rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: ** DISPUTED ** The disas_insn function in target/i386/translate.c in QEMU before 2.9.0, when TCG mode without hardware acceleration is used, does not limit the instruction size, which allows local users to gain privileges by creating a modified basic block that injects code into a setuid program, as demonstrated by procmail. NOTE: the vendor has stated "this bug does not violate any security guarantees QEMU makes."
Vulnerability ID: CVE-2017-8284
CWE: CWE-94
Severity score: 10
Project: https://github.com/qemu/qemu
Published: 2017-04-26
File: target/i386/translate.c
Commit message: tcg/i386: Check the size of instruction being translated

This fixes the bug: 'user-to-root privesc inside VM via bad translation
caching' reported by Jann Horn here:
https://bugs.chromium.org/p/project-zero/issues/detail?id=1122

Reviewed-by: Richard Henderson <rth@twiddle.net>
CC: Peter Maydell <peter.maydell@linaro.org>
CC: Paolo Bonzini <pbonzini@redhat.com>
Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Pranith Kumar <bobby.prani@gmail.com>
Message-Id: <20170323175851.14342-1-bobby.prani@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Commit author: Pranith Kumar

Vulnerable version (before fix):
 static target_ulong disas_insn(CPUX86State *env, DisasContext *s,     s->vex_l = 0;     s->vex_v = 0;  next_byte:     b = cpu_ldub_code(env, s->pc);     s->pc++;     /* Collect prefixes.  */

Fixed version (after fix):
 static target_ulong disas_insn(CPUX86State *env, DisasContext *s,     s->vex_l = 0;     s->vex_v = 0;  next_byte:     /* x86 has an upper limit of 15 bytes for an instruction. Since we      * do not want to decode and generate IR for an illegal      * instruction, the following check limits the instruction size to      * 25 bytes: 14 prefix + 1 opc + 6 (modrm+sib+ofs) + 4 imm */     if (s->pc - pc_start > 14) {         goto illegal_op;     }     b = cpu_ldub_code(env, s->pc);     s->pc++;     /* Collect prefixes.  */

Patch:
patch: @@ -4418,6 +4418,13 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
     s->vex_l = 0;
     s->vex_v = 0;
  next_byte:
+    /* x86 has an upper limit of 15 bytes for an instruction. Since we
+     * do not want to decode and generate IR for an illegal
+     * instruction, the following check limits the instruction size to
+     * 25 bytes: 14 prefix + 1 opc + 6 (modrm+sib+ofs) + 4 imm */
+    if (s->pc - pc_start > 14) {
+        goto illegal_op;
+    }
     b = cpu_ldub_code(env, s->pc);
     s->pc++;
     /* Collect prefixes.  */
path: target/i386/translate.c
Vulnerability: gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.
Vulnerability ID: CVE-2017-8288
CWE: CWE-20
Severity score: 6.4
Project: https://github.com/GNOME/gnome-shell
Published: 2017-04-27
File: js/ui/extensionSystem.js
Commit message: extensionSystem: handle reloading broken extensions

Some extensions out there may fail to reload. When that happens,
we need to catch any exceptions so that we don't leave things in
a broken state that could lead to leaving extensions enabled in
the screen shield.

https://bugzilla.gnome.org/show_bug.cgi?id=781728
Commit author: Emilio Pozuelo Monfort

Vulnerable version (before fix):
 function _onVersionValidationChanged() {     // temporarily disable them all     enabledExtensions = [];     for (let uuid in ExtensionUtils.extensions)         reloadExtension(ExtensionUtils.extensions[uuid]);     enabledExtensions = getEnabledExtensions();      if (Main.sessionMode.allowExtensions) {         enabledExtensions.forEach(function(uuid) {             enableExtension(uuid);         });     } }

Fixed version (after fix):
 function _onVersionValidationChanged() {     // temporarily disable them all     enabledExtensions = [];     for (let uuid in ExtensionUtils.extensions)         try {             reloadExtension(ExtensionUtils.extensions[uuid]);         } catch(e) {             logExtensionError(uuid, e);         }     enabledExtensions = getEnabledExtensions();      if (Main.sessionMode.allowExtensions) {         enabledExtensions.forEach(function(uuid) {             try {                 enableExtension(uuid);             } catch(e) {                 logExtensionError(uuid, e);             }         });     } }

Patch:
patch: @@ -282,12 +282,20 @@ function _onVersionValidationChanged() {
     // temporarily disable them all
     enabledExtensions = [];
     for (let uuid in ExtensionUtils.extensions)
-        reloadExtension(ExtensionUtils.extensions[uuid]);
+        try {
+            reloadExtension(ExtensionUtils.extensions[uuid]);
+        } catch(e) {
+            logExtensionError(uuid, e);
+        }
     enabledExtensions = getEnabledExtensions();
 
     if (Main.sessionMode.allowExtensions) {
         enabledExtensions.forEach(function(uuid) {
-            enableExtension(uuid);
+            try {
+                enableExtension(uuid);
+            } catch(e) {
+                logExtensionError(uuid, e);
+            }
         });
     }
 }
path: js/ui/extensionSystem.js
Vulnerability: vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to obtain sensitive information from process memory because a VFP_GetStorage buffer is larger than intended in certain circumstances involving -sfile Stevedore transient objects.
Vulnerability ID: CVE-2017-8807
CWE: CWE-119
Severity score: 4.9
Project: https://github.com/varnishcache/varnish-cache
Published: 2017-11-16
File: bin/varnishd/cache/cache_fetch.c
Commit message: Avoid buffer read overflow on vcl_error and -sfile

The file stevedore may return a buffer larger than asked for when
requesting storage. Due to lack of check for this condition, the code
to copy the synthetic error memory buffer from vcl_error would overrun
the buffer.

Patch by @shamger

Fixes: #2429
Commit author: Martin Blix Grydeland

Vulnerable version (before fix):
 vbf_stp_error(struct worker *wrk, struct busyobj *bo) 		l = ll; 		if (VFP_GetStorage(bo->vfc, &l, &ptr) != VFP_OK) 			break; 		memcpy(ptr, VSB_data(synth_body) + o, l); 		VFP_Extend(bo->vfc, l); 		ll -= l;

Fixed version (after fix):
 vbf_stp_error(struct worker *wrk, struct busyobj *bo) 		l = ll; 		if (VFP_GetStorage(bo->vfc, &l, &ptr) != VFP_OK) 			break; 		if (l > ll) 			l = ll; 		memcpy(ptr, VSB_data(synth_body) + o, l); 		VFP_Extend(bo->vfc, l); 		ll -= l;

Patch:
patch: @@ -899,6 +899,8 @@ vbf_stp_error(struct worker *wrk, struct busyobj *bo)
 		l = ll;
 		if (VFP_GetStorage(bo->vfc, &l, &ptr) != VFP_OK)
 			break;
+		if (l > ll)
+			l = ll;
 		memcpy(ptr, VSB_data(synth_body) + o, l);
 		VFP_Extend(bo->vfc, l);
 		ll -= l;
path: bin/varnishd/cache/cache_fetch.c
Vulnerability: A null dereference vulnerability has been found in the MIME handling component of LibEtPan before 1.8, as used in MailCore and MailCore 2. A crash can occur in low-level/imf/mailimf.c during a failed parse of a Cc header containing multiple e-mail addresses.
Vulnerability ID: CVE-2017-8825
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/dinhviethoa/libetpan
Published: 2017-05-08
File: src/low-level/imf/mailimf.c
Commit message: Fixed crash #274
Commit author: Viet Hoa Dinh

Vulnerable version (before fix):
 static int mailimf_group_parse(const char * message, size_t length,   struct mailimf_group * group;   int r;   int res;    cur_token = * indx;  static int mailimf_group_parse(const char * message, size_t length,       res = r;       goto free_display_name;     }     break;   default:     res = r;

Fixed version (after fix):
 static int mailimf_group_parse(const char * message, size_t length,   struct mailimf_group * group;   int r;   int res;   clist * list;    cur_token = * indx;  static int mailimf_group_parse(const char * message, size_t length,       res = r;       goto free_display_name;     }     list = clist_new();     if (list == NULL) {       res = MAILIMF_ERROR_MEMORY;       goto free_display_name;     }     mailbox_list = mailimf_mailbox_list_new(list);     if (mailbox_list == NULL) {       res = MAILIMF_ERROR_MEMORY;       clist_free(list);       goto free_display_name;     }     break;   default:     res = r;

Patch:
patch: @@ -3083,6 +3083,7 @@ static int mailimf_group_parse(const char * message, size_t length,
   struct mailimf_group * group;
   int r;
   int res;
+  clist * list;
 
   cur_token = * indx;
 
@@ -3110,6 +3111,17 @@ static int mailimf_group_parse(const char * message, size_t length,
       res = r;
       goto free_display_name;
     }
+    list = clist_new();
+    if (list == NULL) {
+      res = MAILIMF_ERROR_MEMORY;
+      goto free_display_name;
+    }
+    mailbox_list = mailimf_mailbox_list_new(list);
+    if (mailbox_list == NULL) {
+      res = MAILIMF_ERROR_MEMORY;
+      clist_free(list);
+      goto free_display_name;
+    }
     break;
   default:
     res = r;
path: src/low-level/imf/mailimf.c
Vulnerability: The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel through 4.10.15 allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call.
Vulnerability ID: CVE-2017-8890
CWE: CWE-415
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2017-05-10
File: net/ipv4/inet_connection_sock.c
Commit message: dccp/tcp: do not inherit mc_list from parent

syzkaller found a way to trigger double frees from ip_mc_drop_socket()

It turns out that leave a copy of parent mc_list at accept() time,
which is very bad.

Very similar to commit 8b485ce69876 ("tcp: do not inherit
fastopen_req from parent")

Initial report from Pray3r, completed by Andrey one.
Thanks a lot to them !

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Pray3r <pray3r.z@gmail.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Eric Dumazet

Vulnerable version (before fix):
 struct sock *inet_csk_clone_lock(const struct sock *sk, 		/* listeners have SOCK_RCU_FREE, not the children */ 		sock_reset_flag(newsk, SOCK_RCU_FREE);  		newsk->sk_mark = inet_rsk(req)->ir_mark; 		atomic64_set(&newsk->sk_cookie, 			     atomic64_read(&inet_rsk(req)->ir_cookie));

Fixed version (after fix):
 struct sock *inet_csk_clone_lock(const struct sock *sk, 		/* listeners have SOCK_RCU_FREE, not the children */ 		sock_reset_flag(newsk, SOCK_RCU_FREE);  		inet_sk(newsk)->mc_list = NULL;  		newsk->sk_mark = inet_rsk(req)->ir_mark; 		atomic64_set(&newsk->sk_cookie, 			     atomic64_read(&inet_rsk(req)->ir_cookie));

Patch:
patch: @@ -794,6 +794,8 @@ struct sock *inet_csk_clone_lock(const struct sock *sk,
 		/* listeners have SOCK_RCU_FREE, not the children */
 		sock_reset_flag(newsk, SOCK_RCU_FREE);
 
+		inet_sk(newsk)->mc_list = NULL;
+
 		newsk->sk_mark = inet_rsk(req)->ir_mark;
 		atomic64_set(&newsk->sk_cookie,
 			     atomic64_read(&inet_rsk(req)->ir_cookie));
path: net/ipv4/inet_connection_sock.c
Vulnerability: In ImageMagick 7.0.5-7 Q16, a crafted file could trigger an assertion failure in the ResetImageProfileIterator function in MagickCore/profile.c because of missing checks in the ReadDDSImage function in coders/dds.c.
Vulnerability ID: CVE-2017-9141
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-05-22
File: coders/dds.c
Commit message: Added check to prevent image being 0x0 (reported in #489).
Commit author: Dirk Lemstra

Vulnerable version (before fix):
 static Image *ReadDDSImage(const ImageInfo *image_info,ExceptionInfo *exception)   /*     Initialize image structure.   */   if (ReadDDSInfo(image, &dds_info) != MagickTrue) {     ThrowReaderException(CorruptImageError,"ImproperImageHeader");   }      if (dds_info.ddscaps2 & DDSCAPS2_CUBEMAP)     cubemap = MagickTrue;      if (dds_info.ddscaps2 & DDSCAPS2_VOLUME && dds_info.depth > 0)     volume = MagickTrue;      (void) SeekBlob(image, 128, SEEK_SET);    /* static Image *ReadDDSImage(const ImageInfo *image_info,ExceptionInfo *exception)      if (volume)     num_images = dds_info.depth;      for (n = 0; n < num_images; n++)   {     if (n != 0)

Fixed version (after fix):
 static Image *ReadDDSImage(const ImageInfo *image_info,ExceptionInfo *exception)   /*     Initialize image structure.   */   if (ReadDDSInfo(image, &dds_info) != MagickTrue)     ThrowReaderException(CorruptImageError,"ImproperImageHeader");    if (dds_info.ddscaps2 & DDSCAPS2_CUBEMAP)     cubemap = MagickTrue;    if (dds_info.ddscaps2 & DDSCAPS2_VOLUME && dds_info.depth > 0)     volume = MagickTrue;    (void) SeekBlob(image, 128, SEEK_SET);    /* static Image *ReadDDSImage(const ImageInfo *image_info,ExceptionInfo *exception)      if (volume)     num_images = dds_info.depth;    if (num_images < 1)     ThrowReaderException(CorruptImageError,"ImproperImageHeader");    for (n = 0; n < num_images; n++)   {     if (n != 0)

Patch:
patch: @@ -1677,16 +1677,15 @@ static Image *ReadDDSImage(const ImageInfo *image_info,ExceptionInfo *exception)
   /*
     Initialize image structure.
   */
-  if (ReadDDSInfo(image, &dds_info) != MagickTrue) {
+  if (ReadDDSInfo(image, &dds_info) != MagickTrue)
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
-  }
-  
+
   if (dds_info.ddscaps2 & DDSCAPS2_CUBEMAP)
     cubemap = MagickTrue;
-  
+
   if (dds_info.ddscaps2 & DDSCAPS2_VOLUME && dds_info.depth > 0)
     volume = MagickTrue;
-  
+
   (void) SeekBlob(image, 128, SEEK_SET);
 
   /*
@@ -1775,7 +1774,10 @@ static Image *ReadDDSImage(const ImageInfo *image_info,ExceptionInfo *exception)
   
   if (volume)
     num_images = dds_info.depth;
-  
+
+  if (num_images < 1)
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+
   for (n = 0; n < num_images; n++)
   {
     if (n != 0)
path: coders/dds.c
Vulnerability: In ImageMagick 7.0.5-7 Q16, a crafted file could trigger an assertion failure in the WriteBlob function in MagickCore/blob.c because of missing checks in the ReadOneJNGImage function in coders/png.c.
Vulnerability ID: CVE-2017-9142
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-05-22
File: coders/png.c
Commit message: Fixed incorrect call to WriteBlob reported in #490.
Commit author: Dirk Lemstra

Vulnerable version (before fix):
 static Image *ReadOneJNGImage(MngInfo *mng_info,           (void) LogMagickEvent(CoderEvent,GetMagickModule(),             "    Copying JDAT chunk data to color_blob.");          (void) WriteBlob(color_image,length,chunk);          if (length != 0)           chunk=(unsigned char *) RelinquishMagickMemory(chunk);          continue;       }

Fixed version (after fix):
 static Image *ReadOneJNGImage(MngInfo *mng_info,           (void) LogMagickEvent(CoderEvent,GetMagickModule(),             "    Copying JDAT chunk data to color_blob.");          if (length != 0)           {             (void) WriteBlob(color_image,length,chunk);             chunk=(unsigned char *) RelinquishMagickMemory(chunk);           }          continue;       }

Patch:
patch: @@ -4782,10 +4782,11 @@ static Image *ReadOneJNGImage(MngInfo *mng_info,
           (void) LogMagickEvent(CoderEvent,GetMagickModule(),
             "    Copying JDAT chunk data to color_blob.");
 
-        (void) WriteBlob(color_image,length,chunk);
-
         if (length != 0)
-          chunk=(unsigned char *) RelinquishMagickMemory(chunk);
+          {
+            (void) WriteBlob(color_image,length,chunk);
+            chunk=(unsigned char *) RelinquishMagickMemory(chunk);
+          }
 
         continue;
       }
path: coders/png.c
Vulnerability: imagew-cmd.c:850:46 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted image, related to imagew-api.c.
Vulnerability ID: CVE-2017-9201
CWE: CWE-369
Severity score: 2.9
Project: https://github.com/jsummers/imageworsener
Published: 2017-05-23
File: src/imagew-api.c
Commit message: Double-check that the input image's density is valid

Fixes a bug that could result in division by zero, at least for a JPEG
source image.
Fixes issues #19, #20
Commit author: Jason Summers

Vulnerable version (before fix):
 IW_IMPL(int) iw_get_input_density(struct iw_context *ctx, { 	*px = 1.0; 	*py = 1.0; 	*pcode = ctx->img1.density_code; 	if(ctx->img1.density_code!=IW_DENSITY_UNKNOWN) { 		*px = ctx->img1.density_x; 		*py = ctx->img1.density_y; 		return 1; 	} 	return 0; }  IW_IMPL(void) iw_set_output_density(struct iw_context *ctx,

Fixed version (after fix):
 IW_IMPL(int) iw_get_input_density(struct iw_context *ctx, { 	*px = 1.0; 	*py = 1.0; 	*pcode = IW_DENSITY_UNKNOWN;  	if(ctx->img1.density_code==IW_DENSITY_UNKNOWN) { 		return 0; 	} 	if(!iw_is_valid_density(ctx->img1.density_x, ctx->img1.density_y, 		ctx->img1.density_code)) 	{ 		return 0; 	} 	*px = ctx->img1.density_x; 	*py = ctx->img1.density_y; 	*pcode = ctx->img1.density_code; 	return 1; }  IW_IMPL(void) iw_set_output_density(struct iw_context *ctx,

Patch:
patch: @@ -483,13 +483,20 @@ IW_IMPL(int) iw_get_input_density(struct iw_context *ctx,
 {
 	*px = 1.0;
 	*py = 1.0;
-	*pcode = ctx->img1.density_code;
-	if(ctx->img1.density_code!=IW_DENSITY_UNKNOWN) {
-		*px = ctx->img1.density_x;
-		*py = ctx->img1.density_y;
-		return 1;
+	*pcode = IW_DENSITY_UNKNOWN;
+
+	if(ctx->img1.density_code==IW_DENSITY_UNKNOWN) {
+		return 0;
 	}
-	return 0;
+	if(!iw_is_valid_density(ctx->img1.density_x, ctx->img1.density_y,
+		ctx->img1.density_code))
+	{
+		return 0;
+	}
+	*px = ctx->img1.density_x;
+	*py = ctx->img1.density_y;
+	*pcode = ctx->img1.density_code;
+	return 1;
 }
 
 IW_IMPL(void) iw_set_output_density(struct iw_context *ctx,
path: src/imagew-api.c
Vulnerability: systemd-resolved through 233 allows remote attackers to cause a denial of service (daemon crash) via a crafted DNS response with an empty question section.
Vulnerability ID: CVE-2017-9217
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/systemd/systemd
Published: 2017-05-24
File: src/resolve/resolved-dns-packet.c
Commit message: resolved: bugfix of null pointer p->question dereferencing (#6020)

See https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1621396
Commit author: Evgeny Vereshchagin

Vulnerable version (before fix):
 int dns_packet_is_reply_for(DnsPacket *p, const DnsResourceKey *key) {         if (r < 0)                 return r;          if (p->question->n_keys != 1)                 return 0; 

Fixed version (after fix):
 int dns_packet_is_reply_for(DnsPacket *p, const DnsResourceKey *key) {         if (r < 0)                 return r;          if (!p->question)                 return 0;          if (p->question->n_keys != 1)                 return 0; 

Patch:
patch: @@ -2269,6 +2269,9 @@ int dns_packet_is_reply_for(DnsPacket *p, const DnsResourceKey *key) {
         if (r < 0)
                 return r;
 
+        if (!p->question)
+                return 0;
+
         if (p->question->n_keys != 1)
                 return 0;
path: src/resolve/resolved-dns-packet.c
Vulnerability: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer.
Vulnerability ID: CVE-2017-9224
CWE: CWE-125
Severity score: 6.4
Project: https://github.com/kkos/oniguruma
Published: 2017-05-24
File: src/regexec.c
Commit message: fix #57 : DATA_ENSURE() check must be before data access
Commit author: K.Kosako

Vulnerable version (before fix):
 match_at(regex_t* reg, const UChar* str, const UChar* end,       break;      case OP_EXACT1:  MOP_IN(OP_EXACT1); #if 0       DATA_ENSURE(1);       if (*p != *s) goto fail;       p++; s++; #endif       if (*p != *s++) goto fail;       DATA_ENSURE(0);       p++;       MOP_OUT;       break; 

Fixed version (after fix):
 match_at(regex_t* reg, const UChar* str, const UChar* end,       break;      case OP_EXACT1:  MOP_IN(OP_EXACT1);       DATA_ENSURE(1);       if (*p != *s) goto fail;       p++; s++;       MOP_OUT;       break; 

Patch:
patch: @@ -1473,14 +1473,9 @@ match_at(regex_t* reg, const UChar* str, const UChar* end,
       break;
 
     case OP_EXACT1:  MOP_IN(OP_EXACT1);
-#if 0
       DATA_ENSURE(1);
       if (*p != *s) goto fail;
       p++; s++;
-#endif
-      if (*p != *s++) goto fail;
-      DATA_ENSURE(0);
-      p++;
       MOP_OUT;
       break;
path: src/regexec.c
Vulnerability: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer.
Vulnerability ID: CVE-2017-9227
CWE: CWE-125
Severity score: 6.4
Project: https://github.com/kkos/oniguruma
Published: 2017-05-24
File: src/regexec.c
Commit message: fix #58 : access to invalid address by reg->dmin value
Commit author: K.Kosako

Vulnerable version (before fix):
 forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s,     }     else {       UChar *q = p + reg->dmin;       while (p < q) p += enclen(reg->enc, p);     }   }

Fixed version (after fix):
 forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s,     }     else {       UChar *q = p + reg->dmin;        if (q >= end) return 0; /* fail */       while (p < q) p += enclen(reg->enc, p);     }   }

Patch:
patch: @@ -3154,6 +3154,8 @@ forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s,
     }
     else {
       UChar *q = p + reg->dmin;
+
+      if (q >= end) return 0; /* fail */
       while (p < q) p += enclen(reg->enc, p);
     }
   }
path: src/regexec.c
Vulnerability: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs in bitset_set_range() during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect state transition in parse_char_class() could create an execution path that leaves a critical local variable uninitialized until it's used as an index, resulting in an out-of-bounds write memory corruption.
Vulnerability ID: CVE-2017-9228
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/kkos/oniguruma
Published: 2017-05-24
File: src/regparse.c
Commit message: fix #60 : invalid state(CCS_VALUE) in parse_char_class()
Commit author: K.Kosako

Vulnerable version (before fix):
 next_state_class(CClassNode* cc, OnigCodePoint* vs, enum CCVALTYPE* type,     }   }    *state = CCS_VALUE;   *type  = CCV_CLASS;   return 0; }

Fixed version (after fix):
 next_state_class(CClassNode* cc, OnigCodePoint* vs, enum CCVALTYPE* type,     }   }    if (*state != CCS_START)     *state = CCS_VALUE;    *type  = CCV_CLASS;   return 0; }

Patch:
patch: @@ -4081,7 +4081,9 @@ next_state_class(CClassNode* cc, OnigCodePoint* vs, enum CCVALTYPE* type,
     }
   }
 
-  *state = CCS_VALUE;
+  if (*state != CCS_START)
+    *state = CCS_VALUE;
+
   *type  = CCV_CLASS;
   return 0;
 }
path: src/regparse.c