rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, the ReadOneMNGImage function in coders/png.c has an out-of-bounds read with the MNG CLIP chunk.
Vulnerability ID: CVE-2017-13139
CWE: CWE-125
Severity score: 6.4
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-08-23
File: coders/png.c
Commit message: Skip MNG CLIP chunk with out-of-range object IDs
Commit author: Glenn Randers-Pehrson

Vulnerable version (before fix):
 static Image *ReadOneMNGImage(MngInfo* mng_info, const ImageInfo *image_info,                  for (i=(int) first_object; i <= (int) last_object; i++)                 {                   if (mng_info->exists[i] && !mng_info->frozen[i])                     {                       MngBox

Fixed version (after fix):
 static Image *ReadOneMNGImage(MngInfo* mng_info, const ImageInfo *image_info,                  for (i=(int) first_object; i <= (int) last_object; i++)                 {                   if ((i < 0) || (i >= MNG_MAX_OBJECTS))                     continue;                    if (mng_info->exists[i] && !mng_info->frozen[i])                     {                       MngBox

Patch:
patch: @@ -5899,6 +5899,9 @@ static Image *ReadOneMNGImage(MngInfo* mng_info, const ImageInfo *image_info,
 
                 for (i=(int) first_object; i <= (int) last_object; i++)
                 {
+                  if ((i < 0) || (i >= MNG_MAX_OBJECTS))
+                    continue;
+
                   if (mng_info->exists[i] && !mng_info->frozen[i])
                     {
                       MngBox
path: coders/png.c
Vulnerability: In ImageMagick before 6.9.7-6 and 7.x before 7.0.4-6, the ReadMATImage function in coders/mat.c uses uninitialized data, which might allow remote attackers to obtain sensitive information from process memory.
Vulnerability ID: CVE-2017-13143
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-08-23
File: coders/mat.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/362
Commit author: Cristy

Vulnerable version (before fix):
 RestoreMSCWarning     BImgBuff = (unsigned char *) AcquireQuantumMemory((size_t) (ldblk),sizeof(double));    /* Ldblk was set in the check phase */     if (BImgBuff == NULL)       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");      MinVal = 0;     MaxVal = 0;

Fixed version (after fix):
 RestoreMSCWarning     BImgBuff = (unsigned char *) AcquireQuantumMemory((size_t) (ldblk),sizeof(double));    /* Ldblk was set in the check phase */     if (BImgBuff == NULL)       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");     (void) ResetMagickMemory(BImgBuff,0,ldblk*sizeof(double));      MinVal = 0;     MaxVal = 0;

Patch:
patch: @@ -1123,6 +1123,7 @@ RestoreMSCWarning
     BImgBuff = (unsigned char *) AcquireQuantumMemory((size_t) (ldblk),sizeof(double));    /* Ldblk was set in the check phase */
     if (BImgBuff == NULL)
       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+    (void) ResetMagickMemory(BImgBuff,0,ldblk*sizeof(double));
 
     MinVal = 0;
     MaxVal = 0;
path: coders/mat.c
Vulnerability: A stack-based buffer overflow was discovered in the pgxtoimage function in bin/jp2/convert.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.
Vulnerability ID: CVE-2017-14041
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/uclouvain/openjpeg
Published: 2017-08-30
File: src/bin/jp2/convert.c
Commit message: pgxtoimage(): fix write stack buffer overflow (#997)
Commit author: Even Rouault

Vulnerable version (before fix):
 opj_image_t* pgxtoimage(const char *filename, opj_cparameters_t *parameters)     }      fseek(f, 0, SEEK_SET);     if (fscanf(f, "PG%[ \t]%c%c%[ \t+-]%d%[ \t]%d%[ \t]%d", temp, &endian1,                &endian2, signtmp, &prec, temp, &w, temp, &h) != 9) {         fclose(f);         fprintf(stderr,

Fixed version (after fix):
 opj_image_t* pgxtoimage(const char *filename, opj_cparameters_t *parameters)     }      fseek(f, 0, SEEK_SET);     if (fscanf(f, "PG%31[ \t]%c%c%31[ \t+-]%d%31[ \t]%d%31[ \t]%d", temp, &endian1,                &endian2, signtmp, &prec, temp, &w, temp, &h) != 9) {         fclose(f);         fprintf(stderr,

Patch:
patch: @@ -1185,7 +1185,7 @@ opj_image_t* pgxtoimage(const char *filename, opj_cparameters_t *parameters)
     }
 
     fseek(f, 0, SEEK_SET);
-    if (fscanf(f, "PG%[ \t]%c%c%[ \t+-]%d%[ \t]%d%[ \t]%d", temp, &endian1,
+    if (fscanf(f, "PG%31[ \t]%c%c%31[ \t+-]%d%31[ \t]%d%31[ \t]%d", temp, &endian1,
                &endian2, signtmp, &prec, temp, &w, temp, &h) != 9) {
         fclose(f);
         fprintf(stderr,
path: src/bin/jp2/convert.c
Vulnerability: The tcp_disconnect function in net/ipv4/tcp.c in the Linux kernel before 4.12 allows local users to cause a denial of service (__tcp_select_window divide-by-zero error and system crash) by triggering a disconnect within a certain tcp_recvmsg code path.
Vulnerability ID: CVE-2017-14106
CWE: CWE-369
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2017-09-01
File: net/ipv4/tcp.c
Commit message: tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0

When tcp_disconnect() is called, inet_csk_delack_init() sets
icsk->icsk_ack.rcv_mss to 0.
This could potentially cause tcp_recvmsg() => tcp_cleanup_rbuf() =>
__tcp_select_window() call path to have division by 0 issue.
So this patch initializes rcv_mss to TCP_MIN_MSS instead of 0.

Reported-by: Andrey Konovalov  <andreyknvl@google.com>
Signed-off-by: Wei Wang <weiwan@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Wei Wang

Vulnerable version (before fix):
 int tcp_disconnect(struct sock *sk, int flags) 	tcp_set_ca_state(sk, TCP_CA_Open); 	tcp_clear_retrans(tp); 	inet_csk_delack_init(sk); 	tcp_init_send_head(sk); 	memset(&tp->rx_opt, 0, sizeof(tp->rx_opt)); 	__sk_dst_reset(sk);

Fixed version (after fix):
 int tcp_disconnect(struct sock *sk, int flags) 	tcp_set_ca_state(sk, TCP_CA_Open); 	tcp_clear_retrans(tp); 	inet_csk_delack_init(sk); 	/* Initialize rcv_mss to TCP_MIN_MSS to avoid division by 0 	 * issue in __tcp_select_window() 	 */ 	icsk->icsk_ack.rcv_mss = TCP_MIN_MSS; 	tcp_init_send_head(sk); 	memset(&tp->rx_opt, 0, sizeof(tp->rx_opt)); 	__sk_dst_reset(sk);

Patch:
patch: @@ -2320,6 +2320,10 @@ int tcp_disconnect(struct sock *sk, int flags)
 	tcp_set_ca_state(sk, TCP_CA_Open);
 	tcp_clear_retrans(tp);
 	inet_csk_delack_init(sk);
+	/* Initialize rcv_mss to TCP_MIN_MSS to avoid division by 0
+	 * issue in __tcp_select_window()
+	 */
+	icsk->icsk_ack.rcv_mss = TCP_MIN_MSS;
 	tcp_init_send_head(sk);
 	memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
 	__sk_dst_reset(sk);
path: net/ipv4/tcp.c
Vulnerability: A mishandled zero case was discovered in opj_j2k_set_cinema_parameters in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_write_bytes_LE in lib/openjp2/cio.c and opj_j2k_write_sot in lib/openjp2/j2k.c) or possibly remote code execution.
Vulnerability ID: CVE-2017-14152
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/uclouvain/openjpeg
Published: 2017-09-05
File: src/lib/openjp2/j2k.c
Commit message: Fix assertion in debug mode / heap-based buffer overflow in opj_write_bytes_LE for Cinema profiles with numresolutions = 1 (#985)
Commit author: Even Rouault

Vulnerable version (before fix):
 static void opj_j2k_set_cinema_parameters(opj_cparameters_t *parameters,      /* Precincts */     parameters->csty |= 0x01;     parameters->res_spec = parameters->numresolution - 1;     for (i = 0; i < parameters->res_spec; i++) {         parameters->prcw_init[i] = 256;         parameters->prch_init[i] = 256;     }      /* The progression order shall be CPRL */

Fixed version (after fix):
 static void opj_j2k_set_cinema_parameters(opj_cparameters_t *parameters,      /* Precincts */     parameters->csty |= 0x01;     if (parameters->numresolution == 1) {         parameters->res_spec = 1;         parameters->prcw_init[0] = 128;         parameters->prch_init[0] = 128;     } else {         parameters->res_spec = parameters->numresolution - 1;         for (i = 0; i < parameters->res_spec; i++) {             parameters->prcw_init[i] = 256;             parameters->prch_init[i] = 256;         }     }      /* The progression order shall be CPRL */

Patch:
patch: @@ -6573,10 +6573,16 @@ static void opj_j2k_set_cinema_parameters(opj_cparameters_t *parameters,
 
     /* Precincts */
     parameters->csty |= 0x01;
-    parameters->res_spec = parameters->numresolution - 1;
-    for (i = 0; i < parameters->res_spec; i++) {
-        parameters->prcw_init[i] = 256;
-        parameters->prch_init[i] = 256;
+    if (parameters->numresolution == 1) {
+        parameters->res_spec = 1;
+        parameters->prcw_init[0] = 128;
+        parameters->prch_init[0] = 128;
+    } else {
+        parameters->res_spec = parameters->numresolution - 1;
+        for (i = 0; i < parameters->res_spec; i++) {
+            parameters->prcw_init[i] = 256;
+            parameters->prch_init[i] = 256;
+        }
     }
 
     /* The progression order shall be CPRL */
path: src/lib/openjp2/j2k.c
Vulnerability: libarchive 3.3.2 allows remote attackers to cause a denial of service (xml_data heap-based buffer over-read and application crash) via a crafted xar archive, related to the mishandling of empty strings in the atol8 function in archive_read_support_format_xar.c.
Vulnerability ID: CVE-2017-14166
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/libarchive/libarchive
Published: 2017-09-06
File: libarchive/archive_read_support_format_xar.c
Commit message: Do something sensible for empty strings to make fuzzers happy.
Commit author: Joerg Sonnenberger

Vulnerable version (before fix):
 atol10(const char *p, size_t char_cnt) 	uint64_t l; 	int digit;  	l = 0; 	digit = *p - '0'; 	while (digit >= 0 && digit < 10  && char_cnt-- > 0) { atol8(const char *p, size_t char_cnt) { 	int64_t l; 	int digit;          	l = 0; 	while (char_cnt-- > 0) { 		if (*p >= '0' && *p <= '7')

Fixed version (after fix):
 atol10(const char *p, size_t char_cnt) 	uint64_t l; 	int digit;  	if (char_cnt == 0) 		return (0);  	l = 0; 	digit = *p - '0'; 	while (digit >= 0 && digit < 10  && char_cnt-- > 0) { atol8(const char *p, size_t char_cnt) { 	int64_t l; 	int digit;  	if (char_cnt == 0) 		return (0);  	l = 0; 	while (char_cnt-- > 0) { 		if (*p >= '0' && *p <= '7')

Patch:
patch: @@ -1040,6 +1040,9 @@ atol10(const char *p, size_t char_cnt)
 	uint64_t l;
 	int digit;
 
+	if (char_cnt == 0)
+		return (0);
+
 	l = 0;
 	digit = *p - '0';
 	while (digit >= 0 && digit < 10  && char_cnt-- > 0) {
@@ -1054,7 +1057,10 @@ atol8(const char *p, size_t char_cnt)
 {
 	int64_t l;
 	int digit;
-        
+
+	if (char_cnt == 0)
+		return (0);
+
 	l = 0;
 	while (char_cnt-- > 0) {
 		if (*p >= '0' && *p <= '7')
path: libarchive/archive_read_support_format_xar.c
Vulnerability: In the function ReadTXTImage() in coders/txt.c in ImageMagick 7.0.6-10, an integer overflow might occur for the addition operation "GetQuantumRange(depth)+1" when "depth" is large, producing a smaller value than expected. As a result, an infinite loop would occur for a crafted TXT file that claims a very large "max_value" value.
Vulnerability ID: CVE-2017-14173
CWE: CWE-190
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-09-07
File: coders/txt.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/713
Commit author: Cristy

Vulnerable version (before fix):
 static Image *ReadTXTImage(const ImageInfo *image_info,ExceptionInfo *exception)       ThrowReaderException(CorruptImageError,"ImproperImageHeader");     image->columns=width;     image->rows=height;     for (depth=1; (GetQuantumRange(depth)+1) < max_value; depth++) ;     image->depth=depth;     status=SetImageExtent(image,image->columns,image->rows,exception);     if (status == MagickFalse)

Fixed version (after fix):
 static Image *ReadTXTImage(const ImageInfo *image_info,ExceptionInfo *exception)       ThrowReaderException(CorruptImageError,"ImproperImageHeader");     image->columns=width;     image->rows=height;     for (depth=1; (GetQuantumRange(depth)+1) < max_value; depth++)       if (depth >= 64)         break;     image->depth=depth;     status=SetImageExtent(image,image->columns,image->rows,exception);     if (status == MagickFalse)

Patch:
patch: @@ -446,7 +446,9 @@ static Image *ReadTXTImage(const ImageInfo *image_info,ExceptionInfo *exception)
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     image->columns=width;
     image->rows=height;
-    for (depth=1; (GetQuantumRange(depth)+1) < max_value; depth++) ;
+    for (depth=1; (GetQuantumRange(depth)+1) < max_value; depth++)
+      if (depth >= 64)
+        break;
     image->depth=depth;
     status=SetImageExtent(image,image->columns,image->rows,exception);
     if (status == MagickFalse)
path: coders/txt.c
Vulnerability: In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted ASF file, which claims a large "ict" field in the header but does not contain sufficient backing data, is provided, the for loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.
Vulnerability ID: CVE-2017-14223
CWE: CWE-400
Severity score: 6.9
Project: https://github.com/FFmpeg/FFmpeg
Published: 2017-09-09
File: libavformat/asfdec_f.c
Commit message: avformat/asfdec: Fix DoS in asf_build_simple_index()

Fixes: Missing EOF check in loop
No testcase

Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static int asf_build_simple_index(AVFormatContext *s, int stream_index)             int64_t pos       = s->internal->data_offset + s->packet_size * (int64_t)pktnum;             int64_t index_pts = FFMAX(av_rescale(itime, i, 10000) - asf->hdr.preroll, 0);              if (pos != last_pos) {                 av_log(s, AV_LOG_DEBUG, "pktnum:%d, pktct:%d  pts: %"PRId64"\n",                        pktnum, pktct, index_pts);

Fixed version (after fix):
 static int asf_build_simple_index(AVFormatContext *s, int stream_index)             int64_t pos       = s->internal->data_offset + s->packet_size * (int64_t)pktnum;             int64_t index_pts = FFMAX(av_rescale(itime, i, 10000) - asf->hdr.preroll, 0);              if (avio_feof(s->pb)) {                 ret = AVERROR_INVALIDDATA;                 goto end;             }              if (pos != last_pos) {                 av_log(s, AV_LOG_DEBUG, "pktnum:%d, pktct:%d  pts: %"PRId64"\n",                        pktnum, pktct, index_pts);

Patch:
patch: @@ -1610,6 +1610,11 @@ static int asf_build_simple_index(AVFormatContext *s, int stream_index)
             int64_t pos       = s->internal->data_offset + s->packet_size * (int64_t)pktnum;
             int64_t index_pts = FFMAX(av_rescale(itime, i, 10000) - asf->hdr.preroll, 0);
 
+            if (avio_feof(s->pb)) {
+                ret = AVERROR_INVALIDDATA;
+                goto end;
+            }
+
             if (pos != last_pos) {
                 av_log(s, AV_LOG_DEBUG, "pktnum:%d, pktct:%d  pts: %"PRId64"\n",
                        pktnum, pktct, index_pts);
path: libavformat/asfdec_f.c
Vulnerability: In the mboxlist_do_find function in imap/mboxlist.c in Cyrus IMAP before 3.0.4, an off-by-one error in prefix calculation for the LIST command caused use of uninitialized memory, which might allow remote attackers to obtain sensitive information or cause a denial of service (daemon crash) via a 'LIST "" "Other Users"' command.
Vulnerability ID: CVE-2017-14230
CWE: CWE-20
Severity score: 4.9
Project: https://github.com/cyrusimap/cyrus-imapd
Published: 2017-09-10
File: imap/mboxlist.c
Commit message: mboxlist: fix uninitialised memory use where pattern is "Other Users"
Commit author: Bron Gondwana

Vulnerable version (before fix):
 static int mboxlist_do_find(struct find_rock *rock, const strarray_t *patterns)         if (len) len--; // trailing separator          if (!strncmp(rock->namespace->prefix[NAMESPACE_USER], commonpat, MIN(len, prefixlen))) {             if (prefixlen < len) {                 /* we match all users */                 strlcpy(domainpat+domainlen, "user.", sizeof(domainpat)-domainlen);             }

Fixed version (after fix):
 static int mboxlist_do_find(struct find_rock *rock, const strarray_t *patterns)         if (len) len--; // trailing separator          if (!strncmp(rock->namespace->prefix[NAMESPACE_USER], commonpat, MIN(len, prefixlen))) {             if (prefixlen <= len) {                 /* we match all users */                 strlcpy(domainpat+domainlen, "user.", sizeof(domainpat)-domainlen);             }

Patch:
patch: @@ -2851,7 +2851,7 @@ static int mboxlist_do_find(struct find_rock *rock, const strarray_t *patterns)
         if (len) len--; // trailing separator
 
         if (!strncmp(rock->namespace->prefix[NAMESPACE_USER], commonpat, MIN(len, prefixlen))) {
-            if (prefixlen < len) {
+            if (prefixlen <= len) {
                 /* we match all users */
                 strlcpy(domainpat+domainlen, "user.", sizeof(domainpat)-domainlen);
             }
path: imap/mboxlist.c
Vulnerability: The shibboleth_login_form function in shibboleth.php in the Shibboleth plugin before 1.8 for WordPress is prone to an XSS vulnerability due to improper use of add_query_arg().
Vulnerability ID: CVE-2017-14313
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/michaelryanmcneill/shibboleth
Published: 2017-09-12
File: shibboleth.php
Commit message: escape url after add_query_arg
Commit author: Michael Yoshitaka Erlewine

Vulnerable version (before fix):
 function shibboleth_update_user_data($user_id, $force_update = false) { function shibboleth_login_form() { 	$login_url = add_query_arg('action', 'shibboleth'); 	$login_url = remove_query_arg('reauth', $login_url); 	echo '<p id="shibboleth_login"><a href="' . $login_url . '">' . __('Login with Shibboleth', 'shibboleth') . '</a></p>'; } add_action('login_form', 'shibboleth_login_form'); 

Fixed version (after fix):
 function shibboleth_update_user_data($user_id, $force_update = false) { function shibboleth_login_form() { 	$login_url = add_query_arg('action', 'shibboleth'); 	$login_url = remove_query_arg('reauth', $login_url); 	echo '<p id="shibboleth_login"><a href="' . esc_url($login_url) . '">' . __('Login with Shibboleth', 'shibboleth') . '</a></p>'; } add_action('login_form', 'shibboleth_login_form'); 

Patch:
patch: @@ -460,7 +460,7 @@ function shibboleth_update_user_data($user_id, $force_update = false) {
 function shibboleth_login_form() {
 	$login_url = add_query_arg('action', 'shibboleth');
 	$login_url = remove_query_arg('reauth', $login_url);
-	echo '<p id="shibboleth_login"><a href="' . $login_url . '">' . __('Login with Shibboleth', 'shibboleth') . '</a></p>';
+	echo '<p id="shibboleth_login"><a href="' . esc_url($login_url) . '">' . __('Login with Shibboleth', 'shibboleth') . '</a></p>';
 }
 add_action('login_form', 'shibboleth_login_form');
path: shibboleth.php
Vulnerability: ImageMagick 7.0.6-6 has a large loop vulnerability in ReadWPGImage in coders/wpg.c, causing CPU exhaustion via a crafted wpg image file.
Vulnerability ID: CVE-2017-14341
CWE: CWE-400
Severity score: 6.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-09-12
File: coders/wpg.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/654
Commit author: Cristy

Vulnerable version (before fix):
 static Image *ReadWPGImage(const ImageInfo *image_info,           if(i==EOF)             break;           Rd_WP_DWORD(image,&Rec.RecordLength);           if(EOFBlob(image))             break; 

Fixed version (after fix):
 static Image *ReadWPGImage(const ImageInfo *image_info,           if(i==EOF)             break;           Rd_WP_DWORD(image,&Rec.RecordLength);           if (Rec.RecordLength > GetBlobSize(image))             ThrowReaderException(CorruptImageError,"ImproperImageHeader");           if(EOFBlob(image))             break; 

Patch:
patch: @@ -1035,6 +1035,8 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
           if(i==EOF)
             break;
           Rd_WP_DWORD(image,&Rec.RecordLength);
+          if (Rec.RecordLength > GetBlobSize(image))
+            ThrowReaderException(CorruptImageError,"ImproperImageHeader");
           if(EOFBlob(image))
             break;
path: coders/wpg.c
Vulnerability: read_header in archive_read_support_format_rar.c in libarchive 3.3.2 suffers from an off-by-one error for UTF-16 names in RAR archives, leading to an out-of-bounds read in archive_read_format_rar_read_header.
Vulnerability ID: CVE-2017-14502
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/libarchive/libarchive
Published: 2017-09-17
File: libarchive/archive_read_support_format_rar.c
Commit message: Avoid a read off-by-one error for UTF16 names in RAR archives.

Reported-By: OSS-Fuzz issue 573
Commit author: Joerg Sonnenberger

Vulnerable version (before fix):
 read_header(struct archive_read *a, struct archive_entry *entry,         return (ARCHIVE_FATAL);       }       filename[filename_size++] = '\0';       filename[filename_size++] = '\0';        /* Decoded unicode form is UTF-16BE, so we have to update a string        * conversion object for it. */

Fixed version (after fix):
 read_header(struct archive_read *a, struct archive_entry *entry,         return (ARCHIVE_FATAL);       }       filename[filename_size++] = '\0';       /*        * Do not increment filename_size here as the computations below        * add the space for the terminating NUL explicitly.        */       filename[filename_size] = '\0';        /* Decoded unicode form is UTF-16BE, so we have to update a string        * conversion object for it. */

Patch:
patch: @@ -1496,7 +1496,11 @@ read_header(struct archive_read *a, struct archive_entry *entry,
         return (ARCHIVE_FATAL);
       }
       filename[filename_size++] = '\0';
-      filename[filename_size++] = '\0';
+      /*
+       * Do not increment filename_size here as the computations below
+       * add the space for the terminating NUL explicitly.
+       */
+      filename[filename_size] = '\0';
 
       /* Decoded unicode form is UTF-16BE, so we have to update a string
        * conversion object for it. */
path: libarchive/archive_read_support_format_rar.c