rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize that could lead to a later out-of-bounds read.
Vulnerability ID: CVE-2020-11046
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/FreeRDP/FreeRDP
Published: 2020-05-07
File: libfreerdp/core/update.c
Commit message: Fixed #6006: bounds checks in update_read_synchronize
Commit author: akallabeth

Vulnerable version (before fix):
 PALETTE_UPDATE* update_read_palette(rdpUpdate* update, wStream* s) 	return NULL; }  static void update_read_synchronize(rdpUpdate* update, wStream* s) { 	WINPR_UNUSED(update); 	Stream_Seek_UINT16(s); /* pad2Octets (2 bytes) */ 	                       /** 	                        * The Synchronize Update is an artifact from the 	                        * T.128 protocol and should be ignored. 	                        */ }  static BOOL update_read_play_sound(wStream* s, PLAY_SOUND_UPDATE* play_sound) BOOL update_recv(rdpUpdate* update, wStream* s) 		break;  		case UPDATE_TYPE_SYNCHRONIZE: 			update_read_synchronize(update, s); 			rc = IFCALLRESULT(TRUE, update->Synchronize, context); 			break; 

Fixed version (after fix):
 PALETTE_UPDATE* update_read_palette(rdpUpdate* update, wStream* s) 	return NULL; }  static BOOL update_read_synchronize(rdpUpdate* update, wStream* s) { 	WINPR_UNUSED(update); 	return Stream_SafeSeek(s, 2); /* pad2Octets (2 bytes) */ 	                              /** 	                               * The Synchronize Update is an artifact from the 	                               * T.128 protocol and should be ignored. 	                               */ }  static BOOL update_read_play_sound(wStream* s, PLAY_SOUND_UPDATE* play_sound) BOOL update_recv(rdpUpdate* update, wStream* s) 		break;  		case UPDATE_TYPE_SYNCHRONIZE: 			if (!update_read_synchronize(update, s)) 				goto fail; 			rc = IFCALLRESULT(TRUE, update->Synchronize, context); 			break; 

Patch:
patch: @@ -287,14 +287,14 @@ PALETTE_UPDATE* update_read_palette(rdpUpdate* update, wStream* s)
 	return NULL;
 }
 
-static void update_read_synchronize(rdpUpdate* update, wStream* s)
+static BOOL update_read_synchronize(rdpUpdate* update, wStream* s)
 {
 	WINPR_UNUSED(update);
-	Stream_Seek_UINT16(s); /* pad2Octets (2 bytes) */
-	                       /**
-	                        * The Synchronize Update is an artifact from the
-	                        * T.128 protocol and should be ignored.
-	                        */
+	return Stream_SafeSeek(s, 2); /* pad2Octets (2 bytes) */
+	                              /**
+	                               * The Synchronize Update is an artifact from the
+	                               * T.128 protocol and should be ignored.
+	                               */
 }
 
 static BOOL update_read_play_sound(wStream* s, PLAY_SOUND_UPDATE* play_sound)
@@ -807,7 +807,8 @@ BOOL update_recv(rdpUpdate* update, wStream* s)
 		break;
 
 		case UPDATE_TYPE_SYNCHRONIZE:
-			update_read_synchronize(update, s);
+			if (!update_read_synchronize(update, s))
+				goto fail;
 			rc = IFCALLRESULT(TRUE, update->Synchronize, context);
 			break;
path: libfreerdp/core/update.c
Vulnerability: In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory with a manipulated message by providing a short input and reading the measurement result data. This has been patched in 2.0.0.
Vulnerability ID: CVE-2020-11047
CWE: CWE-125
Severity score: 4.9
Project: https://github.com/FreeRDP/FreeRDP
Published: 2020-05-07
File: libfreerdp/core/autodetect.c
Commit message: Fixed #6009: Bounds checks in autodetect_recv_bandwidth_measure_results
Commit author: akallabeth

Vulnerable version (before fix):
 static BOOL autodetect_recv_bandwidth_measure_results(rdpRdp* rdp, wStream* s, 		return FALSE;  	WLog_VRB(AUTODETECT_TAG, "received Bandwidth Measure Results PDU"); 	Stream_Read_UINT32(s, rdp->autodetect->bandwidthMeasureTimeDelta); /* timeDelta (4 bytes) */ 	Stream_Read_UINT32(s, rdp->autodetect->bandwidthMeasureByteCount); /* byteCount (4 bytes) */ 

Fixed version (after fix):
 static BOOL autodetect_recv_bandwidth_measure_results(rdpRdp* rdp, wStream* s, 		return FALSE;  	WLog_VRB(AUTODETECT_TAG, "received Bandwidth Measure Results PDU"); 	if (Stream_GetRemainingLength(s) < 8) 		return -1; 	Stream_Read_UINT32(s, rdp->autodetect->bandwidthMeasureTimeDelta); /* timeDelta (4 bytes) */ 	Stream_Read_UINT32(s, rdp->autodetect->bandwidthMeasureByteCount); /* byteCount (4 bytes) */ 

Patch:
patch: @@ -465,6 +465,8 @@ static BOOL autodetect_recv_bandwidth_measure_results(rdpRdp* rdp, wStream* s,
 		return FALSE;
 
 	WLog_VRB(AUTODETECT_TAG, "received Bandwidth Measure Results PDU");
+	if (Stream_GetRemainingLength(s) < 8)
+		return -1;
 	Stream_Read_UINT32(s, rdp->autodetect->bandwidthMeasureTimeDelta); /* timeDelta (4 bytes) */
 	Stream_Read_UINT32(s, rdp->autodetect->bandwidthMeasureByteCount); /* byteCount (4 bytes) */
path: libfreerdp/core/autodetect.c
Vulnerability: In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect due to an invalid data read. This has been fixed in 2.0.0.
Vulnerability ID: CVE-2020-11058
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/FreeRDP/FreeRDP
Published: 2020-05-12
File: libfreerdp/core/capabilities.c
Commit message: Fixed #6011: Bounds check in rdp_read_font_capability_set
Commit author: akallabeth

Vulnerable version (before fix):
 static BOOL rdp_print_input_capability_set(wStream* s, UINT16 length) static BOOL rdp_read_font_capability_set(wStream* s, UINT16 length, rdpSettings* settings) { 	WINPR_UNUSED(settings); 	if (length > 4) 		Stream_Seek_UINT16(s); /* fontSupportFlags (2 bytes) */  	if (length > 6) 		Stream_Seek_UINT16(s); /* pad2Octets (2 bytes) */  	return TRUE;

Fixed version (after fix):
 static BOOL rdp_print_input_capability_set(wStream* s, UINT16 length) static BOOL rdp_read_font_capability_set(wStream* s, UINT16 length, rdpSettings* settings) { 	WINPR_UNUSED(settings); 	if (length > 5) 		Stream_Seek_UINT16(s); /* fontSupportFlags (2 bytes) */  	if (length > 7) 		Stream_Seek_UINT16(s); /* pad2Octets (2 bytes) */  	return TRUE;

Patch:
patch: @@ -1397,10 +1397,10 @@ static BOOL rdp_print_input_capability_set(wStream* s, UINT16 length)
 static BOOL rdp_read_font_capability_set(wStream* s, UINT16 length, rdpSettings* settings)
 {
 	WINPR_UNUSED(settings);
-	if (length > 4)
+	if (length > 5)
 		Stream_Seek_UINT16(s); /* fontSupportFlags (2 bytes) */
 
-	if (length > 6)
+	if (length > 7)
 		Stream_Seek_UINT16(s); /* pad2Octets (2 bytes) */
 
 	return TRUE;
path: libfreerdp/core/capabilities.c
Vulnerability: In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This has been fixed in 2.1.0.
Vulnerability ID: CVE-2020-11086
CWE: CWE-125
Severity score: 4.9
Project: https://github.com/FreeRDP/FreeRDP
Published: 2020-05-29
File: winpr/libwinpr/sspi/NTLM/ntlm_compute.c
Commit message: Fixed oob read in ntlm_read_ntlm_v2_response
Commit author: akallabeth

Vulnerable version (before fix):
 void ntlm_print_version_info(NTLM_VERSION_INFO* versionInfo) static int ntlm_read_ntlm_v2_client_challenge(wStream* s, NTLMv2_CLIENT_CHALLENGE* challenge) { 	size_t size; 	Stream_Read_UINT8(s, challenge->RespType); 	Stream_Read_UINT8(s, challenge->HiRespType); 	Stream_Read_UINT16(s, challenge->Reserved1); static int ntlm_write_ntlm_v2_client_challenge(wStream* s, NTLMv2_CLIENT_CHALLEN  int ntlm_read_ntlm_v2_response(wStream* s, NTLMv2_RESPONSE* response) { 	Stream_Read(s, response->Response, 16); 	return ntlm_read_ntlm_v2_client_challenge(s, &(response->Challenge)); }

Fixed version (after fix):
 void ntlm_print_version_info(NTLM_VERSION_INFO* versionInfo) static int ntlm_read_ntlm_v2_client_challenge(wStream* s, NTLMv2_CLIENT_CHALLENGE* challenge) { 	size_t size; 	if (Stream_GetRemainingLength(s) < 28) 		return -1;  	Stream_Read_UINT8(s, challenge->RespType); 	Stream_Read_UINT8(s, challenge->HiRespType); 	Stream_Read_UINT16(s, challenge->Reserved1); static int ntlm_write_ntlm_v2_client_challenge(wStream* s, NTLMv2_CLIENT_CHALLEN  int ntlm_read_ntlm_v2_response(wStream* s, NTLMv2_RESPONSE* response) { 	if (Stream_GetRemainingLength(s) < 16) 		return -1; 	Stream_Read(s, response->Response, 16); 	return ntlm_read_ntlm_v2_client_challenge(s, &(response->Challenge)); }

Patch:
patch: @@ -124,6 +124,9 @@ void ntlm_print_version_info(NTLM_VERSION_INFO* versionInfo)
 static int ntlm_read_ntlm_v2_client_challenge(wStream* s, NTLMv2_CLIENT_CHALLENGE* challenge)
 {
 	size_t size;
+	if (Stream_GetRemainingLength(s) < 28)
+		return -1;
+
 	Stream_Read_UINT8(s, challenge->RespType);
 	Stream_Read_UINT8(s, challenge->HiRespType);
 	Stream_Read_UINT16(s, challenge->Reserved1);
@@ -163,6 +166,8 @@ static int ntlm_write_ntlm_v2_client_challenge(wStream* s, NTLMv2_CLIENT_CHALLEN
 
 int ntlm_read_ntlm_v2_response(wStream* s, NTLMv2_RESPONSE* response)
 {
+	if (Stream_GetRemainingLength(s) < 16)
+		return -1;
 	Stream_Read(s, response->Response, 16);
 	return ntlm_read_ntlm_v2_client_challenge(s, &(response->Challenge));
 }
path: winpr/libwinpr/sspi/NTLM/ntlm_compute.c
Vulnerability: In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This has been fixed in 2.1.0.
Vulnerability ID: CVE-2020-11088
CWE: CWE-125
Severity score: 4.9
Project: https://github.com/FreeRDP/FreeRDP
Published: 2020-05-29
File: winpr/libwinpr/sspi/NTLM/ntlm_message.c
Commit message: Fixed oob read in ntlm_read_NegotiateMessage
Commit author: akallabeth

Vulnerable version (before fix):
 SECURITY_STATUS ntlm_read_NegotiateMessage(NTLM_CONTEXT* context, PSecBuffer buf 		return SEC_E_INVALID_TOKEN; 	}  	Stream_Read_UINT32(s, message->NegotiateFlags); /* NegotiateFlags (4 bytes) */  	if (!((message->NegotiateFlags & NTLMSSP_REQUEST_TARGET) &&

Fixed version (after fix):
 SECURITY_STATUS ntlm_read_NegotiateMessage(NTLM_CONTEXT* context, PSecBuffer buf 		return SEC_E_INVALID_TOKEN; 	}  	if (Stream_GetRemainingLength(s) < 4) 	{ 		Stream_Free(s, FALSE); 		return SEC_E_INVALID_TOKEN; 	} 	Stream_Read_UINT32(s, message->NegotiateFlags); /* NegotiateFlags (4 bytes) */  	if (!((message->NegotiateFlags & NTLMSSP_REQUEST_TARGET) &&

Patch:
patch: @@ -219,6 +219,11 @@ SECURITY_STATUS ntlm_read_NegotiateMessage(NTLM_CONTEXT* context, PSecBuffer buf
 		return SEC_E_INVALID_TOKEN;
 	}
 
+	if (Stream_GetRemainingLength(s) < 4)
+	{
+		Stream_Free(s, FALSE);
+		return SEC_E_INVALID_TOKEN;
+	}
 	Stream_Read_UINT32(s, message->NegotiateFlags); /* NegotiateFlags (4 bytes) */
 
 	if (!((message->NegotiateFlags & NTLMSSP_REQUEST_TARGET) &&
path: winpr/libwinpr/sspi/NTLM/ntlm_message.c
Vulnerability: In FreeRDP before version 2.1.2, there is an out-of-bound read in glyph_cache_put. This affects all FreeRDP clients with `+glyph-cache` option enabled This is fixed in version 2.1.2.
Vulnerability ID: CVE-2020-11098
CWE: CWE-125
Severity score: 4.9
Project: https://github.com/FreeRDP/FreeRDP
Published: 2020-06-22
File: libfreerdp/cache/glyph.c
Commit message: Fixed Out-of-bound read in glyph_cache_put

CVE-2020-11098 thanks to @antonio-morales for finding this.
Commit author: akallabeth

Vulnerable version (before fix):
 BOOL glyph_cache_put(rdpGlyphCache* glyphCache, UINT32 id, UINT32 index, rdpGlyp 		return FALSE; 	}  	if (index > glyphCache->glyphCache[id].number) 	{ 		WLog_ERR(TAG, "invalid glyph cache index: %" PRIu32 " in cache id: %" PRIu32 "", index, id); 		return FALSE;

Fixed version (after fix):
 BOOL glyph_cache_put(rdpGlyphCache* glyphCache, UINT32 id, UINT32 index, rdpGlyp 		return FALSE; 	}  	if (index >= glyphCache->glyphCache[id].number) 	{ 		WLog_ERR(TAG, "invalid glyph cache index: %" PRIu32 " in cache id: %" PRIu32 "", index, id); 		return FALSE;

Patch:
patch: @@ -579,7 +579,7 @@ BOOL glyph_cache_put(rdpGlyphCache* glyphCache, UINT32 id, UINT32 index, rdpGlyp
 		return FALSE;
 	}
 
-	if (index > glyphCache->glyphCache[id].number)
+	if (index >= glyphCache->glyphCache[id].number)
 	{
 		WLog_ERR(TAG, "invalid glyph cache index: %" PRIu32 " in cache id: %" PRIu32 "", index, id);
 		return FALSE;
path: libfreerdp/cache/glyph.c
Vulnerability: pfSense before 2.4.5 has stored XSS in system_usermanager_addprivs.php in the WebGUI via the descr parameter (aka full name) of a user.
Vulnerability ID: CVE-2020-11457
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/pfsense/pfsense
Published: 2020-04-01
File: src/usr/local/www/system_usermanager_addprivs.php
Commit message: Encode user descr before output. Fixes #103241
Commit author: jim-p

Vulnerable version (before fix):
 function get_root_priv_item_text() {  $name_string = $a_user['name']; if (!empty($a_user['descr'])) { 	$name_string .= " ({$a_user['descr']})"; }  $section->addInput(new Form_StaticText(

Fixed version (after fix):
 function get_root_priv_item_text() {  $name_string = $a_user['name']; if (!empty($a_user['descr'])) { 	$name_string .= " (" . htmlspecialchars($a_user['descr']) . ")"; }  $section->addInput(new Form_StaticText(

Patch:
patch: @@ -157,7 +157,7 @@ function get_root_priv_item_text() {
 
 $name_string = $a_user['name'];
 if (!empty($a_user['descr'])) {
-	$name_string .= " ({$a_user['descr']})";
+	$name_string .= " (" . htmlspecialchars($a_user['descr']) . ")";
 }
 
 $section->addInput(new Form_StaticText(
path: src/usr/local/www/system_usermanager_addprivs.php
Vulnerability: libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.
Vulnerability ID: CVE-2020-11525
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/FreeRDP/FreeRDP
Published: 2020-05-15
File: libfreerdp/cache/bitmap.c
Commit message: Fixed possible NULL dereference
Commit author: akallabeth

Vulnerable version (before fix):
 rdpBitmapCache* bitmap_cache_new(rdpSettings* settings) 	bitmapCache->settings = settings; 	bitmapCache->update = ((freerdp*)settings->instance)->update; 	bitmapCache->context = bitmapCache->update->context; 	bitmapCache->maxCells = settings->BitmapCacheV2NumCells; 	bitmapCache->cells = (BITMAP_V2_CELL*)calloc(bitmapCache->maxCells, sizeof(BITMAP_V2_CELL));  	if (!bitmapCache->cells) 		goto fail;  	for (i = 0; i < (int)bitmapCache->maxCells; i++) 	{

Fixed version (after fix):
 rdpBitmapCache* bitmap_cache_new(rdpSettings* settings) 	bitmapCache->settings = settings; 	bitmapCache->update = ((freerdp*)settings->instance)->update; 	bitmapCache->context = bitmapCache->update->context; 	bitmapCache->cells = 	    (BITMAP_V2_CELL*)calloc(settings->BitmapCacheV2NumCells, sizeof(BITMAP_V2_CELL));  	if (!bitmapCache->cells) 		goto fail; 	bitmapCache->maxCells = settings->BitmapCacheV2NumCells;  	for (i = 0; i < (int)bitmapCache->maxCells; i++) 	{

Patch:
patch: @@ -281,11 +281,12 @@ rdpBitmapCache* bitmap_cache_new(rdpSettings* settings)
 	bitmapCache->settings = settings;
 	bitmapCache->update = ((freerdp*)settings->instance)->update;
 	bitmapCache->context = bitmapCache->update->context;
-	bitmapCache->maxCells = settings->BitmapCacheV2NumCells;
-	bitmapCache->cells = (BITMAP_V2_CELL*)calloc(bitmapCache->maxCells, sizeof(BITMAP_V2_CELL));
+	bitmapCache->cells =
+	    (BITMAP_V2_CELL*)calloc(settings->BitmapCacheV2NumCells, sizeof(BITMAP_V2_CELL));
 
 	if (!bitmapCache->cells)
 		goto fail;
+	bitmapCache->maxCells = settings->BitmapCacheV2NumCells;
 
 	for (i = 0; i < (int)bitmapCache->maxCells; i++)
 	{
path: libfreerdp/cache/bitmap.c
Vulnerability: An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. audio_sample_entry_Read in isomedia/box_code_base.c does not properly decide when to make gf_isom_box_del calls. This leads to various use-after-free outcomes involving mdia_Read, gf_isom_delete_movie, and gf_isom_parse_movie_boxes.
Vulnerability ID: CVE-2020-11558
CWE: CWE-416
Severity score: 6.4
Project: https://github.com/gpac/gpac
Published: 2020-04-05
File: src/isomedia/box_code_base.c
Commit message: fix UAF in audio_sample_entry_Read (#1440)
Commit author: Aurelien David

Vulnerable version (before fix):
 GF_Err audio_sample_entry_Read(GF_Box *s, GF_BitStream *bs) 	gf_bs_read_data(bs, data, size); 	for (i=0; i<size-8; i++) { 		if (GF_4CC((u32)data[i+4], (u8)data[i+5], (u8)data[i+6], (u8)data[i+7]) == GF_ISOM_BOX_TYPE_ESDS) { 			GF_BitStream *mybs = gf_bs_new(data + i, size - i, GF_BITSTREAM_READ); 			if (ptr->esd) { 				gf_isom_box_del((GF_Box *)ptr->esd); 				ptr->esd=NULL; 			} 

Fixed version (after fix):
 GF_Err audio_sample_entry_Read(GF_Box *s, GF_BitStream *bs) 	gf_bs_read_data(bs, data, size); 	for (i=0; i<size-8; i++) { 		if (GF_4CC((u32)data[i+4], (u8)data[i+5], (u8)data[i+6], (u8)data[i+7]) == GF_ISOM_BOX_TYPE_ESDS) { 			extern Bool use_dump_mode; 			GF_BitStream *mybs = gf_bs_new(data + i, size - i, GF_BITSTREAM_READ); 			if (ptr->esd) { 				if (!use_dump_mode) gf_isom_box_del((GF_Box *)ptr->esd); 				ptr->esd=NULL; 			} 

Patch:
patch: @@ -4069,9 +4069,10 @@ GF_Err audio_sample_entry_Read(GF_Box *s, GF_BitStream *bs)
 	gf_bs_read_data(bs, data, size);
 	for (i=0; i<size-8; i++) {
 		if (GF_4CC((u32)data[i+4], (u8)data[i+5], (u8)data[i+6], (u8)data[i+7]) == GF_ISOM_BOX_TYPE_ESDS) {
+			extern Bool use_dump_mode;
 			GF_BitStream *mybs = gf_bs_new(data + i, size - i, GF_BITSTREAM_READ);
 			if (ptr->esd) {
-				gf_isom_box_del((GF_Box *)ptr->esd);
+				if (!use_dump_mode) gf_isom_box_del((GF_Box *)ptr->esd);
 				ptr->esd=NULL;
 			}
path: src/isomedia/box_code_base.c
Vulnerability: ** DISPUTED ** An issue was discovered in the Linux kernel through 5.6.2. mpol_parse_str in mm/mempolicy.c has a stack-based out-of-bounds write because an empty nodelist is mishandled during mount option parsing, aka CID-aa9f7d5172fa. NOTE: Someone in the security community disagrees that this is a vulnerability because the issue “is a bug in parsing mount options which can only be specified by a privileged user, so triggering the bug does not grant any powers not already held.”.
Vulnerability ID: CVE-2020-11565
CWE: CWE-787
Severity score: 4.9
Project: https://github.com/torvalds/linux
Published: 2020-04-06
File: mm/mempolicy.c
Commit message: mm: mempolicy: require at least one nodeid for MPOL_PREFERRED

Using an empty (malformed) nodelist that is not caught during mount option
parsing leads to a stack-out-of-bounds access.

The option string that was used was: "mpol=prefer:,".  However,
MPOL_PREFERRED requires a single node number, which is not being provided
here.

Add a check that 'nodes' is not empty after parsing for MPOL_PREFERRED's
nodeid.

Fixes: 095f1fc4ebf3 ("mempolicy: rework shmem mpol parsing and display")
Reported-by: Entropy Moe <3ntr0py1337@gmail.com>
Reported-by: syzbot+b055b1a6b2b958707a21@syzkaller.appspotmail.com
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: syzbot+b055b1a6b2b958707a21@syzkaller.appspotmail.com
Cc: Lee Schermerhorn <lee.schermerhorn@hp.com>
Link: http://lkml.kernel.org/r/89526377-7eb6-b662-e1d8-4430928abde9@infradead.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Randy Dunlap

Vulnerable version (before fix):
 int mpol_parse_str(char *str, struct mempolicy **mpol) 	switch (mode) { 	case MPOL_PREFERRED: 		/* 		 * Insist on a nodelist of one node only 		 */ 		if (nodelist) { 			char *rest = nodelist; 			while (isdigit(*rest)) 				rest++; 			if (*rest) 				goto out; 		} 		break; 	case MPOL_INTERLEAVE:

Fixed version (after fix):
 int mpol_parse_str(char *str, struct mempolicy **mpol) 	switch (mode) { 	case MPOL_PREFERRED: 		/* 		 * Insist on a nodelist of one node only, although later 		 * we use first_node(nodes) to grab a single node, so here 		 * nodelist (or nodes) cannot be empty. 		 */ 		if (nodelist) { 			char *rest = nodelist; 			while (isdigit(*rest)) 				rest++; 			if (*rest) 				goto out; 			if (nodes_empty(nodes)) 				goto out; 		} 		break; 	case MPOL_INTERLEAVE:

Patch:
patch: @@ -2898,14 +2898,18 @@ int mpol_parse_str(char *str, struct mempolicy **mpol)
 	switch (mode) {
 	case MPOL_PREFERRED:
 		/*
-		 * Insist on a nodelist of one node only
+		 * Insist on a nodelist of one node only, although later
+		 * we use first_node(nodes) to grab a single node, so here
+		 * nodelist (or nodes) cannot be empty.
 		 */
 		if (nodelist) {
 			char *rest = nodelist;
 			while (isdigit(*rest))
 				rest++;
 			if (*rest)
 				goto out;
+			if (nodes_empty(nodes))
+				goto out;
 		}
 		break;
 	case MPOL_INTERLEAVE:
path: mm/mempolicy.c
Vulnerability: An issue was discovered in the Linux kernel before 5.6.1. drivers/media/usb/gspca/ov519.c allows NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs when there are zero endpoints, aka CID-998912346c0d.
Vulnerability ID: CVE-2020-11608
CWE: CWE-476
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2020-04-07
File: drivers/media/usb/gspca/ov519.c
Commit message: media: ov519: add missing endpoint sanity checks

Make sure to check that we have at least one endpoint before accessing
the endpoint array to avoid dereferencing a NULL-pointer on stream
start.

Note that these sanity checks are not redundant as the driver is mixing
looking up altsettings by index and by number, which need not coincide.

Fixes: 1876bb923c98 ("V4L/DVB (12079): gspca_ov519: add support for the ov511 bridge")
Fixes: b282d87332f5 ("V4L/DVB (12080): gspca_ov519: Fix ov518+ with OV7620AE (Trust spacecam 320)")
Cc: stable <stable@vger.kernel.org>     # 2.6.31
Cc: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Commit author: Johan Hovold

Vulnerable version (before fix):
 static void ov511_mode_init_regs(struct sd *sd) 		return; 	}  	packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); 	reg_w(sd, R51x_FIFO_PSIZE, packet_size >> 5);  static void ov518_mode_init_regs(struct sd *sd) 		return; 	}  	packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); 	ov518_reg_w32(sd, R51x_FIFO_PSIZE, packet_size & ~7, 2); 

Fixed version (after fix):
 static void ov511_mode_init_regs(struct sd *sd) 		return; 	}  	if (alt->desc.bNumEndpoints < 1) { 		sd->gspca_dev.usb_err = -ENODEV; 		return; 	}  	packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); 	reg_w(sd, R51x_FIFO_PSIZE, packet_size >> 5);  static void ov518_mode_init_regs(struct sd *sd) 		return; 	}  	if (alt->desc.bNumEndpoints < 1) { 		sd->gspca_dev.usb_err = -ENODEV; 		return; 	}  	packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); 	ov518_reg_w32(sd, R51x_FIFO_PSIZE, packet_size & ~7, 2); 

Patch:
patch: @@ -3477,6 +3477,11 @@ static void ov511_mode_init_regs(struct sd *sd)
 		return;
 	}
 
+	if (alt->desc.bNumEndpoints < 1) {
+		sd->gspca_dev.usb_err = -ENODEV;
+		return;
+	}
+
 	packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
 	reg_w(sd, R51x_FIFO_PSIZE, packet_size >> 5);
 
@@ -3603,6 +3608,11 @@ static void ov518_mode_init_regs(struct sd *sd)
 		return;
 	}
 
+	if (alt->desc.bNumEndpoints < 1) {
+		sd->gspca_dev.usb_err = -ENODEV;
+		return;
+	}
+
 	packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
 	ov518_reg_w32(sd, R51x_FIFO_PSIZE, packet_size & ~7, 2);
path: drivers/media/usb/gspca/ov519.c