MATCH    if (strlen(s) < n) {     return sip_method_invalid;   }    if (IS_NON_WS(s[n]))     /* Unknown method */     code = sip_method_unknown;

Patch:
patch: @@ -454,6 +454,10 @@ sip_method_t sip_method_d(char **ss, char const **return_name)
 
 #undef MATCH
 
+  if (strlen(s) < n) {
+    return sip_method_invalid;
+  }
+
   if (IS_NON_WS(s[n]))
     /* Unknown method */
     code = sip_method_unknown;
path: libsofia-sip-ua/sip/sip_parser.c
Vulnerability: Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to FreeSWITCH, which may cause a crash. This type of crash may be caused by a URL ending with `%`. Version 1.13.8 contains a patch for this issue.
Vulnerability ID: CVE-2022-31002
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/freeswitch/sofia-sip
Published: 2022-05-31
File: libsofia-sip-ua/url/url.c
Commit message: Merge pull request from GHSA-g3x6-p824-x6hm

Fix Out-of-bound read in url_canonize2 and url_canonize3
Commit author: Andrey Volk

Vulnerable version (before fix):
 char *url_canonize2(char *d, char const * const s, size_t n,       continue;     }      h1 = s[i + 1], h2 = s[i + 2];      if (!IS_HEX(h1) || !IS_HEX(h2)) {       *d = '\0'; char *url_canonize3(char *d, char const * const s, size_t n,       continue;     }      h1 = s[i + 1], h2 = s[i + 2];      if (!IS_HEX(h1) || !IS_HEX(h2)) {       *d = '\0';

Fixed version (after fix):
 char *url_canonize2(char *d, char const * const s, size_t n,       continue;     }      h1 = s[i + 1];     if (!h1) {         *d = '\0';         return NULL;     }     h2 = s[i + 2];      if (!IS_HEX(h1) || !IS_HEX(h2)) {       *d = '\0'; char *url_canonize3(char *d, char const * const s, size_t n,       continue;     }      h1 = s[i + 1];     if (!h1) {         *d = '\0';         return NULL;     }     h2 = s[i + 2];      if (!IS_HEX(h1) || !IS_HEX(h2)) {       *d = '\0';

Patch:
patch: @@ -364,7 +364,12 @@ char *url_canonize2(char *d, char const * const s, size_t n,
       continue;
     }
 
-    h1 = s[i + 1], h2 = s[i + 2];
+    h1 = s[i + 1];
+    if (!h1) {
+        *d = '\0';
+        return NULL;
+    }
+    h2 = s[i + 2];
 
     if (!IS_HEX(h1) || !IS_HEX(h2)) {
       *d = '\0';
@@ -422,7 +427,12 @@ char *url_canonize3(char *d, char const * const s, size_t n,
       continue;
     }
 
-    h1 = s[i + 1], h2 = s[i + 2];
+    h1 = s[i + 1];
+    if (!h1) {
+        *d = '\0';
+        return NULL;
+    }
+    h2 = s[i + 2];
 
     if (!IS_HEX(h1) || !IS_HEX(h2)) {
       *d = '\0';
path: libsofia-sip-ua/url/url.c
Vulnerability: Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, when parsing each line of a sdp message, `rest = record + 2` will access the memory behind `\0` and cause an out-of-bounds write. An attacker can send a message with evil sdp to FreeSWITCH, causing a crash or more serious consequence, such as remote code execution. Version 1.13.8 contains a patch for this issue.
Vulnerability ID: CVE-2022-31003
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/freeswitch/sofia-sip
Published: 2022-05-31
File: libsofia-sip-ua/sdp/sdp_parse.c
Commit message: Merge pull request from GHSA-8w5j-6g2j-pxcp

Fix Heap-buffer-overflow in parse_descs and parse_message
Commit author: Andrey Volk

Vulnerable version (before fix):
 static void parse_message(sdp_parser_t *p)        record = next(&message, CRLF, strip)) {     field = record[0];      rest = record + 2; rest += strspn(rest, strip);      if (record[1] != '=') { static void parse_descs(sdp_parser_t *p,        record = next(&message, CRLF, strip)) {     char field = record[0];      rest = record + 2; rest += strspn(rest, strip);      if (record[1] == '=') switch (field) {

Fixed version (after fix):
 static void parse_message(sdp_parser_t *p)        record = next(&message, CRLF, strip)) {     field = record[0];      if (strlen(record) < 2) {       return;     }      rest = record + 2; rest += strspn(rest, strip);      if (record[1] != '=') { static void parse_descs(sdp_parser_t *p,        record = next(&message, CRLF, strip)) {     char field = record[0];      if (strlen(record) < 2) {       return;     }      rest = record + 2; rest += strspn(rest, strip);      if (record[1] == '=') switch (field) {

Patch:
patch: @@ -396,6 +396,10 @@ static void parse_message(sdp_parser_t *p)
        record = next(&message, CRLF, strip)) {
     field = record[0];
 
+    if (strlen(record) < 2) {
+      return;
+    }
+
     rest = record + 2; rest += strspn(rest, strip);
 
     if (record[1] != '=') {
@@ -1763,6 +1767,10 @@ static void parse_descs(sdp_parser_t *p,
        record = next(&message, CRLF, strip)) {
     char field = record[0];
 
+    if (strlen(record) < 2) {
+      return;
+    }
+
     rest = record + 2; rest += strspn(rest, strip);
 
     if (record[1] == '=') switch (field) {
path: libsofia-sip-ua/sdp/sdp_parse.c
Vulnerability: AdminLTE is a Pi-hole Dashboard for stats and configuration. In affected versions inserting code like `<script>alert("XSS")</script>` in the field marked with "Domain to look for" and hitting <kbd>enter</kbd> (or clicking on any of the buttons) will execute the script. The user must be logged in to use this vulnerability. Usually only administrators have login access to pi-hole, minimizing the risks. Users are advised to upgrade. There are no known workarounds for this issue.
Vulnerability ID: CVE-2022-31029
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/pi-hole/AdminLTE
Published: 2022-07-07
File: scripts/pi-hole/php/queryads.php
Commit message: Merge pull request from GHSA-cfr5-rqm5-9vhp

Fix/ghsa-cfr5-rqm5-9vhp - Possible XSS in queryads.php
Commit author: Adam Warner

Vulnerable version (before fix):
 function echoEvent($datatext) { {     // Is this a valid domain?     $url = idn_to_ascii($_GET["domain"]);     if(!validDomain($url))     {         echoEvent("$url is an invalid domain!");         die();     } }

Fixed version (after fix):
 function echoEvent($datatext) { {     // Is this a valid domain?     $url = idn_to_ascii($_GET["domain"]);     if (!validDomain($url)) {         echoEvent(htmlentities($url)." is an invalid domain!");         die();     } }

Patch:
patch: @@ -27,9 +27,8 @@ function echoEvent($datatext) {
 {
     // Is this a valid domain?
     $url = idn_to_ascii($_GET["domain"]);
-    if(!validDomain($url))
-    {
-        echoEvent("$url is an invalid domain!");
+    if (!validDomain($url)) {
+        echoEvent(htmlentities($url)." is an invalid domain!");
         die();
     }
 }
path: scripts/pi-hole/php/queryads.php
Vulnerability: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions prior to and including 2.12.1 a stack buffer overflow vulnerability affects PJSIP users that use STUN in their applications, either by: setting a STUN server in their account/media config in PJSUA/PJSUA2 level, or directly using `pjlib-util/stun_simple` API. A patch is available in commit 450baca which should be included in the next release. There are no known workarounds for this issue.
Vulnerability ID: CVE-2022-31031
CWE: CWE-120
Severity score: 6.4
Project: https://github.com/pjsip/pjproject
Published: 2022-06-09
File: pjlib-util/src/pjlib-util/stun_simple.c
Commit message: Merge pull request from GHSA-26j7-ww69-c4qj
Commit author: sauwming

Vulnerable version (before fix):
 PJ_DEF(pj_status_t) pjstun_parse_msg( void *buf, pj_size_t buf_len, {     pj_uint16_t msg_type, msg_len;     char *p_attr;      PJ_CHECK_STACK();  PJ_DEF(pj_status_t) pjstun_parse_msg( void *buf, pj_size_t buf_len,     msg->attr_count = 0;     p_attr = (char*)buf + sizeof(pjstun_msg_hdr);      while (msg_len > 0) { 	pjstun_attr_hdr **attr = &msg->attr[msg->attr_count]; 	pj_uint32_t len; 	pj_uint16_t attr_type; PJ_DEF(pj_status_t) pjstun_parse_msg( void *buf, pj_size_t buf_len, 	p_attr += len; 	++msg->attr_count;     }      return PJ_SUCCESS; }

Fixed version (after fix):
 PJ_DEF(pj_status_t) pjstun_parse_msg( void *buf, pj_size_t buf_len, {     pj_uint16_t msg_type, msg_len;     char *p_attr;     int attr_max_cnt = PJ_ARRAY_SIZE(msg->attr);      PJ_CHECK_STACK();  PJ_DEF(pj_status_t) pjstun_parse_msg( void *buf, pj_size_t buf_len,     msg->attr_count = 0;     p_attr = (char*)buf + sizeof(pjstun_msg_hdr);      while (msg_len > 0 && msg->attr_count < attr_max_cnt) { 	pjstun_attr_hdr **attr = &msg->attr[msg->attr_count]; 	pj_uint32_t len; 	pj_uint16_t attr_type; PJ_DEF(pj_status_t) pjstun_parse_msg( void *buf, pj_size_t buf_len, 	p_attr += len; 	++msg->attr_count;     }     if (msg->attr_count == attr_max_cnt) { 	PJ_LOG(4, (THIS_FILE, "Warning: max number attribute %d reached.", 		   attr_max_cnt));     }      return PJ_SUCCESS; }

Patch:
patch: @@ -54,6 +54,7 @@ PJ_DEF(pj_status_t) pjstun_parse_msg( void *buf, pj_size_t buf_len,
 {
     pj_uint16_t msg_type, msg_len;
     char *p_attr;
+    int attr_max_cnt = PJ_ARRAY_SIZE(msg->attr);
 
     PJ_CHECK_STACK();
 
@@ -83,7 +84,7 @@ PJ_DEF(pj_status_t) pjstun_parse_msg( void *buf, pj_size_t buf_len,
     msg->attr_count = 0;
     p_attr = (char*)buf + sizeof(pjstun_msg_hdr);
 
-    while (msg_len > 0) {
+    while (msg_len > 0 && msg->attr_count < attr_max_cnt) {
 	pjstun_attr_hdr **attr = &msg->attr[msg->attr_count];
 	pj_uint32_t len;
 	pj_uint16_t attr_type;
@@ -111,6 +112,10 @@ PJ_DEF(pj_status_t) pjstun_parse_msg( void *buf, pj_size_t buf_len,
 	p_attr += len;
 	++msg->attr_count;
     }
+    if (msg->attr_count == attr_max_cnt) {
+	PJ_LOG(4, (THIS_FILE, "Warning: max number attribute %d reached.",
+		   attr_max_cnt));
+    }
 
     return PJ_SUCCESS;
 }
path: pjlib-util/src/pjlib-util/stun_simple.c