rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The g2m_init_buffers function in libavcodec/g2meet.c in FFmpeg before 2.1 does not properly allocate memory for tiles, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Go2Webinar data.
Vulnerability ID: CVE-2013-7022
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/FFmpeg/FFmpeg
Published: 2013-12-09
File: libavcodec/g2meet.c
Commit message: avcodec/g2meet: Fix framebuf size

Currently the code can in some cases draw tiles that hang outside the
allocated buffer. This patch increases the buffer size to avoid out
of array accesses. An alternative would be to fail if such tiles are
encountered.
I do not know if any valid files use such hanging tiles.

Fixes Ticket2971
Found-by: ami_stuff
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static int g2m_init_buffers(G2MContext *c)     int aligned_height;      if (!c->framebuf || c->old_width < c->width || c->old_height < c->height) {         c->framebuf_stride = FFALIGN(c->width * 3, 16);         aligned_height     = FFALIGN(c->height,    16);         av_free(c->framebuf);         c->framebuf = av_mallocz(c->framebuf_stride * aligned_height);         if (!c->framebuf)

Fixed version (after fix):
 static int g2m_init_buffers(G2MContext *c)     int aligned_height;      if (!c->framebuf || c->old_width < c->width || c->old_height < c->height) {         c->framebuf_stride = FFALIGN(c->width + 15, 16) * 3;         aligned_height     = c->height + 15;         av_free(c->framebuf);         c->framebuf = av_mallocz(c->framebuf_stride * aligned_height);         if (!c->framebuf)

Patch:
patch: @@ -443,8 +443,8 @@ static int g2m_init_buffers(G2MContext *c)
     int aligned_height;
 
     if (!c->framebuf || c->old_width < c->width || c->old_height < c->height) {
-        c->framebuf_stride = FFALIGN(c->width * 3, 16);
-        aligned_height     = FFALIGN(c->height,    16);
+        c->framebuf_stride = FFALIGN(c->width + 15, 16) * 3;
+        aligned_height     = c->height + 15;
         av_free(c->framebuf);
         c->framebuf = av_mallocz(c->framebuf_stride * aligned_height);
         if (!c->framebuf)
path: libavcodec/g2meet.c
Vulnerability: Multiple cross-site request forgery (CSRF) vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to the lack of a protect_from_forgery line in app/controllers/application_controller.rb.
Vulnerability ID: CVE-2013-7223
CWE: CWE-352
Severity score: 6.4
Project: https://github.com/fatfreecrm/fat_free_crm
Published: 2014-01-02
File: app/controllers/application_controller.rb
Commit message: Ensure requests are protected.
Commit author: Steve Kenworthy

Vulnerable version (before fix):
 #------------------------------------------------------------------------------ class ApplicationController < ActionController::Base    before_filter :set_context   before_filter :clear_setting_cache   before_filter "hook(:app_before_filter, self)"

Fixed version (after fix):
 #------------------------------------------------------------------------------ class ApplicationController < ActionController::Base    protect_from_forgery    before_filter :set_context   before_filter :clear_setting_cache   before_filter "hook(:app_before_filter, self)"

Patch:
patch: @@ -5,6 +5,8 @@
 #------------------------------------------------------------------------------
 class ApplicationController < ActionController::Base
 
+  protect_from_forgery
+
   before_filter :set_context
   before_filter :clear_setting_cache
   before_filter "hook(:app_before_filter, self)"
path: app/controllers/application_controller.rb
Vulnerability: SQL injection vulnerability in the msPostGISLayerSetTimeFilter function in mappostgis.c in MapServer before 6.4.1, when a WMS-Time service is used, allows remote attackers to execute arbitrary SQL commands via a crafted string in a PostGIS TIME filter.
Vulnerability ID: CVE-2013-7262
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/mapserver/mapserver
Published: 2014-01-05
File: mappostgis.c
Commit message: Fix potential SQL Injection with postgis TIME filters (#4834)
Commit author: Even Rouault

Vulnerable version (before fix):
 int msPostGISLayerSetTimeFilter(layerObj *lp, const char *timestring, const char   if (!lp || !timestring || !timefield)     return MS_FALSE;    /* discrete time */   if (strstr(timestring, ",") == NULL &&       strstr(timestring, "/") == NULL) { /* discrete time */

Fixed version (after fix):
 int msPostGISLayerSetTimeFilter(layerObj *lp, const char *timestring, const char   if (!lp || !timestring || !timefield)     return MS_FALSE;    if( strchr(timestring,'\'') || strchr(timestring, '\\') ) {      msSetError(MS_MISCERR, "Invalid time filter.", "msPostGISLayerSetTimeFilter()");      return MS_FALSE;   }    /* discrete time */   if (strstr(timestring, ",") == NULL &&       strstr(timestring, "/") == NULL) { /* discrete time */

Patch:
patch: @@ -3212,6 +3212,11 @@ int msPostGISLayerSetTimeFilter(layerObj *lp, const char *timestring, const char
   if (!lp || !timestring || !timefield)
     return MS_FALSE;
 
+  if( strchr(timestring,'\'') || strchr(timestring, '\\') ) {
+     msSetError(MS_MISCERR, "Invalid time filter.", "msPostGISLayerSetTimeFilter()");
+     return MS_FALSE;
+  }
+
   /* discrete time */
   if (strstr(timestring, ",") == NULL &&
       strstr(timestring, "/") == NULL) { /* discrete time */
path: mappostgis.c
Vulnerability: Cross-site scripting (XSS) vulnerability in misc.php in MyBB (aka MyBulletinBoard) before 1.6.12 allows remote attackers to inject arbitrary web script or HTML via the editor parameter in a smilie list popup.
Vulnerability ID: CVE-2013-7275
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/mybb/mybb
Published: 2014-01-08
File: misc.php
Commit message: Fixes XSS in misc.php
Commit author: Stefan-ST

Vulnerable version (before fix):
 	$smilies = ''; 	if($mybb->input['popup']) 	{ // make small popup list of smilies 		$editor = addslashes(htmlentities($mybb->input['editor'])); 		$e = 1; 		$class = "trow1"; 		$smilies = "<tr>";

Fixed version (after fix):
 	$smilies = ''; 	if($mybb->input['popup']) 	{ // make small popup list of smilies 		$editor = preg_replace('#([^a-zA-z0-9_-]+)#', '', $mybb->input['editor']); 		$e = 1; 		$class = "trow1"; 		$smilies = "<tr>";

Patch:
patch: @@ -486,7 +486,7 @@
 	$smilies = '';
 	if($mybb->input['popup'])
 	{ // make small popup list of smilies
-		$editor = addslashes(htmlentities($mybb->input['editor']));
+		$editor = preg_replace('#([^a-zA-z0-9_-]+)#', '', $mybb->input['editor']);
 		$e = 1;
 		$class = "trow1";
 		$smilies = "<tr>";
path: misc.php
Vulnerability: Cross-site scripting (XSS) vulnerability in the mycode_parse_video function in inc/class_parser.php in MyBB (aka MyBulletinBoard) before 1.6.12 allows remote attackers to inject arbitrary web script or HTML via vectors related to Yahoo video URLs.
Vulnerability ID: CVE-2013-7288
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/mybb/mybb
Published: 2014-01-10
File: inc/class_parser.php
Commit message: Fixes XSS in inc/class_parser.php
Commit author: Stefan-ST

Vulnerable version (before fix):
 function mycode_parse_video($video, $url) 				$domain = explode('.', $parsed_url['host']); 				if($domain[0] != 'screen') 				{ 					$local = $domain[0].'.'; 				} 				else 				{

Fixed version (after fix):
 function mycode_parse_video($video, $url) 				$domain = explode('.', $parsed_url['host']); 				if($domain[0] != 'screen') 				{ 					$local = htmlspecialchars_uni($domain[0]).'.'; 				} 				else 				{

Patch:
patch: @@ -1172,7 +1172,7 @@ function mycode_parse_video($video, $url)
 				$domain = explode('.', $parsed_url['host']);
 				if($domain[0] != 'screen')
 				{
-					$local = $domain[0].'.';
+					$local = htmlspecialchars_uni($domain[0]).'.';
 				}
 				else
 				{
path: inc/class_parser.php
Vulnerability: framework/common/messageheaderparser.cpp in Tntnet before 2.2.1 allows remote attackers to obtain sensitive information via a header that ends in \n instead of \r\n, which prevents a null terminator from being added and causes Tntnet to include headers from other requests.
Vulnerability ID: CVE-2013-7299
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/maekitalo/tntnet
Published: 2014-01-26
File: framework/common/messageheaderparser.cpp
Commit message: fix possible information leak
Commit author: Tommi Mäkitalo

Vulnerable version (before fix):
 namespace tnt                    break;       }        return true;     }     else if (std::isspace(ch)) namespace tnt   void Messageheader::Parser::checkHeaderspace(unsigned chars) const   {     if (headerdataPtr + chars >= header.rawdata + sizeof(header.rawdata))       throw HttpError(HTTP_REQUEST_ENTITY_TOO_LARGE, "header too large");   }    void Messageheader::Parser::reset()

Fixed version (after fix):
 namespace tnt                    break;       }        *headerdataPtr = '\0';       return true;     }     else if (std::isspace(ch)) namespace tnt   void Messageheader::Parser::checkHeaderspace(unsigned chars) const   {     if (headerdataPtr + chars >= header.rawdata + sizeof(header.rawdata))     {       header.rawdata[sizeof(header.rawdata) - 1] = '\0';       throw HttpError(HTTP_REQUEST_ENTITY_TOO_LARGE, "header too large");     }   }    void Messageheader::Parser::reset()

Patch:
patch: @@ -204,6 +204,7 @@ namespace tnt
                    break;
       }
 
+      *headerdataPtr = '\0';
       return true;
     }
     else if (std::isspace(ch))
@@ -259,7 +260,10 @@ namespace tnt
   void Messageheader::Parser::checkHeaderspace(unsigned chars) const
   {
     if (headerdataPtr + chars >= header.rawdata + sizeof(header.rawdata))
+    {
+      header.rawdata[sizeof(header.rawdata) - 1] = '\0';
       throw HttpError(HTTP_REQUEST_ENTITY_TOO_LARGE, "header too large");
+    }
   }
 
   void Messageheader::Parser::reset()
path: framework/common/messageheaderparser.cpp
Vulnerability: Double free vulnerability in the ioctx_alloc function in fs/aio.c in the Linux kernel before 3.12.4 allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via vectors involving an error condition in the aio_setup_ring function.
Vulnerability ID: CVE-2013-7348
CWE: CWE-399
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2014-04-01
File: fs/aio.c
Commit message: aio: prevent double free in ioctx_alloc

ioctx_alloc() calls aio_setup_ring() to allocate a ring. If aio_setup_ring()
fails to do so it would call aio_free_ring() before returning, but
ioctx_alloc() would call aio_free_ring() again causing a double free of
the ring.

This is easily reproducible from userspace.

Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Benjamin LaHaise <bcrl@kvack.org>
Commit author: Sasha Levin

Vulnerable version (before fix):
 static struct kioctx *ioctx_alloc(unsigned nr_events) err_cleanup: 	aio_nr_sub(ctx->max_reqs); err: 	aio_free_ring(ctx); 	free_percpu(ctx->cpu); 	free_percpu(ctx->reqs.pcpu_count); 	free_percpu(ctx->users.pcpu_count);

Fixed version (after fix):
 static struct kioctx *ioctx_alloc(unsigned nr_events) err_cleanup: 	aio_nr_sub(ctx->max_reqs); err: 	free_percpu(ctx->cpu); 	free_percpu(ctx->reqs.pcpu_count); 	free_percpu(ctx->users.pcpu_count);

Patch:
patch: @@ -610,7 +610,6 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
 err_cleanup:
 	aio_nr_sub(ctx->max_reqs);
 err:
-	aio_free_ring(ctx);
 	free_percpu(ctx->cpu);
 	free_percpu(ctx->reqs.pcpu_count);
 	free_percpu(ctx->users.pcpu_count);
path: fs/aio.c
Vulnerability: The Special:Contributions page in MediaWiki before 1.22.0 allows remote attackers to determine if an IP is autoblocked via the "Change block" text.
Vulnerability ID: CVE-2013-7444
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/wikimedia/mediawiki
Published: 2015-09-01
File: includes/specials/SpecialContributions.php
Commit message: Prevent Special:Contributions from indicating that an IP address is autoblocked

If an IP address was autoblocked in the userlinks, sysops would see
"change block" and "unblock", indicating that the IP is autoblocked.

Now Special:Contributions will only display "change block" if the user
is blocked and the block type is not Block::TYPE_AUTO. This is the same
check which is used above when deciding whether to display the
block log extract.

Bug: 46457
Change-Id: I43047059cb67527d5296322ac17fe798db917bec
Commit author: Kunal Mehta

Vulnerable version (before fix):
 public function getUserLinks( Title $userpage, Title $talkpage, User $target ) {  		if ( ( $id !== null ) || ( $id === null && IP::isIPAddress( $username ) ) ) { 			if ( $this->getUser()->isAllowed( 'block' ) ) { # Block / Change block / Unblock links 				if ( $target->isBlocked() ) { 					$tools[] = Linker::linkKnown( # Change block link 						SpecialPage::getTitleFor( 'Block', $username ), 						$this->msg( 'change-blocklink' )->escaped()

Fixed version (after fix):
 public function getUserLinks( Title $userpage, Title $talkpage, User $target ) {  		if ( ( $id !== null ) || ( $id === null && IP::isIPAddress( $username ) ) ) { 			if ( $this->getUser()->isAllowed( 'block' ) ) { # Block / Change block / Unblock links 				if ( $target->isBlocked() && $target->getBlock()->getType() != Block::TYPE_AUTO ) { 					$tools[] = Linker::linkKnown( # Change block link 						SpecialPage::getTitleFor( 'Block', $username ), 						$this->msg( 'change-blocklink' )->escaped()

Patch:
patch: @@ -298,7 +298,7 @@ public function getUserLinks( Title $userpage, Title $talkpage, User $target ) {
 
 		if ( ( $id !== null ) || ( $id === null && IP::isIPAddress( $username ) ) ) {
 			if ( $this->getUser()->isAllowed( 'block' ) ) { # Block / Change block / Unblock links
-				if ( $target->isBlocked() ) {
+				if ( $target->isBlocked() && $target->getBlock()->getType() != Block::TYPE_AUTO ) {
 					$tools[] = Linker::linkKnown( # Change block link
 						SpecialPage::getTitleFor( 'Block', $username ),
 						$this->msg( 'change-blocklink' )->escaped()
path: includes/specials/SpecialContributions.php
Vulnerability: Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code on the host OS by leveraging a loop that triggers an invalid memory copy affecting certain cancel_work_item data.
Vulnerability ID: CVE-2014-0049
CWE: CWE-120
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2014-03-11
File: arch/x86/kvm/x86.c
Commit message: kvm: x86: fix emulator buffer overflow (CVE-2014-0049)

The problem occurs when the guest performs a pusha with the stack
address pointing to an mmio address (or an invalid guest physical
address) to start with, but then extending into an ordinary guest
physical address.  When doing repeated emulated pushes
emulator_read_write sets mmio_needed to 1 on the first one.  On a
later push when the stack points to regular memory,
mmio_nr_fragments is set to 0, but mmio_is_needed is not set to 0.

As a result, KVM exits to userspace, and then returns to
complete_emulated_mmio.  In complete_emulated_mmio
vcpu->mmio_cur_fragment is incremented.  The termination condition of
vcpu->mmio_cur_fragment == vcpu->mmio_nr_fragments is never achieved.
The code bounces back and fourth to userspace incrementing
mmio_cur_fragment past it's buffer.  If the guest does nothing else it
eventually leads to a a crash on a memcpy from invalid memory address.

However if a guest code can cause the vm to be destroyed in another
vcpu with excellent timing, then kvm_clear_async_pf_completion_queue
can be used by the guest to control the data that's pointed to by the
call to cancel_work_item, which can be used to gain execution.

Fixes: f78146b0f9230765c6315b2e14f56112513389ad
Signed-off-by: Andrew Honig <ahonig@google.com>
Cc: stable@vger.kernel.org (3.5+)
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Commit author: Andrew Honig

Vulnerable version (before fix):
 static int complete_emulated_mmio(struct kvm_vcpu *vcpu) 		frag->len -= len; 	}  	if (vcpu->mmio_cur_fragment == vcpu->mmio_nr_fragments) { 		vcpu->mmio_needed = 0;  		/* FIXME: return into emulator if single-stepping.  */

Fixed version (after fix):
 static int complete_emulated_mmio(struct kvm_vcpu *vcpu) 		frag->len -= len; 	}  	if (vcpu->mmio_cur_fragment >= vcpu->mmio_nr_fragments) { 		vcpu->mmio_needed = 0;  		/* FIXME: return into emulator if single-stepping.  */

Patch:
patch: @@ -6186,7 +6186,7 @@ static int complete_emulated_mmio(struct kvm_vcpu *vcpu)
 		frag->len -= len;
 	}
 
-	if (vcpu->mmio_cur_fragment == vcpu->mmio_nr_fragments) {
+	if (vcpu->mmio_cur_fragment >= vcpu->mmio_nr_fragments) {
 		vcpu->mmio_needed = 0;
 
 		/* FIXME: return into emulator if single-stepping.  */
path: arch/x86/kvm/x86.c
Vulnerability: The doFilter function in webapp/PushHandlerFilter.java in JBoss RichFaces 4.3.4, 4.3.5, and 5.x allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a large number of malformed atmosphere push requests.
Vulnerability ID: CVE-2014-0086
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/pslegr/core-1
Published: 2014-03-31
File: impl/src/main/java/org/richfaces/webapp/PushHandlerFilter.java
Commit message: RF-13250: applying patch
Commit author: pslegr

Vulnerable version (before fix):
 public void doFilter(ServletRequest request, ServletResponse response, FilterCha             HttpServletResponse httpResp = (HttpServletResponse) response;              if ("GET".equals(httpReq.getMethod())) {                 Meteor meteor = Meteor.build(httpReq, SCOPE.REQUEST, Collections.<BroadcastFilter>emptyList(), null);                  String pushSessionId = httpReq.getParameter(PUSH_SESSION_ID_PARAM);                  Session session = null; public void doFilter(ServletRequest request, ServletResponse response, FilterCha                  httpResp.setContentType("text/plain");                  try {                     Request pushRequest = new RequestImpl(meteor, session); 

Fixed version (after fix):
 public void doFilter(ServletRequest request, ServletResponse response, FilterCha             HttpServletResponse httpResp = (HttpServletResponse) response;              if ("GET".equals(httpReq.getMethod())) {                 String pushSessionId = httpReq.getParameter(PUSH_SESSION_ID_PARAM);                  Session session = null; public void doFilter(ServletRequest request, ServletResponse response, FilterCha                  httpResp.setContentType("text/plain");                  Meteor meteor = Meteor.build(httpReq, SCOPE.REQUEST, Collections.<BroadcastFilter>emptyList(), null);                  try {                     Request pushRequest = new RequestImpl(meteor, session); 

Patch:
patch: @@ -78,8 +78,6 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha
             HttpServletResponse httpResp = (HttpServletResponse) response;
 
             if ("GET".equals(httpReq.getMethod())) {
-                Meteor meteor = Meteor.build(httpReq, SCOPE.REQUEST, Collections.<BroadcastFilter>emptyList(), null);
-
                 String pushSessionId = httpReq.getParameter(PUSH_SESSION_ID_PARAM);
 
                 Session session = null;
@@ -100,6 +98,8 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha
 
                 httpResp.setContentType("text/plain");
 
+                Meteor meteor = Meteor.build(httpReq, SCOPE.REQUEST, Collections.<BroadcastFilter>emptyList(), null);
+
                 try {
                     Request pushRequest = new RequestImpl(meteor, session);
path: impl/src/main/java/org/richfaces/webapp/PushHandlerFilter.java
Vulnerability: The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via a vector that (1) has zero length or (2) is too long.
Vulnerability ID: CVE-2014-0238
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/file/file
Published: 2014-06-01
File: src/cdf.c
Commit message: CVE-2014-0207: Prevent 0 element vectors and vectors longer than the number
of properties from accessing random memory.
Commit author: Christos Zoulas

Vulnerable version (before fix):
 #include "file.h"  #ifndef lint FILE_RCSID("@(#)$File: cdf.c,v 1.58 2014/05/13 16:41:06 christos Exp $") #endif  #include <assert.h> cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h, 		    i, inp[i].pi_id, inp[i].pi_type, q - p, offs)); 		if (inp[i].pi_type & CDF_VECTOR) { 			nelements = CDF_GETUINT32(q, 1); 			o = 2; 		} else { 			nelements = 1; cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h, 			} 			DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n", 			    nelements)); 			for (j = 0; j < nelements; j++, i++) { 				uint32_t l = CDF_GETUINT32(q, o); 				inp[i].pi_str.s_len = l; 				inp[i].pi_str.s_buf = (const char *)

Fixed version (after fix):
 #include "file.h"  #ifndef lint FILE_RCSID("@(#)$File: cdf.c,v 1.59 2014/05/14 23:22:48 christos Exp $") #endif  #include <assert.h> cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h, 		    i, inp[i].pi_id, inp[i].pi_type, q - p, offs)); 		if (inp[i].pi_type & CDF_VECTOR) { 			nelements = CDF_GETUINT32(q, 1); 			if (nelements == 0) { 				DPRINTF(("CDF_VECTOR with nelements == 0\n")); 				goto out; 			} 			o = 2; 		} else { 			nelements = 1; cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h, 			} 			DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n", 			    nelements)); 			for (j = 0; j < nelements && i < sh.sh_properties; 			    j++, i++) 			{ 				uint32_t l = CDF_GETUINT32(q, o); 				inp[i].pi_str.s_len = l; 				inp[i].pi_str.s_buf = (const char *)

Patch:
patch: @@ -35,7 +35,7 @@
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: cdf.c,v 1.58 2014/05/13 16:41:06 christos Exp $")
+FILE_RCSID("@(#)$File: cdf.c,v 1.59 2014/05/14 23:22:48 christos Exp $")
 #endif
 
 #include <assert.h>
@@ -827,6 +827,10 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 		    i, inp[i].pi_id, inp[i].pi_type, q - p, offs));
 		if (inp[i].pi_type & CDF_VECTOR) {
 			nelements = CDF_GETUINT32(q, 1);
+			if (nelements == 0) {
+				DPRINTF(("CDF_VECTOR with nelements == 0\n"));
+				goto out;
+			}
 			o = 2;
 		} else {
 			nelements = 1;
@@ -901,7 +905,9 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 			}
 			DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
 			    nelements));
-			for (j = 0; j < nelements; j++, i++) {
+			for (j = 0; j < nelements && i < sh.sh_properties;
+			    j++, i++)
+			{
 				uint32_t l = CDF_GETUINT32(q, o);
 				inp[i].pi_str.s_len = l;
 				inp[i].pi_str.s_buf = (const char *)
path: src/cdf.c
Vulnerability: Stack-based buffer overflow in lib/Libdis/disrsi_.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x through 2.5.13 allows remote attackers to execute arbitrary code via a large count value.
Vulnerability ID: CVE-2014-0749
CWE: CWE-119
Severity score: 10
Project: https://github.com/adaptivecomputing/torque
Published: 2014-05-16
File: src/lib/Libdis/disrsi_.c
Commit message: Merge pull request #171 into 2.5-fixes.
Commit author: David Beer

Vulnerable version (before fix):
 int disrsi_(   if (dis_umaxd == 0)     disiui_();    switch (c = (*dis_getc)(stream))     { 

Fixed version (after fix):
 int disrsi_(   if (dis_umaxd == 0)     disiui_();    if (count >= dis_umaxd)     {     if (count > dis_umaxd)       goto overflow;      if (memcmp(scratch, dis_umax, dis_umaxd) > 0)       goto overflow;     }    switch (c = (*dis_getc)(stream))     { 

Patch:
patch: @@ -112,6 +112,15 @@ int disrsi_(
   if (dis_umaxd == 0)
     disiui_();
 
+  if (count >= dis_umaxd)
+    {
+    if (count > dis_umaxd)
+      goto overflow;
+
+    if (memcmp(scratch, dis_umax, dis_umaxd) > 0)
+      goto overflow;
+    }
+
   switch (c = (*dis_getc)(stream))
     {
path: src/lib/Libdis/disrsi_.c