rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: NULL Pointer Dereference in Homebrew mruby prior to 3.2.
Vulnerability ID: CVE-2022-0632
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/mruby/mruby
Published: 2022-02-19
File: mrbgems/mruby-compiler/core/codegen.c
Commit message: codegen.c: adjust stack position for `OP_SUPER` instruction.
Commit author: Yukihiro "Matz" Matsumoto

Vulnerable version (before fix):
 codegen(codegen_scope *s, node *tree, int val)         if (tree->cdr->cdr) {           codegen(s, tree->cdr->cdr, VAL);         }         else if (!s2) {/* super at top-level */           push();      /* no need to push block */         }         else {           gen_blkmove(s, s2->ainfo, lv);         }         st++;       }       else {         if (!s2) push();         else gen_blkmove(s, s2->ainfo, lv);         st++;       }       pop_n(st+1);       genop_2(s, OP_SUPER, cursp(), n);       if (val) push(); codegen(codegen_scope *s, node *tree, int val)         codegen_error(s, "no anonymous block argument");       }       gen_move(s, cursp(), idx, val);     }     else {       codegen(s, tree, val);

Fixed version (after fix):
 codegen(codegen_scope *s, node *tree, int val)         if (tree->cdr->cdr) {           codegen(s, tree->cdr->cdr, VAL);         }         else if (s2) gen_blkmove(s, s2->ainfo, lv);         else {           genop_1(s, OP_LOADNIL, cursp());           push();         }       }       else {         if (s2) gen_blkmove(s, s2->ainfo, lv);         else {           genop_1(s, OP_LOADNIL, cursp());           push();         }       }       st++;       pop_n(st+1);       genop_2(s, OP_SUPER, cursp(), n);       if (val) push(); codegen(codegen_scope *s, node *tree, int val)         codegen_error(s, "no anonymous block argument");       }       gen_move(s, cursp(), idx, val);       if (val) push();     }     else {       codegen(s, tree, val);

Patch:
patch: @@ -2954,19 +2954,20 @@ codegen(codegen_scope *s, node *tree, int val)
         if (tree->cdr->cdr) {
           codegen(s, tree->cdr->cdr, VAL);
         }
-        else if (!s2) {/* super at top-level */
-          push();      /* no need to push block */
-        }
+        else if (s2) gen_blkmove(s, s2->ainfo, lv);
         else {
-          gen_blkmove(s, s2->ainfo, lv);
+          genop_1(s, OP_LOADNIL, cursp());
+          push();
         }
-        st++;
       }
       else {
-        if (!s2) push();
-        else gen_blkmove(s, s2->ainfo, lv);
-        st++;
+        if (s2) gen_blkmove(s, s2->ainfo, lv);
+        else {
+          genop_1(s, OP_LOADNIL, cursp());
+          push();
+        }
       }
+      st++;
       pop_n(st+1);
       genop_2(s, OP_SUPER, cursp(), n);
       if (val) push();
@@ -3218,6 +3219,7 @@ codegen(codegen_scope *s, node *tree, int val)
         codegen_error(s, "no anonymous block argument");
       }
       gen_move(s, cursp(), idx, val);
+      if (val) push();
     }
     else {
       codegen(s, tree, val);
path: mrbgems/mruby-compiler/core/codegen.c
Vulnerability: NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.4.
Vulnerability ID: CVE-2022-0712
CWE: CWE-476
Severity score: 6.9
Project: https://github.com/radareorg/radare2
Published: 2022-02-22
File: libr/bin/p/bin_symbols.c
Commit message: Fix null deref in bin.symbols ##crash

* Reported by cnitlrt via huntr.dev
Commit author: pancake

Vulnerable version (before fix):
 /* radare - LGPL - Copyright 2018 - pancake */  #include <r_types.h> #include <r_util.h> static RList *symbols(RBinFile *bf) { 	bool found = false; 	for (i = 0; i < element->hdr->n_lined_symbols; i++) { 		RCoreSymCacheElementSymbol *sym = (RCoreSymCacheElementSymbol *)&element->lined_symbols[i]; 		ht_uu_find (hash, sym->paddr, &found); 		if (found) { 			continue;

Fixed version (after fix):
 /* radare - LGPL - Copyright 2018-2022 - pancake */  #include <r_types.h> #include <r_util.h> static RList *symbols(RBinFile *bf) { 	bool found = false; 	for (i = 0; i < element->hdr->n_lined_symbols; i++) { 		RCoreSymCacheElementSymbol *sym = (RCoreSymCacheElementSymbol *)&element->lined_symbols[i]; 		if (!sym) { 			break; 		} 		ht_uu_find (hash, sym->paddr, &found); 		if (found) { 			continue;

Patch:
patch: @@ -1,4 +1,4 @@
-/* radare - LGPL - Copyright 2018 - pancake */
+/* radare - LGPL - Copyright 2018-2022 - pancake */
 
 #include <r_types.h>
 #include <r_util.h>
@@ -361,6 +361,9 @@ static RList *symbols(RBinFile *bf) {
 	bool found = false;
 	for (i = 0; i < element->hdr->n_lined_symbols; i++) {
 		RCoreSymCacheElementSymbol *sym = (RCoreSymCacheElementSymbol *)&element->lined_symbols[i];
+		if (!sym) {
+			break;
+		}
 		ht_uu_find (hash, sym->paddr, &found);
 		if (found) {
 			continue;
path: libr/bin/p/bin_symbols.c
Vulnerability: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4.
Vulnerability ID: CVE-2022-0713
CWE: CWE-787
Severity score: 4.9
Project: https://github.com/radareorg/radare2
Published: 2022-02-22
File: libr/bin/format/mach0/coresymbolication.c
Commit message: Fix oobread in macho core symbolication ##crash

* Reported by @cnitlrt via huntr.dev
Commit author: pancake

Vulnerable version (before fix):
 RCoreSymCacheElement *r_coresym_cache_element_new(RBinFile *bf, RBuffer *buf, ut 		} 		size_t i; 		ut8 *cursor = b + R_CS_EL_OFF_SEGS; 		for (i = 0; i < hdr->n_segments && cursor < end; i++) { 			RCoreSymCacheElementSegment *seg = &result->segments[i]; 			seg->paddr = seg->vaddr = r_read_le64 (cursor); 			cursor += 8;

Fixed version (after fix):
 RCoreSymCacheElement *r_coresym_cache_element_new(RBinFile *bf, RBuffer *buf, ut 		} 		size_t i; 		ut8 *cursor = b + R_CS_EL_OFF_SEGS; 		for (i = 0; i < hdr->n_segments && cursor + sizeof (RCoreSymCacheElementSegment) < end; i++) { 			RCoreSymCacheElementSegment *seg = &result->segments[i]; 			seg->paddr = seg->vaddr = r_read_le64 (cursor); 			cursor += 8;

Patch:
patch: @@ -222,7 +222,7 @@ RCoreSymCacheElement *r_coresym_cache_element_new(RBinFile *bf, RBuffer *buf, ut
 		}
 		size_t i;
 		ut8 *cursor = b + R_CS_EL_OFF_SEGS;
-		for (i = 0; i < hdr->n_segments && cursor < end; i++) {
+		for (i = 0; i < hdr->n_segments && cursor + sizeof (RCoreSymCacheElementSegment) < end; i++) {
 			RCoreSymCacheElementSegment *seg = &result->segments[i];
 			seg->paddr = seg->vaddr = r_read_le64 (cursor);
 			cursor += 8;
path: libr/bin/format/mach0/coresymbolication.c
Vulnerability: Out-of-bounds Read in GitHub repository mruby/mruby prior to 3.2.
Vulnerability ID: CVE-2022-0717
CWE: CWE-125
Severity score: 4.9
Project: https://github.com/mruby/mruby
Published: 2022-02-23
File: mrbgems/mruby-compiler/core/codegen.c
Commit message: codegen.c: fix a argument generation bug in array assignment.
Commit author: Yukihiro "Matz" Matsumoto

Vulnerable version (before fix):
 gen_assignment(codegen_scope *s, node *tree, node *rhs, int sp, int val)       if (val) {         gen_move(s, top, cursp(), 1);       }       if (n < 14) {         n++;       }       else {         pop();

Fixed version (after fix):
 gen_assignment(codegen_scope *s, node *tree, node *rhs, int sp, int val)       if (val) {         gen_move(s, top, cursp(), 1);       }       if (n < 15) {         n++;         if (n == 15) {           pop_n(14);           genop_2(s, OP_ARRAY, cursp(), 15);         }       }       else {         pop();

Patch:
patch: @@ -1904,8 +1904,12 @@ gen_assignment(codegen_scope *s, node *tree, node *rhs, int sp, int val)
       if (val) {
         gen_move(s, top, cursp(), 1);
       }
-      if (n < 14) {
+      if (n < 15) {
         n++;
+        if (n == 15) {
+          pop_n(14);
+          genop_2(s, OP_ARRAY, cursp(), 15);
+        }
       }
       else {
         pop();
path: mrbgems/mruby-compiler/core/codegen.c
Vulnerability: NULL Pointer Dereference in GitHub repository mruby/mruby prior to 3.2.
Vulnerability ID: CVE-2022-0890
CWE: CWE-476
Severity score: 6.9
Project: https://github.com/mruby/mruby
Published: 2022-03-10
File: mrbgems/mruby-fiber/src/fiber.c
Commit message: fiber.c: should pack 15+ arguments in an array.
Commit author: Yukihiro "Matz" Matsumoto

Vulnerable version (before fix):
 fiber_switch(mrb_state *mrb, mrb_value self, mrb_int len, const mrb_value *a, mr     if (!c->ci->proc) {       mrb_raise(mrb, E_FIBER_ERROR, "double resume (current)");     }     mrb_stack_extend(mrb, len+2); /* for receiver and (optional) block */     b = c->stbase+1;     e = b + len;     while (b<e) {       *b++ = *a++;     }     if (vmexec) {       c->ci--;                    /* pop dummy callinfo */     }     c->cibase->n = len;     value = c->stbase[0] = MRB_PROC_ENV(c->cibase->proc)->stack[0];   }

Fixed version (after fix):
 fiber_switch(mrb_state *mrb, mrb_value self, mrb_int len, const mrb_value *a, mr     if (!c->ci->proc) {       mrb_raise(mrb, E_FIBER_ERROR, "double resume (current)");     }     if (vmexec) {       c->ci--;                    /* pop dummy callinfo */     }     if (len >= 15) {       mrb_stack_extend(mrb, 3);   /* for receiver, args and (optional) block */       c->stbase[1] = mrb_ary_new_from_values(mrb, len, a);       len = 15;     }     else {       mrb_stack_extend(mrb, len+2); /* for receiver and (optional) block */       b = c->stbase+1;       e = b + len;       while (b<e) {         *b++ = *a++;       }     }     c->cibase->n = len;     value = c->stbase[0] = MRB_PROC_ENV(c->cibase->proc)->stack[0];   }

Patch:
patch: @@ -208,15 +208,22 @@ fiber_switch(mrb_state *mrb, mrb_value self, mrb_int len, const mrb_value *a, mr
     if (!c->ci->proc) {
       mrb_raise(mrb, E_FIBER_ERROR, "double resume (current)");
     }
-    mrb_stack_extend(mrb, len+2); /* for receiver and (optional) block */
-    b = c->stbase+1;
-    e = b + len;
-    while (b<e) {
-      *b++ = *a++;
-    }
     if (vmexec) {
       c->ci--;                    /* pop dummy callinfo */
     }
+    if (len >= 15) {
+      mrb_stack_extend(mrb, 3);   /* for receiver, args and (optional) block */
+      c->stbase[1] = mrb_ary_new_from_values(mrb, len, a);
+      len = 15;
+    }
+    else {
+      mrb_stack_extend(mrb, len+2); /* for receiver and (optional) block */
+      b = c->stbase+1;
+      e = b + len;
+      while (b<e) {
+        *b++ = *a++;
+      }
+    }
     c->cibase->n = len;
     value = c->stbase[0] = MRB_PROC_ENV(c->cibase->proc)->stack[0];
   }
path: mrbgems/mruby-fiber/src/fiber.c
Vulnerability: Cross-site Scripting (XSS) - Stored in GitHub repository autolab/autolab prior to 2.8.0.
Vulnerability ID: CVE-2022-0936
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/autolab/autolab
Published: 2022-04-11
File: app/controllers/attachments_controller.rb
Commit message: Force download of attachments (#1490)

* Rubocop fix

* resolve merge

* restore gemfile

* restore nl
Commit author: Fan Pu

Vulnerable version (before fix):
 def show       flash[:error] = "Error loading #{@attachment.name} from #{@attachment.filename}"       redirect_to([@course, :attachments]) && return     end     send_file(filename, disposition: "inline",                         type: @attachment.mime_type, filename: @attachment.filename) && return   end    action_auth_level :edit, :instructor

Fixed version (after fix):
 def show       flash[:error] = "Error loading #{@attachment.name} from #{@attachment.filename}"       redirect_to([@course, :attachments]) && return     end     # Set to application/octet-stream to force download     send_file(filename, disposition: "inline",                         type: "application/octet-stream", filename: @attachment.filename) && return   end    action_auth_level :edit, :instructor

Patch:
patch: @@ -44,8 +44,9 @@ def show
       flash[:error] = "Error loading #{@attachment.name} from #{@attachment.filename}"
       redirect_to([@course, :attachments]) && return
     end
+    # Set to application/octet-stream to force download
     send_file(filename, disposition: "inline",
-                        type: @attachment.mime_type, filename: @attachment.filename) && return
+                        type: "application/octet-stream", filename: @attachment.filename) && return
   end
 
   action_auth_level :edit, :instructor
path: app/controllers/attachments_controller.rb
Vulnerability: Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6.
Vulnerability ID: CVE-2022-1033
CWE: CWE-434
Severity score: 6.4
Project: https://github.com/crater-invoice/crater
Published: 2022-03-23
File: app/Http/Requests/UploadExpenseReceiptRequest.php
Commit message: Expense attachment validation fix (#855)

https://huntr.dev/bounties/4d7d4fc9-e0cf-42d3-b89c-6ea57a769045/
Commit author: theWorstComrade

Vulnerable version (before fix):
 public function authorize()     public function rules()     {         return [             'upload_receipt' => [                 'nullable',                 new Base64Mime(['gif', 'jpg', 'png'])             ]

Fixed version (after fix):
 public function authorize()     public function rules()     {         return [             'attachment_receipt' => [                 'nullable',                 new Base64Mime(['gif', 'jpg', 'png'])             ]

Patch:
patch: @@ -25,7 +25,7 @@ public function authorize()
     public function rules()
     {
         return [
-            'upload_receipt' => [
+            'attachment_receipt' => [
                 'nullable',
                 new Base64Mime(['gif', 'jpg', 'png'])
             ]
path: app/Http/Requests/UploadExpenseReceiptRequest.php
Vulnerability: Stored XSS viva .svg file upload in GitHub repository polonel/trudesk prior to v1.2.0.
Vulnerability ID: CVE-2022-1045
CWE: CWE-434
Severity score: 2.9
Project: https://github.com/polonel/trudesk
Published: 2022-04-11
File: src/controllers/tickets.js
Commit message: fix(tickets): disable uploading .svg as an attachment
Commit author: Chris Brame

Vulnerable version (before fix):
 ticketsController.uploadImageMDE = function (req, res) {       '.bmp',       '.dib',       '.heif',       '.heic',       '.svg',       '.svgz'     ]      if (!allowedExtensions.includes(ext.toLocaleLowerCase())) {

Fixed version (after fix):
 ticketsController.uploadImageMDE = function (req, res) {       '.bmp',       '.dib',       '.heif',       '.heic'     ]      if (!allowedExtensions.includes(ext.toLocaleLowerCase())) {

Patch:
patch: @@ -575,9 +575,7 @@ ticketsController.uploadImageMDE = function (req, res) {
       '.bmp',
       '.dib',
       '.heif',
-      '.heic',
-      '.svg',
-      '.svgz'
+      '.heic'
     ]
 
     if (!allowedExtensions.includes(ext.toLocaleLowerCase())) {
path: src/controllers/tickets.js
Vulnerability: Heap Buffer Overflow in parseDragons in GitHub repository radareorg/radare2 prior to 5.6.8.
Vulnerability ID: CVE-2022-1061
CWE: CWE-787
Severity score: 2.9
Project: https://github.com/radareorg/radare2
Published: 2022-03-24
File: libr/bin/p/bin_symbols.c
Commit message: Fix oobread in symbols header parsing ##bin
Commit author: Sergi Àlvarez i Capilla

Vulnerable version (before fix):
 static RBinSymbol *bin_symbol_from_symbol(RCoreSymCacheElement *element, RCoreSy  static RCoreSymCacheElement *parseDragons(RBinFile *bf, RBuffer *buf, int off, int bits, R_OWN char *file_name) { 	D eprintf ("Dragons at 0x%x\n", off); 	ut64 size = r_buf_size (buf); 	if (off >= size) { 		return NULL; 	} 	size -= off; 	if (!size) { 		return NULL; 	} 	ut8 *b = malloc (size); 	if (!b) { 		return NULL;

Fixed version (after fix):
 static RBinSymbol *bin_symbol_from_symbol(RCoreSymCacheElement *element, RCoreSy  static RCoreSymCacheElement *parseDragons(RBinFile *bf, RBuffer *buf, int off, int bits, R_OWN char *file_name) { 	D eprintf ("Dragons at 0x%x\n", off); 	st64 size = r_buf_size (buf); 	if (off >= size) { 		return NULL; 	} 	size -= off; 	if (!size) { 		return NULL; 	} 	if (size < 32) { 		return NULL; 	} 	ut8 *b = malloc (size); 	if (!b) { 		return NULL;

Patch:
patch: @@ -181,14 +181,17 @@ static RBinSymbol *bin_symbol_from_symbol(RCoreSymCacheElement *element, RCoreSy
 
 static RCoreSymCacheElement *parseDragons(RBinFile *bf, RBuffer *buf, int off, int bits, R_OWN char *file_name) {
 	D eprintf ("Dragons at 0x%x\n", off);
-	ut64 size = r_buf_size (buf);
+	st64 size = r_buf_size (buf);
 	if (off >= size) {
 		return NULL;
 	}
 	size -= off;
 	if (!size) {
 		return NULL;
 	}
+	if (size < 32) {
+		return NULL;
+	}
 	ut8 *b = malloc (size);
 	if (!b) {
 		return NULL;
path: libr/bin/p/bin_symbols.c
Vulnerability: use after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.
Vulnerability ID: CVE-2022-1106
CWE: CWE-416
Severity score: 4.9
Project: https://github.com/mruby/mruby
Published: 2022-03-27
File: src/vm.c
Commit message: vm.c: vm.c: stack may be reallocated in functions calls; aaa28a5

`mrb_range_new()` also calls VM recursively.
Commit author: Yukihiro "Matz" Matsumoto

Vulnerable version (before fix):
 mrb_vm_exec(mrb_state *mrb, const struct RProc *proc, const mrb_code *pc)     }      CASE(OP_RANGE_INC, B) {       regs[a] = mrb_range_new(mrb, regs[a], regs[a+1], FALSE);       mrb_gc_arena_restore(mrb, ai);       NEXT;     }      CASE(OP_RANGE_EXC, B) {       regs[a] = mrb_range_new(mrb, regs[a], regs[a+1], TRUE);       mrb_gc_arena_restore(mrb, ai);       NEXT;     }

Fixed version (after fix):
 mrb_vm_exec(mrb_state *mrb, const struct RProc *proc, const mrb_code *pc)     }      CASE(OP_RANGE_INC, B) {       mrb_value v = mrb_range_new(mrb, regs[a], regs[a+1], FALSE);       regs[a] = v;       mrb_gc_arena_restore(mrb, ai);       NEXT;     }      CASE(OP_RANGE_EXC, B) {       mrb_value v = mrb_range_new(mrb, regs[a], regs[a+1], TRUE);       regs[a] = v;       mrb_gc_arena_restore(mrb, ai);       NEXT;     }

Patch:
patch: @@ -2819,13 +2819,15 @@ mrb_vm_exec(mrb_state *mrb, const struct RProc *proc, const mrb_code *pc)
     }
 
     CASE(OP_RANGE_INC, B) {
-      regs[a] = mrb_range_new(mrb, regs[a], regs[a+1], FALSE);
+      mrb_value v = mrb_range_new(mrb, regs[a], regs[a+1], FALSE);
+      regs[a] = v;
       mrb_gc_arena_restore(mrb, ai);
       NEXT;
     }
 
     CASE(OP_RANGE_EXC, B) {
-      regs[a] = mrb_range_new(mrb, regs[a], regs[a+1], TRUE);
+      mrb_value v = mrb_range_new(mrb, regs[a], regs[a+1], TRUE);
+      regs[a] = v;
       mrb_gc_arena_restore(mrb, ai);
       NEXT;
     }
path: src/vm.c
Vulnerability: Null Pointer Dereference Caused Segmentation Fault in GitHub repository gpac/gpac prior to 2.1.0-DEV.
Vulnerability ID: CVE-2022-1172
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2022-03-30
File: src/bifs/field_decode.c
Commit message: fixed #2153
Commit author: jeanlf

Vulnerable version (before fix):
 GF_Err gf_bifs_dec_sf_field(GF_BifsDecoder * codec, GF_BitStream *bs, GF_Node *n 		if (sfcb->buffer) { 			gf_free(sfcb->buffer); 			sfcb->buffer = NULL; 		} 		while (gf_list_count(sfcb->commandList)) { 			GF_Command *com = (GF_Command*)gf_list_get(sfcb->commandList, 0);

Fixed version (after fix):
 GF_Err gf_bifs_dec_sf_field(GF_BifsDecoder * codec, GF_BitStream *bs, GF_Node *n 		if (sfcb->buffer) { 			gf_free(sfcb->buffer); 			sfcb->buffer = NULL; 			sfcb->bufferSize = 0; 		} 		while (gf_list_count(sfcb->commandList)) { 			GF_Command *com = (GF_Command*)gf_list_get(sfcb->commandList, 0);

Patch:
patch: @@ -205,6 +205,7 @@ GF_Err gf_bifs_dec_sf_field(GF_BifsDecoder * codec, GF_BitStream *bs, GF_Node *n
 		if (sfcb->buffer) {
 			gf_free(sfcb->buffer);
 			sfcb->buffer = NULL;
+			sfcb->bufferSize = 0;
 		}
 		while (gf_list_count(sfcb->commandList)) {
 			GF_Command *com = (GF_Command*)gf_list_get(sfcb->commandList, 0);
path: src/bifs/field_decode.c
Vulnerability: NULL Pointer Dereference in mrb_vm_exec with super in GitHub repository mruby/mruby prior to 3.2. This vulnerability is capable of making the mruby interpreter crash, thus affecting the availability of the system.
Vulnerability ID: CVE-2022-1201
CWE: CWE-476
Severity score: 6.9
Project: https://github.com/mruby/mruby
Published: 2022-04-02
File: src/vm.c
Commit message: vm.c: target class may be NULL.
Commit author: Yukihiro "Matz" Matsumoto

Vulnerable version (before fix):
 mrb_vm_exec(mrb_state *mrb, const struct RProc *proc, const mrb_code *pc)       }       else if (target_class->tt == MRB_TT_MODULE) {         target_class = mrb_vm_ci_target_class(ci);         if (target_class->tt != MRB_TT_ICLASS) {           goto super_typeerror;         }       }

Fixed version (after fix):
 mrb_vm_exec(mrb_state *mrb, const struct RProc *proc, const mrb_code *pc)       }       else if (target_class->tt == MRB_TT_MODULE) {         target_class = mrb_vm_ci_target_class(ci);         if (!target_class || target_class->tt != MRB_TT_ICLASS) {           goto super_typeerror;         }       }

Patch:
patch: @@ -1749,7 +1749,7 @@ mrb_vm_exec(mrb_state *mrb, const struct RProc *proc, const mrb_code *pc)
       }
       else if (target_class->tt == MRB_TT_MODULE) {
         target_class = mrb_vm_ci_target_class(ci);
-        if (target_class->tt != MRB_TT_ICLASS) {
+        if (!target_class || target_class->tt != MRB_TT_ICLASS) {
           goto super_typeerror;
         }
       }
path: src/vm.c
Vulnerability: Use-After-Free in str_escape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
Vulnerability ID: CVE-2022-1212
CWE: CWE-416
Severity score: 6.4
Project: https://github.com/mruby/mruby
Published: 2022-04-05
File: src/vm.c
Commit message: vm.c: create break object before clearing GC arena.

Otherwise it possibly cause use-after-free.
Commit author: Yukihiro "Matz" Matsumoto

Vulnerable version (before fix):
 mrb_vm_exec(mrb_state *mrb, const struct RProc *proc, const mrb_code *pc)           }           if (ci->cci > CINFO_NONE) {             ci = cipop(mrb);             mrb_gc_arena_restore(mrb, ai);             mrb->c->vmexec = FALSE;             mrb->exc = (struct RObject*)break_new(mrb, RBREAK_TAG_BREAK, proc, v);             mrb->jmp = prev_jmp;             MRB_THROW(prev_jmp);           }

Fixed version (after fix):
 mrb_vm_exec(mrb_state *mrb, const struct RProc *proc, const mrb_code *pc)           }           if (ci->cci > CINFO_NONE) {             ci = cipop(mrb);             mrb->exc = (struct RObject*)break_new(mrb, RBREAK_TAG_BREAK, proc, v);             mrb_gc_arena_restore(mrb, ai);             mrb->c->vmexec = FALSE;             mrb->jmp = prev_jmp;             MRB_THROW(prev_jmp);           }

Patch:
patch: @@ -2268,9 +2268,9 @@ mrb_vm_exec(mrb_state *mrb, const struct RProc *proc, const mrb_code *pc)
           }
           if (ci->cci > CINFO_NONE) {
             ci = cipop(mrb);
+            mrb->exc = (struct RObject*)break_new(mrb, RBREAK_TAG_BREAK, proc, v);
             mrb_gc_arena_restore(mrb, ai);
             mrb->c->vmexec = FALSE;
-            mrb->exc = (struct RObject*)break_new(mrb, RBREAK_TAG_BREAK, proc, v);
             mrb->jmp = prev_jmp;
             MRB_THROW(prev_jmp);
           }
path: src/vm.c