rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Multiple integer overflows in ext/standard/exec.c in PHP 7.x before 7.0.2 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a long string to the (1) php_escape_shell_cmd or (2) php_escape_shell_arg function, leading to a heap-based buffer overflow.
Vulnerability ID: CVE-2016-1904
CWE: CWE-189
Severity score: 6.4
Project: https://github.com/php/php-src
Published: 2016-01-19
File: ext/standard/exec.c
Commit message: Patch for Heap Buffer Overflow in EscapeShell

Proposed patch for bug #71270
Commit author: libnex

Vulnerable version (before fix):
 PHPAPI zend_string *php_escape_shell_cmd(char *str) #endif   	cmd = zend_string_alloc(2 * l, 0);  	for (x = 0, y = 0; x < l; x++) { 		int mb_len = php_mblen(str + x, (l - x)); PHPAPI zend_string *php_escape_shell_arg(char *str) 	size_t estimate = (4 * l) + 3;   	cmd = zend_string_alloc(4 * l + 2, 0); /* worst case */  #ifdef PHP_WIN32 	ZSTR_VAL(cmd)[y++] = '"';

Fixed version (after fix):
 PHPAPI zend_string *php_escape_shell_cmd(char *str) #endif   	cmd = zend_string_safe_alloc(2, l, 0, 0);  	for (x = 0, y = 0; x < l; x++) { 		int mb_len = php_mblen(str + x, (l - x)); PHPAPI zend_string *php_escape_shell_arg(char *str) 	size_t estimate = (4 * l) + 3;   	cmd = zend_string_safe_alloc(4, l, 2, 0); /* worst case */  #ifdef PHP_WIN32 	ZSTR_VAL(cmd)[y++] = '"';

Patch:
patch: @@ -253,7 +253,7 @@ PHPAPI zend_string *php_escape_shell_cmd(char *str)
 #endif
 
 
-	cmd = zend_string_alloc(2 * l, 0);
+	cmd = zend_string_safe_alloc(2, l, 0, 0);
 
 	for (x = 0, y = 0; x < l; x++) {
 		int mb_len = php_mblen(str + x, (l - x));
@@ -345,7 +345,7 @@ PHPAPI zend_string *php_escape_shell_arg(char *str)
 	size_t estimate = (4 * l) + 3;
 
 
-	cmd = zend_string_alloc(4 * l + 2, 0); /* worst case */
+	cmd = zend_string_safe_alloc(4, l, 2, 0); /* worst case */
 
 #ifdef PHP_WIN32
 	ZSTR_VAL(cmd)[y++] = '"';
path: ext/standard/exec.c
Vulnerability: Cross-site scripting (XSS) vulnerability in the goToFinish1NF function in js/normalization.js in phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a table name to the normalization page.
Vulnerability ID: CVE-2016-2043
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/phpmyadmin/phpmyadmin
Published: 2016-02-20
File: js/normalization.js
Commit message: Fix XSS in normalization.php

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
Commit author: Madhura Jayaratne

Vulnerable version (before fix):
 function goToFinish1NF()     }     $("#mainContent legend").html(PMA_messages.strEndStep);     $("#mainContent h4").html(         "<h3>" + PMA_sprintf(PMA_messages.strFinishMsg, PMA_commonParams.get('table')) + "</h3>"     );     $("#mainContent p").html('');     $("#mainContent #extra").html('');

Fixed version (after fix):
 function goToFinish1NF()     }     $("#mainContent legend").html(PMA_messages.strEndStep);     $("#mainContent h4").html(         "<h3>" + PMA_sprintf(PMA_messages.strFinishMsg, escapeHtml(PMA_commonParams.get('table'))) + "</h3>"     );     $("#mainContent p").html('');     $("#mainContent #extra").html('');

Patch:
patch: @@ -102,7 +102,7 @@ function goToFinish1NF()
     }
     $("#mainContent legend").html(PMA_messages.strEndStep);
     $("#mainContent h4").html(
-        "<h3>" + PMA_sprintf(PMA_messages.strFinishMsg, PMA_commonParams.get('table')) + "</h3>"
+        "<h3>" + PMA_sprintf(PMA_messages.strFinishMsg, escapeHtml(PMA_commonParams.get('table'))) + "</h3>"
     );
     $("#mainContent p").html('');
     $("#mainContent #extra").html('');
path: js/normalization.js
Vulnerability: libraries/sql-parser/autoload.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.
Vulnerability ID: CVE-2016-2044
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/phpmyadmin/phpmyadmin
Published: 2016-02-20
File: libraries/sql-parser/autoload.php
Commit message: Avoid invalid invocation of SQL parser

Signed-off-by: Michal Čihař <michal@cihar.com>
Commit author: Michal Čihař

Vulnerable version (before fix):
 namespace SqlParser\Autoload;  if (!class_exists('SqlParser\\Autoload\\ClassLoader')) {     include_once './libraries/sql-parser/ClassLoader.php'; } 

Fixed version (after fix):
 namespace SqlParser\Autoload;  if (!class_exists('SqlParser\\Autoload\\ClassLoader')) {     if (! file_exists('./libraries/sql-parser/ClassLoader.php')) {         die('Invalid invocation');     }     include_once './libraries/sql-parser/ClassLoader.php'; } 

Patch:
patch: @@ -14,6 +14,9 @@
 namespace SqlParser\Autoload;
 
 if (!class_exists('SqlParser\\Autoload\\ClassLoader')) {
+    if (! file_exists('./libraries/sql-parser/ClassLoader.php')) {
+        die('Invalid invocation');
+    }
     include_once './libraries/sql-parser/ClassLoader.php';
 }
path: libraries/sql-parser/autoload.php
Vulnerability: The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel through 4.5.2 incorrectly enables scatter/gather I/O, which allows remote attackers to obtain sensitive information from kernel memory by reading packet data.
Vulnerability ID: CVE-2016-2117
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2016-05-02
File: drivers/net/ethernet/atheros/atlx/atl2.c
Commit message: atl2: Disable unimplemented scatter/gather feature

atl2 includes NETIF_F_SG in hw_features even though it has no support
for non-linear skbs.  This bug was originally harmless since the
driver does not claim to implement checksum offload and that used to
be a requirement for SG.

Now that SG and checksum offload are independent features, if you
explicitly enable SG *and* use one of the rare protocols that can use
SG without checkusm offload, this potentially leaks sensitive
information (before you notice that it just isn't working).  Therefore
this obscure bug has been designated CVE-2016-2117.

Reported-by: Justin Yackoski <jyackoski@crypto-nite.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Fixes: ec5f06156423 ("net: Kill link between CSUM and SG features.")
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Ben Hutchings

Vulnerable version (before fix):
 static int atl2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)  	err = -EIO;  	netdev->hw_features = NETIF_F_SG | NETIF_F_HW_VLAN_CTAG_RX; 	netdev->features |= (NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX);  	/* Init PHY as early as possible due to power saving issue  */

Fixed version (after fix):
 static int atl2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)  	err = -EIO;  	netdev->hw_features = NETIF_F_HW_VLAN_CTAG_RX; 	netdev->features |= (NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX);  	/* Init PHY as early as possible due to power saving issue  */

Patch:
patch: @@ -1412,7 +1412,7 @@ static int atl2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
 	err = -EIO;
 
-	netdev->hw_features = NETIF_F_SG | NETIF_F_HW_VLAN_CTAG_RX;
+	netdev->hw_features = NETIF_F_HW_VLAN_CTAG_RX;
 	netdev->features |= (NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX);
 
 	/* Init PHY as early as possible due to power saving issue  */
path: drivers/net/ethernet/atheros/atlx/atl2.c
Vulnerability: The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted time-stamp file that is mishandled by the "openssl ts" command.
Vulnerability ID: CVE-2016-2180
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/openssl/openssl
Published: 2016-08-01
File: crypto/ts/ts_lib.c
Commit message: Fix OOB read in TS_OBJ_print_bio().

TS_OBJ_print_bio() misuses OBJ_txt2obj: it should print the result
as a null terminated buffer. The length value returned is the total
length the complete text reprsentation would need not the amount of
data written.

CVE-2016-2180

Thanks to Shi Lei for reporting this bug.

Reviewed-by: Matt Caswell <matt@openssl.org>
Commit author: Dr. Stephen Henson

Vulnerable version (before fix):
 int TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj) {     char obj_txt[128];      int len = OBJ_obj2txt(obj_txt, sizeof(obj_txt), obj, 0);     BIO_write(bio, obj_txt, len);     BIO_write(bio, "\n", 1);      return 1; }

Fixed version (after fix):
 int TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj) {     char obj_txt[128];      OBJ_obj2txt(obj_txt, sizeof(obj_txt), obj, 0);     BIO_printf(bio, "%s\n", obj_txt);      return 1; }

Patch:
patch: @@ -40,9 +40,8 @@ int TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj)
 {
     char obj_txt[128];
 
-    int len = OBJ_obj2txt(obj_txt, sizeof(obj_txt), obj, 0);
-    BIO_write(bio, obj_txt, len);
-    BIO_write(bio, "\n", 1);
+    OBJ_obj2txt(obj_txt, sizeof(obj_txt), obj, 0);
+    BIO_printf(bio, "%s\n", obj_txt);
 
     return 1;
 }
path: crypto/ts/ts_lib.c
Vulnerability: Integer underflow in the decode_level3_header function in lib/lha_file_header.c in Lhasa before 0.3.1 allows remote attackers to execute arbitrary code via a crafted archive.
Vulnerability ID: CVE-2016-2347
CWE: CWE-190
Severity score: 6.4
Project: https://github.com/fragglet/lhasa
Published: 2017-04-21
File: lib/lha_file_header.c
Commit message: Fix integer underflow vulnerability in L3 decode.

Marcin 'Icewall' Noga of Cisco TALOS discovered that the level 3 header
decoding routines were vulnerable to an integer underflow, if the 32-bit
header length was less than the base level 3 header length. This could
lead to an exploitable heap corruption condition.

Thanks go to Marcin Noga and Regina Wilson of Cisco TALOS for reporting
this vulnerability.
Commit author: Simon Howard

Vulnerable version (before fix):
 static uint8_t *extend_raw_data(LHAFileHeader **header, 	size_t new_raw_len; 	uint8_t *result;  	// Reallocate the header and raw_data area to be larger.  	new_raw_len = RAW_DATA_LEN(header) + nbytes; static int decode_level3_header(LHAFileHeader **header, LHAInputStream *stream)  	header_len = lha_decode_uint32(&RAW_DATA(header, 24));  	if (header_len > LEVEL_3_MAX_HEADER_LEN) { 		return 0; 	} 

Fixed version (after fix):
 static uint8_t *extend_raw_data(LHAFileHeader **header, 	size_t new_raw_len; 	uint8_t *result;  	if (nbytes > LEVEL_3_MAX_HEADER_LEN) { 		return NULL; 	}  	// Reallocate the header and raw_data area to be larger.  	new_raw_len = RAW_DATA_LEN(header) + nbytes; static int decode_level3_header(LHAFileHeader **header, LHAInputStream *stream)  	header_len = lha_decode_uint32(&RAW_DATA(header, 24));  	if (header_len > LEVEL_3_MAX_HEADER_LEN 	 || header_len < RAW_DATA_LEN(header)) { 		return 0; 	} 

Patch:
patch: @@ -351,6 +351,10 @@ static uint8_t *extend_raw_data(LHAFileHeader **header,
 	size_t new_raw_len;
 	uint8_t *result;
 
+	if (nbytes > LEVEL_3_MAX_HEADER_LEN) {
+		return NULL;
+	}
+
 	// Reallocate the header and raw_data area to be larger.
 
 	new_raw_len = RAW_DATA_LEN(header) + nbytes;
@@ -797,7 +801,8 @@ static int decode_level3_header(LHAFileHeader **header, LHAInputStream *stream)
 
 	header_len = lha_decode_uint32(&RAW_DATA(header, 24));
 
-	if (header_len > LEVEL_3_MAX_HEADER_LEN) {
+	if (header_len > LEVEL_3_MAX_HEADER_LEN
+	 || header_len < RAW_DATA_LEN(header)) {
 		return 0;
 	}
path: lib/lha_file_header.c
Vulnerability: Heap-based buffer overflow in the encode_msg function in encode_msg.c in the SEAS module in Kamailio (formerly OpenSER and SER) before 4.3.5 allows remote attackers to cause a denial of service (memory corruption and process crash) or possibly execute arbitrary code via a large SIP packet.
Vulnerability ID: CVE-2016-2385
CWE: CWE-119
Severity score: 10
Project: https://github.com/kamailio/kamailio
Published: 2016-04-11
File: modules/seas/encode_msg.c
Commit message: seas: safety check for target buffer size before copying message in encode_msg()

- avoid buffer overflow for large SIP messages
- reported by Stelios Tsampas
Commit author: Daniel-Constantin Mierla

Vulnerable version (before fix):
 int encode_msg(struct sip_msg *msg,char *payload,int len)     if(len < MAX_ENCODED_MSG + MAX_MESSAGE_LEN)       return -1;    if(parse_headers(msg,HDR_EOH_F,0)<0){       myerror="in parse_headers";       goto error; int encode_msg(struct sip_msg *msg,char *payload,int len)    /*j+=k;*/    /*pkg_free(payload2);*/    /*now we copy the actual message after the headers-meta-section*/    memcpy(&payload[j],msg->buf,msg->len);    LM_DBG("msglen = %d,msg starts at %d\n",msg->len,j);    j=htons(j);

Fixed version (after fix):
 int encode_msg(struct sip_msg *msg,char *payload,int len)     if(len < MAX_ENCODED_MSG + MAX_MESSAGE_LEN)       return -1;     if(parse_headers(msg,HDR_EOH_F,0)<0){       myerror="in parse_headers";       goto error; int encode_msg(struct sip_msg *msg,char *payload,int len)    /*j+=k;*/    /*pkg_free(payload2);*/    /*now we copy the actual message after the headers-meta-section*/  	if(len < j + msg->len + 1) {    	   LM_ERR("not enough space to encode sip message\n");    	   return -1; 	}    memcpy(&payload[j],msg->buf,msg->len);    LM_DBG("msglen = %d,msg starts at %d\n",msg->len,j);    j=htons(j);

Patch:
patch: @@ -158,6 +158,7 @@ int encode_msg(struct sip_msg *msg,char *payload,int len)
 
    if(len < MAX_ENCODED_MSG + MAX_MESSAGE_LEN)
       return -1;
+
    if(parse_headers(msg,HDR_EOH_F,0)<0){
       myerror="in parse_headers";
       goto error;
@@ -266,6 +267,11 @@ int encode_msg(struct sip_msg *msg,char *payload,int len)
    /*j+=k;*/
    /*pkg_free(payload2);*/
    /*now we copy the actual message after the headers-meta-section*/
+
+	if(len < j + msg->len + 1) {
+   	   LM_ERR("not enough space to encode sip message\n");
+   	   return -1;
+	}
    memcpy(&payload[j],msg->buf,msg->len);
    LM_DBG("msglen = %d,msg starts at %d\n",msg->len,j);
    j=htons(j);
path: modules/seas/encode_msg.c
Vulnerability: Race condition in the queue_delete function in sound/core/seq/seq_queue.c in the Linux kernel before 4.4.1 allows local users to cause a denial of service (use-after-free and system crash) by making an ioctl call at a certain time.
Vulnerability ID: CVE-2016-2544
CWE: CWE-362
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2016-04-27
File: sound/core/seq/seq_queue.c
Commit message: ALSA: seq: Fix race at timer setup and close

ALSA sequencer code has an open race between the timer setup ioctl and
the close of the client.  This was triggered by syzkaller fuzzer, and
a use-after-free was caught there as a result.

This patch papers over it by adding a proper queue->timer_mutex lock
around the timer-related calls in the relevant code path.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Commit author: Takashi Iwai

Vulnerable version (before fix):
 static struct snd_seq_queue *queue_new(int owner, int locked) static void queue_delete(struct snd_seq_queue *q) { 	/* stop and release the timer */ 	snd_seq_timer_stop(q->timer); 	snd_seq_timer_close(q); 	/* wait until access free */ 	snd_use_lock_sync(&q->use_lock); 	/* release resources... */

Fixed version (after fix):
 static struct snd_seq_queue *queue_new(int owner, int locked) static void queue_delete(struct snd_seq_queue *q) { 	/* stop and release the timer */ 	mutex_lock(&q->timer_mutex); 	snd_seq_timer_stop(q->timer); 	snd_seq_timer_close(q); 	mutex_unlock(&q->timer_mutex); 	/* wait until access free */ 	snd_use_lock_sync(&q->use_lock); 	/* release resources... */

Patch:
patch: @@ -142,8 +142,10 @@ static struct snd_seq_queue *queue_new(int owner, int locked)
 static void queue_delete(struct snd_seq_queue *q)
 {
 	/* stop and release the timer */
+	mutex_lock(&q->timer_mutex);
 	snd_seq_timer_stop(q->timer);
 	snd_seq_timer_close(q);
+	mutex_unlock(&q->timer_mutex);
 	/* wait until access free */
 	snd_use_lock_sync(&q->use_lock);
 	/* release resources... */
path: sound/core/seq/seq_queue.c
Vulnerability: The snd_timer_interrupt function in sound/core/timer.c in the Linux kernel before 4.4.1 does not properly maintain a certain linked list, which allows local users to cause a denial of service (race condition and system crash) via a crafted ioctl call.
Vulnerability ID: CVE-2016-2545
CWE: CWE-362
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2016-04-27
File: sound/core/timer.c
Commit message: ALSA: timer: Fix double unlink of active_list

ALSA timer instance object has a couple of linked lists and they are
unlinked unconditionally at snd_timer_stop().  Meanwhile
snd_timer_interrupt() unlinks it, but it calls list_del() which leaves
the element list itself unchanged.  This ends up with unlinking twice,
and it was caught by syzkaller fuzzer.

The fix is to use list_del_init() variant properly there, too.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Commit author: Takashi Iwai

Vulnerable version (before fix):
 void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left) 		} else { 			ti->flags &= ~SNDRV_TIMER_IFLG_RUNNING; 			if (--timer->running) 				list_del(&ti->active_list); 		} 		if ((timer->hw.flags & SNDRV_TIMER_HW_TASKLET) || 		    (ti->flags & SNDRV_TIMER_IFLG_FAST))

Fixed version (after fix):
 void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left) 		} else { 			ti->flags &= ~SNDRV_TIMER_IFLG_RUNNING; 			if (--timer->running) 				list_del_init(&ti->active_list); 		} 		if ((timer->hw.flags & SNDRV_TIMER_HW_TASKLET) || 		    (ti->flags & SNDRV_TIMER_IFLG_FAST))

Patch:
patch: @@ -694,7 +694,7 @@ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left)
 		} else {
 			ti->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
 			if (--timer->running)
-				list_del(&ti->active_list);
+				list_del_init(&ti->active_list);
 		}
 		if ((timer->hw.flags & SNDRV_TIMER_HW_TASKLET) ||
 		    (ti->flags & SNDRV_TIMER_IFLG_FAST))
path: sound/core/timer.c
Vulnerability: sound/core/hrtimer.c in the Linux kernel before 4.4.1 does not prevent recursive callback access, which allows local users to cause a denial of service (deadlock) via a crafted ioctl call.
Vulnerability ID: CVE-2016-2549
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2016-04-27
File: sound/core/hrtimer.c
Commit message: ALSA: hrtimer: Fix stall by hrtimer_cancel()

hrtimer_cancel() waits for the completion from the callback, thus it
must not be called inside the callback itself.  This was already a
problem in the past with ALSA hrtimer driver, and the early commit
[fcfdebe70759: ALSA: hrtimer - Fix lock-up] tried to address it.

However, the previous fix is still insufficient: it may still cause a
lockup when the ALSA timer instance reprograms itself in its callback.
Then it invokes the start function even in snd_timer_interrupt() that
is called in hrtimer callback itself, results in a CPU stall.  This is
no hypothetical problem but actually triggered by syzkaller fuzzer.

This patch tries to fix the issue again.  Now we call
hrtimer_try_to_cancel() at both start and stop functions so that it
won't fall into a deadlock, yet giving some chance to cancel the queue
if the functions have been called outside the callback.  The proper
hrtimer_cancel() is called in anyway at closing, so this should be
enough.

Reported-and-tested-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Commit author: Takashi Iwai

Vulnerable version (before fix):
 static int snd_hrtimer_start(struct snd_timer *t) 	struct snd_hrtimer *stime = t->private_data;  	atomic_set(&stime->running, 0); 	hrtimer_cancel(&stime->hrt); 	hrtimer_start(&stime->hrt, ns_to_ktime(t->sticks * resolution), 		      HRTIMER_MODE_REL); 	atomic_set(&stime->running, 1); static int snd_hrtimer_stop(struct snd_timer *t) { 	struct snd_hrtimer *stime = t->private_data; 	atomic_set(&stime->running, 0); 	return 0; } 

Fixed version (after fix):
 static int snd_hrtimer_start(struct snd_timer *t) 	struct snd_hrtimer *stime = t->private_data;  	atomic_set(&stime->running, 0); 	hrtimer_try_to_cancel(&stime->hrt); 	hrtimer_start(&stime->hrt, ns_to_ktime(t->sticks * resolution), 		      HRTIMER_MODE_REL); 	atomic_set(&stime->running, 1); static int snd_hrtimer_stop(struct snd_timer *t) { 	struct snd_hrtimer *stime = t->private_data; 	atomic_set(&stime->running, 0); 	hrtimer_try_to_cancel(&stime->hrt); 	return 0; } 

Patch:
patch: @@ -90,7 +90,7 @@ static int snd_hrtimer_start(struct snd_timer *t)
 	struct snd_hrtimer *stime = t->private_data;
 
 	atomic_set(&stime->running, 0);
-	hrtimer_cancel(&stime->hrt);
+	hrtimer_try_to_cancel(&stime->hrt);
 	hrtimer_start(&stime->hrt, ns_to_ktime(t->sticks * resolution),
 		      HRTIMER_MODE_REL);
 	atomic_set(&stime->running, 1);
@@ -101,6 +101,7 @@ static int snd_hrtimer_stop(struct snd_timer *t)
 {
 	struct snd_hrtimer *stime = t->private_data;
 	atomic_set(&stime->running, 0);
+	hrtimer_try_to_cancel(&stime->hrt);
 	return 0;
 }
path: sound/core/hrtimer.c
Vulnerability: Cross-site scripting (XSS) vulnerability in the format function in libraries/sql-parser/src/Utils/Error.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted query.
Vulnerability ID: CVE-2016-2559
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/phpmyadmin/phpmyadmin
Published: 2016-03-01
File: libraries/sql-parser/src/Utils/Error.php
Commit message: Escape query when displaying

Signed-off-by: Michal Čihař <michal@cihar.com>
Commit author: Michal Čihař

Vulnerable version (before fix):
 public static function format(                 ++$i,                 $err[0],                 $err[1],                 $err[2],                 $err[3]             );         }

Fixed version (after fix):
 public static function format(                 ++$i,                 $err[0],                 $err[1],                 htmlspecialchars($err[2]),                 $err[3]             );         }

Patch:
patch: @@ -90,7 +90,7 @@ public static function format(
                 ++$i,
                 $err[0],
                 $err[1],
-                $err[2],
+                htmlspecialchars($err[2]),
                 $err[3]
             );
         }
path: libraries/sql-parser/src/Utils/Error.php