rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via a Buffer Overflow during syntax parsing because a check for '\0' is made for the wrong array element in jsvar.c.
Vulnerability ID: CVE-2018-11596
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/espruino/Espruino
Published: 2018-05-31
File: src/jsvar.c
Commit message: fix jsvGetString regression
Commit author: Gordon Williams

Vulnerable version (before fix):
 size_t jsvGetString(const JsVar *v, char *str, size_t len) {      * want to pad the entire buffer with zeros */     len--;     int l = 0;     while (*s && l<len) {       str[l] = s[l];       l++;     }

Fixed version (after fix):
 size_t jsvGetString(const JsVar *v, char *str, size_t len) {      * want to pad the entire buffer with zeros */     len--;     int l = 0;     while (s[l] && l<len) {       str[l] = s[l];       l++;     }

Patch:
patch: @@ -1190,7 +1190,7 @@ size_t jsvGetString(const JsVar *v, char *str, size_t len) {
      * want to pad the entire buffer with zeros */
     len--;
     int l = 0;
-    while (*s && l<len) {
+    while (s[l] && l<len) {
       str[l] = s[l];
       l++;
     }
path: src/jsvar.c
Vulnerability: An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrb_class, related to certain .clone usage, because mrb_obj_clone in kernel.c copies flags other than the MRB_FLAG_IS_FROZEN flag (e.g., the embedded flag).
Vulnerability ID: CVE-2018-12247
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/mruby/mruby
Published: 2018-06-12
File: src/kernel.c
Commit message: Allow `Object#clone` to copy frozen status only; fix #4036

Copying all flags from the original object may overwrite the clone's
flags e.g. the embedded flag.
Commit author: Yukihiro "Matz" Matsumoto

Vulnerable version (before fix):
 mrb_obj_clone(mrb_state *mrb, mrb_value self)   mrb_field_write_barrier(mrb, (struct RBasic*)p, (struct RBasic*)p->c);   clone = mrb_obj_value(p);   init_copy(mrb, clone, self);   p->flags = mrb_obj_ptr(self)->flags;    return clone; }

Fixed version (after fix):
 mrb_obj_clone(mrb_state *mrb, mrb_value self)   mrb_field_write_barrier(mrb, (struct RBasic*)p, (struct RBasic*)p->c);   clone = mrb_obj_value(p);   init_copy(mrb, clone, self);   p->flags |= mrb_obj_ptr(self)->flags & MRB_FLAG_IS_FROZEN;    return clone; }

Patch:
patch: @@ -348,7 +348,7 @@ mrb_obj_clone(mrb_state *mrb, mrb_value self)
   mrb_field_write_barrier(mrb, (struct RBasic*)p, (struct RBasic*)p->c);
   clone = mrb_obj_value(p);
   init_copy(mrb, clone, self);
-  p->flags = mrb_obj_ptr(self)->flags;
+  p->flags |= mrb_obj_ptr(self)->flags & MRB_FLAG_IS_FROZEN;
 
   return clone;
 }
path: src/kernel.c
Vulnerability: An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrb_class_real because "class BasicObject" is not properly supported in class.c.
Vulnerability ID: CVE-2018-12249
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/mruby/mruby
Published: 2018-06-12
File: src/class.c
Commit message: `mrb_class_real()` did not work for `BasicObject`; fix #4037
Commit author: Yukihiro "Matz" Matsumoto

Vulnerable version (before fix):
 mrb_class_path(mrb_state *mrb, struct RClass *c) MRB_API struct RClass* mrb_class_real(struct RClass* cl) {   if (cl == 0)     return NULL;   while ((cl->tt == MRB_TT_SCLASS) || (cl->tt == MRB_TT_ICLASS)) {     cl = cl->super;   }   return cl; }

Fixed version (after fix):
 mrb_class_path(mrb_state *mrb, struct RClass *c) MRB_API struct RClass* mrb_class_real(struct RClass* cl) {   if (cl == 0) return NULL;   while ((cl->tt == MRB_TT_SCLASS) || (cl->tt == MRB_TT_ICLASS)) {     cl = cl->super;     if (cl == 0) return NULL;   }   return cl; }

Patch:
patch: @@ -1763,10 +1763,10 @@ mrb_class_path(mrb_state *mrb, struct RClass *c)
 MRB_API struct RClass*
 mrb_class_real(struct RClass* cl)
 {
-  if (cl == 0)
-    return NULL;
+  if (cl == 0) return NULL;
   while ((cl->tt == MRB_TT_SCLASS) || (cl->tt == MRB_TT_ICLASS)) {
     cl = cl->super;
+    if (cl == 0) return NULL;
   }
   return cl;
 }
path: src/class.c
Vulnerability: There is a use after free in radare2 2.6.0 in r_anal_bb_free() in libr/anal/bb.c via a crafted Java binary file.
Vulnerability ID: CVE-2018-12320
CWE: CWE-416
Severity score: 6.4
Project: https://github.com/radare/radare2
Published: 2018-06-13
File: libr/anal/bb.c
Commit message: Fix #10293 - Use-after-free in r_anal_bb_free()
Commit author: pancake

Vulnerable version (before fix):
 R_API void r_anal_bb_free(RAnalBlock *bb) { 		bb->failbb->prev = NULL; 		bb->failbb = NULL; 	} 	R_FREE (bb); }  R_API RList *r_anal_bb_list_new() {

Fixed version (after fix):
 R_API void r_anal_bb_free(RAnalBlock *bb) { 		bb->failbb->prev = NULL; 		bb->failbb = NULL; 	} 	if (bb->next) { 		// avoid double free 		bb->next->prev = NULL; 	} 	R_FREE (bb); // double free }  R_API RList *r_anal_bb_list_new() {

Patch:
patch: @@ -62,7 +62,11 @@ R_API void r_anal_bb_free(RAnalBlock *bb) {
 		bb->failbb->prev = NULL;
 		bb->failbb = NULL;
 	}
-	R_FREE (bb);
+	if (bb->next) {
+		// avoid double free
+		bb->next->prev = NULL;
+	}
+	R_FREE (bb); // double free
 }
 
 R_API RList *r_anal_bb_list_new() {
path: libr/anal/bb.c
Vulnerability: There is a heap out of bounds read in radare2 2.6.0 in java_switch_op() in libr/anal/p/anal_java.c via a crafted Java binary file.
Vulnerability ID: CVE-2018-12321
CWE: CWE-125
Severity score: 6.4
Project: https://github.com/radare/radare2
Published: 2018-06-13
File: libr/anal/p/anal_java.c
Commit message: Fix #10296 - Heap out of bounds read in java_switch_op()
Commit author: pancake

Vulnerable version (before fix):
 static int java_switch_op(RAnal *anal, RAnalOp *op, ut64 addr, const ut8 *data,  	if (op_byte == 0xaa) { 		// handle a table switch condition 		if (pos + 8 > len) { 			return op->size; 		} 		int min_val = (ut32)(UINT (data, pos + 4)), 			max_val = (ut32)(UINT (data, pos + 8));  		ut32 default_loc = (ut32) (UINT (data, pos)), cur_case = 0; 		op->switch_op = r_anal_switch_op_new (addr, min_val, default_loc);

Fixed version (after fix):
 static int java_switch_op(RAnal *anal, RAnalOp *op, ut64 addr, const ut8 *data,  	if (op_byte == 0xaa) { 		// handle a table switch condition 		if (pos + 8 + 8 > len) { 			return op->size; 		} 		const int min_val = (ut32)(UINT (data, pos + 4)); 		const int max_val = (ut32)(UINT (data, pos + 8));  		ut32 default_loc = (ut32) (UINT (data, pos)), cur_case = 0; 		op->switch_op = r_anal_switch_op_new (addr, min_val, default_loc);

Patch:
patch: @@ -679,11 +679,11 @@ static int java_switch_op(RAnal *anal, RAnalOp *op, ut64 addr, const ut8 *data,
 
 	if (op_byte == 0xaa) {
 		// handle a table switch condition
-		if (pos + 8 > len) {
+		if (pos + 8 + 8 > len) {
 			return op->size;
 		}
-		int min_val = (ut32)(UINT (data, pos + 4)),
-			max_val = (ut32)(UINT (data, pos + 8));
+		const int min_val = (ut32)(UINT (data, pos + 4));
+		const int max_val = (ut32)(UINT (data, pos + 8));
 
 		ut32 default_loc = (ut32) (UINT (data, pos)), cur_case = 0;
 		op->switch_op = r_anal_switch_op_new (addr, min_val, default_loc);
path: libr/anal/p/anal_java.c
Vulnerability: There is a heap out of bounds read in radare2 2.6.0 in _6502_op() in libr/anal/p/anal_6502.c via a crafted iNES ROM binary file.
Vulnerability ID: CVE-2018-12322
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/radare/radare2
Published: 2018-06-13
File: libr/anal/p/anal_6502.c
Commit message: Fix #10294 - crash in r2_hoobr__6502_op
Commit author: pancake

Vulnerable version (before fix):
 static int _6502_op(RAnal *anal, RAnalOp *op, ut64 addr, const ut8 *data, int le 		op->cycles = 2; 		op->failcycles = 3; 		op->type = R_ANAL_OP_TYPE_CJMP; 		if (data[1] <= 127) 			op->jump = addr + data[1] + op->size; 		else	op->jump = addr - (256 - data[1]) + op->size; 		op->fail = addr + op->size; 		// FIXME: add a type of conditional 		// op->cond = R_ANAL_COND_LE;

Fixed version (after fix):
 static int _6502_op(RAnal *anal, RAnalOp *op, ut64 addr, const ut8 *data, int le 		op->cycles = 2; 		op->failcycles = 3; 		op->type = R_ANAL_OP_TYPE_CJMP; 		if (len > 1) { 			if (data[1] <= 127) { 				op->jump = addr + data[1] + op->size; 			} else { 				op->jump = addr - (256 - data[1]) + op->size; 			} 		} else { 			op->jump = addr; 		} 		op->fail = addr + op->size; 		// FIXME: add a type of conditional 		// op->cond = R_ANAL_COND_LE;

Patch:
patch: @@ -682,9 +682,15 @@ static int _6502_op(RAnal *anal, RAnalOp *op, ut64 addr, const ut8 *data, int le
 		op->cycles = 2;
 		op->failcycles = 3;
 		op->type = R_ANAL_OP_TYPE_CJMP;
-		if (data[1] <= 127)
-			op->jump = addr + data[1] + op->size;
-		else	op->jump = addr - (256 - data[1]) + op->size;
+		if (len > 1) {
+			if (data[1] <= 127) {
+				op->jump = addr + data[1] + op->size;
+			} else {
+				op->jump = addr - (256 - data[1]) + op->size;
+			}
+		} else {
+			op->jump = addr;
+		}
 		op->fail = addr + op->size;
 		// FIXME: add a type of conditional
 		// op->cond = R_ANAL_COND_LE;
path: libr/anal/p/anal_6502.c
Vulnerability: An inconsistent bits-per-sample value in the ff_mpeg4_decode_picture_header function in libavcodec/mpeg4videodec.c in FFmpeg 4.0 may trigger an assertion violation while converting a crafted AVI file to MPEG4, leading to a denial of service.
Vulnerability ID: CVE-2018-12459
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/FFmpeg/FFmpeg
Published: 2018-06-15
File: libavcodec/mpeg4videodec.c
Commit message: avcodec/mpeg4videodec: Clear bits_per_raw_sample if it has originated from a previous instance

Fixes: assertion failure
Fixes: ffmpeg_crash_5.avi

Found-by: Thuan Pham <thuanpv@comp.nus.edu.sg>, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 int ff_mpeg4_decode_picture_header(Mpeg4DecContext *ctx, GetBitContext *gb)     /* search next start code */     align_get_bits(gb);      if (s->codec_tag == AV_RL32("WV1F") && show_bits(gb, 24) == 0x575630) {         skip_bits(gb, 24);         if (get_bits(gb, 8) == 0xF0)

Fixed version (after fix):
 int ff_mpeg4_decode_picture_header(Mpeg4DecContext *ctx, GetBitContext *gb)     /* search next start code */     align_get_bits(gb);      // If we have not switched to studio profile than we also did not switch bps     // that means something else (like a previous instance) outside set bps which     // would be inconsistant with the currect state, thus reset it     if (!s->studio_profile && s->avctx->bits_per_raw_sample != 8)         s->avctx->bits_per_raw_sample = 0;      if (s->codec_tag == AV_RL32("WV1F") && show_bits(gb, 24) == 0x575630) {         skip_bits(gb, 24);         if (get_bits(gb, 8) == 0xF0)

Patch:
patch: @@ -3109,6 +3109,12 @@ int ff_mpeg4_decode_picture_header(Mpeg4DecContext *ctx, GetBitContext *gb)
     /* search next start code */
     align_get_bits(gb);
 
+    // If we have not switched to studio profile than we also did not switch bps
+    // that means something else (like a previous instance) outside set bps which
+    // would be inconsistant with the currect state, thus reset it
+    if (!s->studio_profile && s->avctx->bits_per_raw_sample != 8)
+        s->avctx->bits_per_raw_sample = 0;
+
     if (s->codec_tag == AV_RL32("WV1F") && show_bits(gb, 24) == 0x575630) {
         skip_bits(gb, 24);
         if (get_bits(gb, 8) == 0xF0)
path: libavcodec/mpeg4videodec.c
Vulnerability: An issue was discovered in the Linux kernel through 4.17.2. vbg_misc_device_ioctl() in drivers/virt/vboxguest/vboxguest_linux.c reads the same user data twice with copy_from_user. The header part of the user data is double-fetched, and a malicious user thread can tamper with the critical variables (hdr.size_in and hdr.size_out) in the header between the two fetches because of a race condition, leading to severe kernel errors, such as buffer over-accesses. This bug can cause a local denial of service and information leakage.
Vulnerability ID: CVE-2018-12633
CWE: CWE-362
Severity score: 9.2
Project: https://github.com/torvalds/linux
Published: 2018-06-22
File: drivers/virt/vboxguest/vboxguest_linux.c
Commit message: virt: vbox: Only copy_from_user the request-header once

In vbg_misc_device_ioctl(), the header of the ioctl argument is copied from
the userspace pointer 'arg' and saved to the kernel object 'hdr'. Then the
'version', 'size_in', and 'size_out' fields of 'hdr' are verified.

Before this commit, after the checks a buffer for the entire request would
be allocated and then all data including the verified header would be
copied from the userspace 'arg' pointer again.

Given that the 'arg' pointer resides in userspace, a malicious userspace
process can race to change the data pointed to by 'arg' between the two
copies. By doing so, the user can bypass the verifications on the ioctl
argument.

This commit fixes this by using the already checked copy of the header
to fill the header part of the allocated buffer and only copying the
remainder of the data from userspace.

Signed-off-by: Wenwen Wang <wang6495@umn.edu>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Commit author: Wenwen Wang

Vulnerable version (before fix):
 static long vbg_misc_device_ioctl(struct file *filp, unsigned int req, 	if (!buf) 		return -ENOMEM;  	if (copy_from_user(buf, (void *)arg, hdr.size_in)) { 		ret = -EFAULT; 		goto out; 	}

Fixed version (after fix):
 static long vbg_misc_device_ioctl(struct file *filp, unsigned int req, 	if (!buf) 		return -ENOMEM;  	*((struct vbg_ioctl_hdr *)buf) = hdr; 	if (copy_from_user(buf + sizeof(hdr), (void *)arg + sizeof(hdr), 			   hdr.size_in - sizeof(hdr))) { 		ret = -EFAULT; 		goto out; 	}

Patch:
patch: @@ -121,7 +121,9 @@ static long vbg_misc_device_ioctl(struct file *filp, unsigned int req,
 	if (!buf)
 		return -ENOMEM;
 
-	if (copy_from_user(buf, (void *)arg, hdr.size_in)) {
+	*((struct vbg_ioctl_hdr *)buf) = hdr;
+	if (copy_from_user(buf + sizeof(hdr), (void *)arg + sizeof(hdr),
+			   hdr.size_in - sizeof(hdr))) {
 		ret = -EFAULT;
 		goto out;
 	}
path: drivers/virt/vboxguest/vboxguest_linux.c
Vulnerability: Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Denial of Service or Information Disclosure via a crafted SSI file.
Vulnerability ID: CVE-2018-12684
CWE: CWE-200
Severity score: 4.9
Project: https://github.com/civetweb/civetweb
Published: 2018-06-22
File: src/civetweb.c
Commit message: Check length of memcmp
Commit author: bel2125

Vulnerable version (before fix):
 send_ssi_file(struct mg_connection *conn, 					/* Handle SSI tag */ 					buf[len] = 0;  					if (!memcmp(buf + 5, "include", 7)) { 						do_ssi_include(conn, path, buf + 12, include_level + 1); #if !defined(NO_POPEN) 					} else if (!memcmp(buf + 5, "exec", 4)) { 						do_ssi_exec(conn, buf + 9); #endif /* !NO_POPEN */ 					} else {

Fixed version (after fix):
 send_ssi_file(struct mg_connection *conn, 					/* Handle SSI tag */ 					buf[len] = 0;  					if ((len > 12) && !memcmp(buf + 5, "include", 7)) { 						do_ssi_include(conn, path, buf + 12, include_level + 1); #if !defined(NO_POPEN) 					} else if ((len > 9) && !memcmp(buf + 5, "exec", 4)) { 						do_ssi_exec(conn, buf + 9); #endif /* !NO_POPEN */ 					} else {

Patch:
patch: @@ -11611,10 +11611,10 @@ send_ssi_file(struct mg_connection *conn,
 					/* Handle SSI tag */
 					buf[len] = 0;
 
-					if (!memcmp(buf + 5, "include", 7)) {
+					if ((len > 12) && !memcmp(buf + 5, "include", 7)) {
 						do_ssi_include(conn, path, buf + 12, include_level + 1);
 #if !defined(NO_POPEN)
-					} else if (!memcmp(buf + 5, "exec", 4)) {
+					} else if ((len > 9) && !memcmp(buf + 5, "exec", 4)) {
 						do_ssi_exec(conn, buf + 9);
 #endif /* !NO_POPEN */
 					} else {
path: src/civetweb.c
Vulnerability: Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Denial of Service or Information Disclosure via a crafted SSI file.
Vulnerability ID: CVE-2018-12684
CWE: CWE-125
Severity score: 4.9
Project: https://github.com/civetweb/civetweb
Published: 2018-06-22
File: src/civetweb.c
Commit message: Check length of memcmp
Commit author: bel2125

Vulnerable version (before fix):
 send_ssi_file(struct mg_connection *conn, 					/* Handle SSI tag */ 					buf[len] = 0;  					if (!memcmp(buf + 5, "include", 7)) { 						do_ssi_include(conn, path, buf + 12, include_level + 1); #if !defined(NO_POPEN) 					} else if (!memcmp(buf + 5, "exec", 4)) { 						do_ssi_exec(conn, buf + 9); #endif /* !NO_POPEN */ 					} else {

Fixed version (after fix):
 send_ssi_file(struct mg_connection *conn, 					/* Handle SSI tag */ 					buf[len] = 0;  					if ((len > 12) && !memcmp(buf + 5, "include", 7)) { 						do_ssi_include(conn, path, buf + 12, include_level + 1); #if !defined(NO_POPEN) 					} else if ((len > 9) && !memcmp(buf + 5, "exec", 4)) { 						do_ssi_exec(conn, buf + 9); #endif /* !NO_POPEN */ 					} else {

Patch:
patch: @@ -11611,10 +11611,10 @@ send_ssi_file(struct mg_connection *conn,
 					/* Handle SSI tag */
 					buf[len] = 0;
 
-					if (!memcmp(buf + 5, "include", 7)) {
+					if ((len > 12) && !memcmp(buf + 5, "include", 7)) {
 						do_ssi_include(conn, path, buf + 12, include_level + 1);
 #if !defined(NO_POPEN)
-					} else if (!memcmp(buf + 5, "exec", 4)) {
+					} else if ((len > 9) && !memcmp(buf + 5, "exec", 4)) {
 						do_ssi_exec(conn, buf + 9);
 #endif /* !NO_POPEN */
 					} else {
path: src/civetweb.c
Vulnerability: A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) in MantisBT 2.1.0 through 2.15.0 allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted PATH_INFO.
Vulnerability ID: CVE-2018-13055
CWE: CWE-79
Severity score: 2.9
Project: http://github.com/mantisbt/mantisbt
Published: 2018-08-03
File: core/filter_form_api.php
Commit message: Fix XSS in filter_form_draw_inputs() (CVE-2018-13055)

Ömer Çıtak, Security Researcher at Netsparker, reported this
vulnerability, allowing remote attackers to inject arbitrary code
(if CSP settings permit it) through a crafted PATH_INFO on
view_filters_page.php.

Prevent the attack by sanitizing the output of $_SERVER['PHP_SELF']
before display.

Fixes #24580
Commit author: Damien Regad

Vulnerable version (before fix):
 function filter_form_draw_inputs( $p_filter, $p_for_screen = true, $p_static = f  	if( null === $p_static_fallback_page ) { 		$p_static_fallback_page = $_SERVER['PHP_SELF']; 	} 	$t_filters_url = $p_static_fallback_page; 	$t_get_params = $_GET;

Fixed version (after fix):
 function filter_form_draw_inputs( $p_filter, $p_for_screen = true, $p_static = f  	if( null === $p_static_fallback_page ) { 		$p_static_fallback_page = $_SERVER['PHP_SELF']; 		$p_static_fallback_page = string_sanitize_url( $_SERVER['PHP_SELF'] ); 	} 	$t_filters_url = $p_static_fallback_page; 	$t_get_params = $_GET;

Patch:
patch: @@ -2394,6 +2394,7 @@ function filter_form_draw_inputs( $p_filter, $p_for_screen = true, $p_static = f
 
 	if( null === $p_static_fallback_page ) {
 		$p_static_fallback_page = $_SERVER['PHP_SELF'];
+		$p_static_fallback_page = string_sanitize_url( $_SERVER['PHP_SELF'] );
 	}
 	$t_filters_url = $p_static_fallback_page;
 	$t_get_params = $_GET;
path: core/filter_form_api.php
Vulnerability: An issue was discovered in fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel through 4.17.3. An OOPS may occur for a corrupted xfs image after xfs_da_shrink_inode() is called with a NULL bp.
Vulnerability ID: CVE-2018-13094
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2018-07-03
File: fs/xfs/libxfs/xfs_attr_leaf.c
Commit message: xfs: don't call xfs_da_shrink_inode with NULL bp

xfs_attr3_leaf_create may have errored out before instantiating a buffer,
for example if the blkno is out of range.  In that case there is no work
to do to remove it, and in fact xfs_da_shrink_inode will lead to an oops
if we try.

This also seems to fix a flaw where the original error from
xfs_attr3_leaf_create gets overwritten in the cleanup case, and it
removes a pointless assignment to bp which isn't used after this.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199969
Reported-by: Xu, Wen <wen.xu@gatech.edu>
Tested-by: Xu, Wen <wen.xu@gatech.edu>
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Commit author: Eric Sandeen

Vulnerable version (before fix):
 xfs_attr_shortform_to_leaf( 	ASSERT(blkno == 0); 	error = xfs_attr3_leaf_create(args, blkno, &bp); 	if (error) { 		error = xfs_da_shrink_inode(args, 0, bp); 		bp = NULL; 		if (error) 			goto out; 		xfs_idata_realloc(dp, size, XFS_ATTR_FORK);	/* try to put */ 		memcpy(ifp->if_u1.if_data, tmpbuffer, size);	/* it back */

Fixed version (after fix):
 xfs_attr_shortform_to_leaf( 	ASSERT(blkno == 0); 	error = xfs_attr3_leaf_create(args, blkno, &bp); 	if (error) { 		/* xfs_attr3_leaf_create may not have instantiated a block */ 		if (bp && (xfs_da_shrink_inode(args, 0, bp) != 0)) 			goto out; 		xfs_idata_realloc(dp, size, XFS_ATTR_FORK);	/* try to put */ 		memcpy(ifp->if_u1.if_data, tmpbuffer, size);	/* it back */

Patch:
patch: @@ -791,9 +791,8 @@ xfs_attr_shortform_to_leaf(
 	ASSERT(blkno == 0);
 	error = xfs_attr3_leaf_create(args, blkno, &bp);
 	if (error) {
-		error = xfs_da_shrink_inode(args, 0, bp);
-		bp = NULL;
-		if (error)
+		/* xfs_attr3_leaf_create may not have instantiated a block */
+		if (bp && (xfs_da_shrink_inode(args, 0, bp) != 0))
 			goto out;
 		xfs_idata_realloc(dp, size, XFS_ATTR_FORK);	/* try to put */
 		memcpy(ifp->if_u1.if_data, tmpbuffer, size);	/* it back */
path: fs/xfs/libxfs/xfs_attr_leaf.c
Vulnerability: In FFmpeg 4.0.1, a missing check for failure of a call to init_get_bits8() in the avpriv_ac3_parse_header function in libavcodec/ac3_parser.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service.
Vulnerability ID: CVE-2018-13303
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/FFmpeg/FFmpeg
Published: 2018-07-05
File: libavcodec/ac3_parser.c
Commit message: avcodec/ac3_parser: Check init_get_bits8() for failure

Fixes: null pointer dereference
Fixes: ffmpeg_crash_6.avi

Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 int avpriv_ac3_parse_header(AC3HeaderInfo **phdr, const uint8_t *buf,         return AVERROR(ENOMEM);     hdr = *phdr;      init_get_bits8(&gb, buf, size);     err = ff_ac3_parse_header(&gb, hdr);     if (err < 0)         return AVERROR_INVALIDDATA;

Fixed version (after fix):
 int avpriv_ac3_parse_header(AC3HeaderInfo **phdr, const uint8_t *buf,         return AVERROR(ENOMEM);     hdr = *phdr;      err = init_get_bits8(&gb, buf, size);     if (err < 0)         return AVERROR_INVALIDDATA;     err = ff_ac3_parse_header(&gb, hdr);     if (err < 0)         return AVERROR_INVALIDDATA;

Patch:
patch: @@ -162,7 +162,9 @@ int avpriv_ac3_parse_header(AC3HeaderInfo **phdr, const uint8_t *buf,
         return AVERROR(ENOMEM);
     hdr = *phdr;
 
-    init_get_bits8(&gb, buf, size);
+    err = init_get_bits8(&gb, buf, size);
+    if (err < 0)
+        return AVERROR_INVALIDDATA;
     err = ff_ac3_parse_header(&gb, hdr);
     if (err < 0)
         return AVERROR_INVALIDDATA;
path: libavcodec/ac3_parser.c