rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Buffer overflow in the ppp_hdlc function in print-ppp.c in tcpdump 4.6.2 and earlier allows remote attackers to cause a denial of service (crash) cia a crafted PPP packet.
Vulnerability ID: CVE-2014-9140
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/the-tcpdump-group/tcpdump
Published: 2014-12-05
File: print-ppp.c
Commit message: Do bounds checking when unescaping PPP.

Clean up a const issue while we're at it.
Commit author: Guy Harris

Vulnerable version (before fix):
 static void ppp_hdlc(netdissect_options *ndo,          const u_char *p, int length) { 	u_char *b, *s, *t, c; 	int i, proto; 	const void *se;          if (length <= 0)                 return;  	b = (uint8_t *)malloc(length); 	if (b == NULL) 		return;  ppp_hdlc(netdissect_options *ndo, 	 * Do this so that we dont overwrite the original packet 	 * contents. 	 */ 	for (s = (u_char *)p, t = b, i = length; i > 0; i--) { 		c = *s++; 		if (c == 0x7d) { 			if (i > 1) { 				i--; 				c = *s++ ^ 0x20; 			} else 				continue; 		} 		*t++ = c; 	}

Fixed version (after fix):
 static void ppp_hdlc(netdissect_options *ndo,          const u_char *p, int length) { 	u_char *b, *t, c; 	const u_char *s; 	int i, proto; 	const void *se;          if (length <= 0)                 return;  	b = (u_char *)malloc(length); 	if (b == NULL) 		return;  ppp_hdlc(netdissect_options *ndo, 	 * Do this so that we dont overwrite the original packet 	 * contents. 	 */ 	for (s = p, t = b, i = length; i > 0 && ND_TTEST(*s); i--) { 		c = *s++; 		if (c == 0x7d) { 			if (i <= 1 || !ND_TTEST(*s)) 				break; 			i--; 			c = *s++ ^ 0x20; 		} 		*t++ = c; 	}

Patch:
patch: @@ -1351,14 +1351,15 @@ static void
 ppp_hdlc(netdissect_options *ndo,
          const u_char *p, int length)
 {
-	u_char *b, *s, *t, c;
+	u_char *b, *t, c;
+	const u_char *s;
 	int i, proto;
 	const void *se;
 
         if (length <= 0)
                 return;
 
-	b = (uint8_t *)malloc(length);
+	b = (u_char *)malloc(length);
 	if (b == NULL)
 		return;
 
@@ -1367,14 +1368,13 @@ ppp_hdlc(netdissect_options *ndo,
 	 * Do this so that we dont overwrite the original packet
 	 * contents.
 	 */
-	for (s = (u_char *)p, t = b, i = length; i > 0; i--) {
+	for (s = p, t = b, i = length; i > 0 && ND_TTEST(*s); i--) {
 		c = *s++;
 		if (c == 0x7d) {
-			if (i > 1) {
-				i--;
-				c = *s++ ^ 0x20;
-			} else
-				continue;
+			if (i <= 1 || !ND_TTEST(*s))
+				break;
+			i--;
+			c = *s++ ^ 0x20;
 		}
 		*t++ = c;
 	}
path: print-ppp.c
Vulnerability: Cross-site scripting (XSS) vulnerability in the projax_array_serialize_for_autocomplete function in core/projax_api.php in MantisBT 1.1.0a3 through 1.2.17 allows remote attackers to inject arbitrary web script or HTML via the "profile/Platform" field.
Vulnerability ID: CVE-2014-9270
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/mantisbt/mantisbt
Published: 2014-12-08
File: core/projax_api.php
Commit message: Fix #17583: XSS in projax_api.php

Offensive Security reported this issue via their bug bounty program [1].

The Projax library does not properly escape html strings.  An attacker
could take advantage of this to perform an XSS attack using the
profile/Platform field.

[1] http://www.offensive-security.com/bug-bounty-program/

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Commit author: Paul Richards

Vulnerable version (before fix):
 function projax_array_serialize_for_autocomplete( $p_array ) { 	$t_matches = '<ul>';  	foreach( $p_array as $t_entry ) { 		$t_matches .= "<li>$t_entry</li>"; 	}  	$t_matches .= '</ul>';

Fixed version (after fix):
 function projax_array_serialize_for_autocomplete( $p_array ) { 	$t_matches = '<ul>';  	foreach( $p_array as $t_entry ) { 		$t_matches .= '<li>' . string_attribute( $t_entry ) . '</li>'; 	}  	$t_matches .= '</ul>';

Patch:
patch: @@ -70,7 +70,7 @@ function projax_array_serialize_for_autocomplete( $p_array ) {
 	$t_matches = '<ul>';
 
 	foreach( $p_array as $t_entry ) {
-		$t_matches .= "<li>$t_entry</li>";
+		$t_matches .= '<li>' . string_attribute( $t_entry ) . '</li>';
 	}
 
 	$t_matches .= '</ul>';
path: core/projax_api.php
Vulnerability: The string_insert_href function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the javascript:// protocol.
Vulnerability ID: CVE-2014-9272
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/mantisbt/mantisbt
Published: 2015-01-09
File: core/string_api.php
Commit message: Fix #17297: XSS in string_insert_hrefs

The URL matching regex in the function did not validate the protocol,
allowing an attacker to use 'javascript://' to execute arbitrary code.

Issue was discovered by Mathias Karlsson (http://mathiaskarlsson.me)
and reported by Offensive Security (http://www.offensive-security.com/).
Commit author: Damien Regad

Vulnerable version (before fix):
 function string_process_bugnote_link( $p_string, $p_include_anchor = true, $p_de }  /**  * Detect URLs and email addresses in the string and replace them with href anchors  * @param string $p_string  * @return string  */ function string_insert_hrefs( $p_string ) {  	# Initialize static variables 	if ( is_null( $s_url_regex ) ) { 		# URL regex 		$t_url_protocol = '(?:[[:alpha:]][-+.[:alnum:]]*):\/\/';  		# %2A notation in url's 		$t_url_hex = '%[[:digit:]A-Fa-f]{2}';

Fixed version (after fix):
 function string_process_bugnote_link( $p_string, $p_include_anchor = true, $p_de }  /**  * Search email addresses and URLs for a few common protocols in the given  * string, and replace occurences with href anchors.  * @param string $p_string  * @return string  */ function string_insert_hrefs( $p_string ) {  	# Initialize static variables 	if ( is_null( $s_url_regex ) ) { 		# URL protocol. The regex accepts a small subset from the list of valid 		# IANA permanent and provisional schemes defined in 		# http://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml 		$t_url_protocol = '(?:https?|s?ftp|file|irc[6s]?|ssh|telnet|nntp|git|svn(?:\+ssh)?|cvs):\/\/';  		# %2A notation in url's 		$t_url_hex = '%[[:digit:]A-Fa-f]{2}';

Patch:
patch: @@ -459,7 +459,8 @@ function string_process_bugnote_link( $p_string, $p_include_anchor = true, $p_de
 }
 
 /**
- * Detect URLs and email addresses in the string and replace them with href anchors
+ * Search email addresses and URLs for a few common protocols in the given
+ * string, and replace occurences with href anchors.
  * @param string $p_string
  * @return string
  */
@@ -480,8 +481,10 @@ function string_insert_hrefs( $p_string ) {
 
 	# Initialize static variables
 	if ( is_null( $s_url_regex ) ) {
-		# URL regex
-		$t_url_protocol = '(?:[[:alpha:]][-+.[:alnum:]]*):\/\/';
+		# URL protocol. The regex accepts a small subset from the list of valid
+		# IANA permanent and provisional schemes defined in
+		# http://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml
+		$t_url_protocol = '(?:https?|s?ftp|file|irc[6s]?|ssh|telnet|nntp|git|svn(?:\+ssh)?|cvs):\/\/';
 
 		# %2A notation in url's
 		$t_url_hex = '%[[:digit:]A-Fa-f]{2}';
path: core/string_api.php
Vulnerability: The current_user_get_bug_filter function in core/current_user_api.php in MantisBT before 1.2.18 allows remote attackers to execute arbitrary PHP code via the filter parameter.
Vulnerability ID: CVE-2014-9280
CWE: CWE-94
Severity score: 6.4
Project: https://github.com/mantisbt/mantisbt
Published: 2014-12-08
File: core/current_user_api.php
Commit message: Do not pass raw user data to unserialize

Filters were moved to TOKEN api, so the code in current_user_api to handle
?filter= on URL query strings is a left over from this move and is no
longer necessary.

This issue was reported by Matthias Karlsson (http://mathiaskarlsson.me)
as part of Offensive Security's bug bounty program [1].

Fixes #17875

[1] http://www.offensive-security.com/bug-bounty-program/

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Commit author: Paul Richards

Vulnerable version (before fix):
 function current_user_get_bug_filter( $p_project_id = null ) { 				$t_filter = unserialize( $t_token ); 			} 		} else { 			$t_filter = unserialize( $f_filter_string ); 		} 	} else if( !filter_is_cookie_valid() ) { 		return false;

Fixed version (after fix):
 function current_user_get_bug_filter( $p_project_id = null ) { 				$t_filter = unserialize( $t_token ); 			} 		} else { 			return false; 		} 	} else if( !filter_is_cookie_valid() ) { 		return false;

Patch:
patch: @@ -203,7 +203,7 @@ function current_user_get_bug_filter( $p_project_id = null ) {
 				$t_filter = unserialize( $t_token );
 			}
 		} else {
-			$t_filter = unserialize( $f_filter_string );
+			return false;
 		}
 	} else if( !filter_is_cookie_valid() ) {
 		return false;
path: core/current_user_api.php
Vulnerability: Cross-site scripting (XSS) vulnerability in admin/copy_field.php in MantisBT before 1.2.18 allows remote attackers to inject arbitrary web script or HTML via the dest_id field.
Vulnerability ID: CVE-2014-9281
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/mantisbt/mantisbt
Published: 2014-12-09
File: admin/copy_field.php
Commit message: Fix #17876: XSS in copy_field.php

This issue was reported by Matthias Karlsson (http://mathiaskarlsson.me)
as part of Offensive Security's bug bounty program [1].

[1] http://www.offensive-security.com/bug-bounty-program/

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Commit author: Paul Richards

Vulnerable version (before fix):
  $f_source_field_id = gpc_get_int( 'source_id' ); $f_dest_field = gpc_get( 'dest_id' ); ?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <br /><br />  <?php # checks on validity $t_valid_fields = array( 	'fixed_in_version', ); if( !in_array( $f_dest_field, $t_valid_fields ) ) { 	echo '<p>Invalid destination field (' . $f_dest_field . ') specified.</p>'; 	echo '</body></html>'; 	exit; }  # @@@ check that source and destination are compatible 

Fixed version (after fix):
  $f_source_field_id = gpc_get_int( 'source_id' ); $f_dest_field = gpc_get( 'dest_id' );  # checks on validity $t_valid_fields = array( 	'fixed_in_version', ); if( !in_array( $f_dest_field, $t_valid_fields ) ) { 	echo '<html><body>'; 	echo '<p>Invalid destination field (' . string_attribute($f_dest_field) . ') specified.</p>'; 	echo '</body></html>'; 	exit; }  ?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <br /><br />  <?php  # @@@ check that source and destination are compatible 

Patch:
patch: @@ -30,6 +30,18 @@
 
 $f_source_field_id = gpc_get_int( 'source_id' );
 $f_dest_field = gpc_get( 'dest_id' );
+
+# checks on validity
+$t_valid_fields = array(
+	'fixed_in_version',
+);
+if( !in_array( $f_dest_field, $t_valid_fields ) ) {
+	echo '<html><body>';
+	echo '<p>Invalid destination field (' . string_attribute($f_dest_field) . ') specified.</p>';
+	echo '</body></html>';
+	exit;
+}
+
 ?>
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
 <html>
@@ -53,15 +65,6 @@
 <br /><br />
 
 <?php
-# checks on validity
-$t_valid_fields = array(
-	'fixed_in_version',
-);
-if( !in_array( $f_dest_field, $t_valid_fields ) ) {
-	echo '<p>Invalid destination field (' . $f_dest_field . ') specified.</p>';
-	echo '</body></html>';
-	exit;
-}
 
 # @@@ check that source and destination are compatible
path: admin/copy_field.php
Vulnerability: engine/server/server.cpp in Teeworlds 0.6.x before 0.6.3 allows remote attackers to read memory and cause a denial of service (crash) via unspecified vectors.
Vulnerability ID: CVE-2014-9351
CWE: CWE-20
Severity score: 4.9
Project: https://github.com/teeworlds/teeworlds
Published: 2014-12-09
File: src/engine/server/server.cpp
Commit message: fixed a server crash
Commit author: oy

Vulnerable version (before fix):
 void CServer::ProcessClientPacket(CNetChunk *pPacket) 				return;  			int Chunk = Unpacker.GetInt(); 			int ChunkSize = 1024-128; 			int Offset = Chunk * ChunkSize; 			int Last = 0;  			// drop faulty map data requests

Fixed version (after fix):
 void CServer::ProcessClientPacket(CNetChunk *pPacket) 				return;  			int Chunk = Unpacker.GetInt(); 			unsigned int ChunkSize = 1024-128; 			unsigned int Offset = Chunk * ChunkSize; 			int Last = 0;  			// drop faulty map data requests

Patch:
patch: @@ -845,8 +845,8 @@ void CServer::ProcessClientPacket(CNetChunk *pPacket)
 				return;
 
 			int Chunk = Unpacker.GetInt();
-			int ChunkSize = 1024-128;
-			int Offset = Chunk * ChunkSize;
+			unsigned int ChunkSize = 1024-128;
+			unsigned int Offset = Chunk * ChunkSize;
 			int Last = 0;
 
 			// drop faulty map data requests
path: src/engine/server/server.cpp
Vulnerability: The rock_continue function in fs/isofs/rock.c in the Linux kernel through 3.18.1 does not restrict the number of Rock Ridge continuation entries, which allows local users to cause a denial of service (infinite loop, and system crash or hang) via a crafted iso9660 image.
Vulnerability ID: CVE-2014-9420
CWE: CWE-399
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2014-12-26
File: fs/isofs/rock.c
Commit message: isofs: Fix infinite looping over CE entries

Rock Ridge extensions define so called Continuation Entries (CE) which
define where is further space with Rock Ridge data. Corrupted isofs
image can contain arbitrarily long chain of these, including a one
containing loop and thus causing kernel to end in an infinite loop when
traversing these entries.

Limit the traversal to 32 entries which should be more than enough space
to store all the Rock Ridge data.

Reported-by: P J P <ppandit@redhat.com>
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Commit author: Jan Kara

Vulnerable version (before fix):
 struct rock_state { 	int cont_size; 	int cont_extent; 	int cont_offset; 	struct inode *inode; };  static void init_rock_state(struct rock_state *rs, struct inode *inode) 	rs->inode = inode; }  /*  * Returns 0 if the caller should continue scanning, 1 if the scan must end  * and -ve on error. static int rock_continue(struct rock_state *rs) 			goto out; 		} 		ret = -EIO; 		bh = sb_bread(rs->inode->i_sb, rs->cont_extent); 		if (bh) { 			memcpy(rs->buffer, bh->b_data + rs->cont_offset,

Fixed version (after fix):
 struct rock_state { 	int cont_size; 	int cont_extent; 	int cont_offset; 	int cont_loops; 	struct inode *inode; };  static void init_rock_state(struct rock_state *rs, struct inode *inode) 	rs->inode = inode; }  /* Maximum number of Rock Ridge continuation entries */ #define RR_MAX_CE_ENTRIES 32  /*  * Returns 0 if the caller should continue scanning, 1 if the scan must end  * and -ve on error. static int rock_continue(struct rock_state *rs) 			goto out; 		} 		ret = -EIO; 		if (++rs->cont_loops >= RR_MAX_CE_ENTRIES) 			goto out; 		bh = sb_bread(rs->inode->i_sb, rs->cont_extent); 		if (bh) { 			memcpy(rs->buffer, bh->b_data + rs->cont_offset,

Patch:
patch: @@ -30,6 +30,7 @@ struct rock_state {
 	int cont_size;
 	int cont_extent;
 	int cont_offset;
+	int cont_loops;
 	struct inode *inode;
 };
 
@@ -73,6 +74,9 @@ static void init_rock_state(struct rock_state *rs, struct inode *inode)
 	rs->inode = inode;
 }
 
+/* Maximum number of Rock Ridge continuation entries */
+#define RR_MAX_CE_ENTRIES 32
+
 /*
  * Returns 0 if the caller should continue scanning, 1 if the scan must end
  * and -ve on error.
@@ -105,6 +109,8 @@ static int rock_continue(struct rock_state *rs)
 			goto out;
 		}
 		ret = -EIO;
+		if (++rs->cont_loops >= RR_MAX_CE_ENTRIES)
+			goto out;
 		bh = sb_bread(rs->inode->i_sb, rs->cont_extent);
 		if (bh) {
 			memcpy(rs->buffer, bh->b_data + rs->cont_offset,
path: fs/isofs/rock.c
Vulnerability: Cross-site scripting (XSS) vulnerability in the loadForm function in Frontend/Modules/Search/Actions/Index.php in Fork CMS before 3.8.4 allows remote attackers to inject arbitrary web script or HTML via the q_widget parameter to en/search.
Vulnerability ID: CVE-2014-9470
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/forkcms/forkcms
Published: 2020-02-08
File: src/Frontend/Modules/Search/Actions/Index.php
Commit message: Don't directly inject $_GET parameters in html.

The Search module created a canonical tag containing a directly injected
$_GET parameter. This commit makes sure we encode specialcharacters
making XSS impossible. Fixes #1018
Commit author: woutersioen

Vulnerable version (before fix):
 private function loadForm()         // since we know the term just here we should set the canonical url here         $canonicalUrl = SITE_URL . FrontendNavigation::getURLForBlock('Search');         if (isset($_GET['q']) && $_GET['q'] != '') {             $canonicalUrl .= '?q=' . $_GET['q'];         }         $this->header->setCanonicalUrl($canonicalUrl);     }

Fixed version (after fix):
 private function loadForm()         // since we know the term just here we should set the canonical url here         $canonicalUrl = SITE_URL . FrontendNavigation::getURLForBlock('Search');         if (isset($_GET['q']) && $_GET['q'] != '') {             $canonicalUrl .= '?q=' . \SpoonFilter::htmlspecialchars($_GET['q']);         }         $this->header->setCanonicalUrl($canonicalUrl);     }

Patch:
patch: @@ -246,7 +246,7 @@ private function loadForm()
         // since we know the term just here we should set the canonical url here
         $canonicalUrl = SITE_URL . FrontendNavigation::getURLForBlock('Search');
         if (isset($_GET['q']) && $_GET['q'] != '') {
-            $canonicalUrl .= '?q=' . $_GET['q'];
+            $canonicalUrl .= '?q=' . \SpoonFilter::htmlspecialchars($_GET['q']);
         }
         $this->header->setCanonicalUrl($canonicalUrl);
     }
path: src/Frontend/Modules/Search/Actions/Index.php
Vulnerability: Race condition in the key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 3.18.2 allows local users to cause a denial of service (memory corruption or panic) or possibly have unspecified other impact via keyctl commands that trigger access to a key structure member during garbage collection of a key.
Vulnerability ID: CVE-2014-9529
CWE: CWE-362
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2015-01-09
File: security/keys/gc.c
Commit message: KEYS: close race between key lookup and freeing

When a key is being garbage collected, it's key->user would get put before
the ->destroy() callback is called, where the key is removed from it's
respective tracking structures.

This leaves a key hanging in a semi-invalid state which leaves a window open
for a different task to try an access key->user. An example is
find_keyring_by_name() which would dereference key->user for a key that is
in the process of being garbage collected (where key->user was freed but
->destroy() wasn't called yet - so it's still present in the linked list).

This would cause either a panic, or corrupt memory.

Fixes CVE-2014-9529.

Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Commit author: Sasha Levin

Vulnerable version (before fix):
 static noinline void key_gc_unused_keys(struct list_head *keys) 		if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) 			atomic_dec(&key->user->nikeys);  		key_user_put(key->user);  		/* now throw away the key memory */ 		if (key->type->destroy) 			key->type->destroy(key);  		kfree(key->description);  #ifdef KEY_DEBUGGING

Fixed version (after fix):
 static noinline void key_gc_unused_keys(struct list_head *keys) 		if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) 			atomic_dec(&key->user->nikeys);  		/* now throw away the key memory */ 		if (key->type->destroy) 			key->type->destroy(key);  		key_user_put(key->user);  		kfree(key->description);  #ifdef KEY_DEBUGGING

Patch:
patch: @@ -148,12 +148,12 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
 		if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
 			atomic_dec(&key->user->nikeys);
 
-		key_user_put(key->user);
-
 		/* now throw away the key memory */
 		if (key->type->destroy)
 			key->type->destroy(key);
 
+		key_user_put(key->user);
+
 		kfree(key->description);
 
 #ifdef KEY_DEBUGGING
path: security/keys/gc.c
Vulnerability: The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 does not validate a length value in the Extensions Reference (ER) System Use Field, which allows local users to obtain sensitive information from kernel memory via a crafted iso9660 image.
Vulnerability ID: CVE-2014-9584
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2015-01-09
File: fs/isofs/rock.c
Commit message: isofs: Fix unchecked printing of ER records

We didn't check length of rock ridge ER records before printing them.
Thus corrupted isofs image can cause us to access and print some memory
behind the buffer with obvious consequences.

Reported-and-tested-by: Carl Henrik Lunde <chlunde@ping.uio.no>
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Commit author: Jan Kara

Vulnerable version (before fix):
 parse_rock_ridge_inode_internal(struct iso_directory_record *de, 			rs.cont_size = isonum_733(rr->u.CE.size); 			break; 		case SIG('E', 'R'): 			ISOFS_SB(inode->i_sb)->s_rock = 1; 			printk(KERN_DEBUG "ISO 9660 Extensions: "); 			{

Fixed version (after fix):
 parse_rock_ridge_inode_internal(struct iso_directory_record *de, 			rs.cont_size = isonum_733(rr->u.CE.size); 			break; 		case SIG('E', 'R'): 			/* Invalid length of ER tag id? */ 			if (rr->u.ER.len_id + offsetof(struct rock_ridge, u.ER.data) > rr->len) 				goto out; 			ISOFS_SB(inode->i_sb)->s_rock = 1; 			printk(KERN_DEBUG "ISO 9660 Extensions: "); 			{

Patch:
patch: @@ -362,6 +362,9 @@ parse_rock_ridge_inode_internal(struct iso_directory_record *de,
 			rs.cont_size = isonum_733(rr->u.CE.size);
 			break;
 		case SIG('E', 'R'):
+			/* Invalid length of ER tag id? */
+			if (rr->u.ER.len_id + offsetof(struct rock_ridge, u.ER.data) > rr->len)
+				goto out;
 			ISOFS_SB(inode->i_sb)->s_rock = 1;
 			printk(KERN_DEBUG "ISO 9660 Extensions: ");
 			{
path: fs/isofs/rock.c
Vulnerability: The GetUpdateFile function in misc/update.c in the Updater in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation from a 64-bit integer to a 32-bit integer, which allows remote attackers to conduct buffer overflow attacks and execute arbitrary code via a crafted update status file, aka an "integer truncation" vulnerability.
Vulnerability ID: CVE-2014-9625
CWE: CWE-120
Severity score: 6.4
Project: https://github.com/videolan/vlc
Published: 2020-01-24
File: src/misc/update.c
Commit message: misc: update: fix buffer overflow in updater

On 32 bit builds, parsing of update status files with a size of
4294967295 or more lead to an integer truncation in a call to malloc
and a subsequent buffer overflow. This happened prior to checking the
files' signature. The commit fixes this by disallowing overly large
status files (above 65k in practice)

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
Commit author: Fabian Yamaguchi

Vulnerable version (before fix):
 static bool GetUpdateFile( update_t *p_update )     }      const int64_t i_read = stream_Size( p_stream );     psz_update_data = malloc( i_read + 1 ); /* terminating '\0' */     if( !psz_update_data )         goto error;

Fixed version (after fix):
 static bool GetUpdateFile( update_t *p_update )     }      const int64_t i_read = stream_Size( p_stream );      if( i_read < 0 || i_read >= UINT16_MAX)     {         msg_Err(p_update->p_libvlc, "Status file too large");         goto error;     }      psz_update_data = malloc( i_read + 1 ); /* terminating '\0' */     if( !psz_update_data )         goto error;

Patch:
patch: @@ -193,6 +193,13 @@ static bool GetUpdateFile( update_t *p_update )
     }
 
     const int64_t i_read = stream_Size( p_stream );
+
+    if( i_read < 0 || i_read >= UINT16_MAX)
+    {
+        msg_Err(p_update->p_libvlc, "Status file too large");
+        goto error;
+    }
+
     psz_update_data = malloc( i_read + 1 ); /* terminating '\0' */
     if( !psz_update_data )
         goto error;
path: src/misc/update.c