rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data.
Vulnerability ID: CVE-2014-8176
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/openssl/openssl
Published: 2015-06-12
File: ssl/d1_lib.c
Commit message: Free up s->d1->buffered_app_data.q properly.

PR#3286
Commit author: zhu qun-ying

Vulnerable version (before fix):
 static void dtls1_clear_queues(SSL *s)  	while ( (item = pqueue_pop(s->d1->buffered_app_data.q)) != NULL) 		{ 		frag = (hm_fragment *)item->data; 		OPENSSL_free(frag->fragment); 		OPENSSL_free(frag); 		pitem_free(item); 		} 	}

Fixed version (after fix):
 static void dtls1_clear_queues(SSL *s)  	while ( (item = pqueue_pop(s->d1->buffered_app_data.q)) != NULL) 		{ 		rdata = (DTLS1_RECORD_DATA *) item->data; 		if (rdata->rbuf.buf) 			{ 			OPENSSL_free(rdata->rbuf.buf); 			} 		OPENSSL_free(item->data); 		pitem_free(item); 		} 	}

Patch:
patch: @@ -202,9 +202,12 @@ static void dtls1_clear_queues(SSL *s)
 
 	while ( (item = pqueue_pop(s->d1->buffered_app_data.q)) != NULL)
 		{
-		frag = (hm_fragment *)item->data;
-		OPENSSL_free(frag->fragment);
-		OPENSSL_free(frag);
+		rdata = (DTLS1_RECORD_DATA *) item->data;
+		if (rdata->rbuf.buf)
+			{
+			OPENSSL_free(rdata->rbuf.buf);
+			}
+		OPENSSL_free(item->data);
 		pitem_free(item);
 		}
 	}
path: ssl/d1_lib.c
Vulnerability: Stack-based buffer overflow in the gps_tracker function in airodump-ng.c in Aircrack-ng before 1.2 RC 1 allows local users to execute arbitrary code or gain privileges via unspecified vectors.
Vulnerability ID: CVE-2014-8321
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/aircrack-ng/aircrack-ng
Published: 2020-01-31
File: src/airodump-ng.c
Commit message: Airodump-ng: Fixed GPS stack overflow (Closes #13 on GitHub).

git-svn-id: http://svn.aircrack-ng.org/trunk@2416 28c6078b-6c39-48e3-add9-af49d547ecab
Commit author: Thomas d'Otreppe

Vulnerable version (before fix):
 void gps_tracker( void )         	}          	// New version, JSON         	if( recv( gpsd_sock, line + pos, sizeof( line ) - 1, 0 ) <= 0 )         		return;          	// search for TPV class: {"class":"TPV"

Fixed version (after fix):
 void gps_tracker( void )         	}          	// New version, JSON         	if( recv( gpsd_sock, line + pos, sizeof( line ) - pos - 1, 0 ) <= 0 )         		return;          	// search for TPV class: {"class":"TPV"

Patch:
patch: @@ -4497,7 +4497,7 @@ void gps_tracker( void )
         	}
 
         	// New version, JSON
-        	if( recv( gpsd_sock, line + pos, sizeof( line ) - 1, 0 ) <= 0 )
+        	if( recv( gpsd_sock, line + pos, sizeof( line ) - pos - 1, 0 ) <= 0 )
         		return;
 
         	// search for TPV class: {"class":"TPV"
path: src/airodump-ng.c
Vulnerability: Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attackers to execute arbitrary code via a crafted length parameter value.
Vulnerability ID: CVE-2014-8322
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/aircrack-ng/aircrack-ng
Published: 2020-01-31
File: src/aireplay-ng.c
Commit message: Aireplay-ng: Fixed tcp_test stack overflow (Closes #14 on GitHub).

git-svn-id: http://svn.aircrack-ng.org/trunk@2417 28c6078b-6c39-48e3-add9-af49d547ecab
Commit author: Thomas d'Otreppe

Vulnerable version (before fix):
 int tcp_test(const char* ip_str, const short port)         if( (unsigned)caplen == sizeof(nh))         {             len = ntohl(nh.nh_len);             if( nh.nh_type == 1 && i==0 )             {                 i=1;

Fixed version (after fix):
 int tcp_test(const char* ip_str, const short port)         if( (unsigned)caplen == sizeof(nh))         {             len = ntohl(nh.nh_len);             if (len > 1024 || len < 0)                 continue;             if( nh.nh_type == 1 && i==0 )             {                 i=1;

Patch:
patch: @@ -5398,6 +5398,8 @@ int tcp_test(const char* ip_str, const short port)
         if( (unsigned)caplen == sizeof(nh))
         {
             len = ntohl(nh.nh_len);
+            if (len > 1024 || len < 0)
+                continue;
             if( nh.nh_type == 1 && i==0 )
             {
                 i=1;
path: src/aireplay-ng.c
Vulnerability: buddy-ng.c in Aircrack-ng before 1.2 Beta 3 allows remote attackers to cause a denial of service (segmentation fault) via a response with a crafted length parameter.
Vulnerability ID: CVE-2014-8323
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/aircrack-ng/aircrack-ng
Published: 2017-10-17
File: src/buddy-ng.c
Commit message: Buddy-ng: Fixed segmentation fault (Closes #15 on GitHub).

git-svn-id: http://svn.aircrack-ng.org/trunk@2418 28c6078b-6c39-48e3-add9-af49d547ecab
Commit author: Thomas d'Otreppe

Vulnerable version (before fix):
 int handle(int s, unsigned char* data, int len, struct sockaddr_in *s_in) 	*cmd++ = htons(S_CMD_PACKET); 	*cmd++ = *pid; 	plen = len - 2;  	last_id = ntohs(*pid); 	if (last_id > 20000)

Fixed version (after fix):
 int handle(int s, unsigned char* data, int len, struct sockaddr_in *s_in) 	*cmd++ = htons(S_CMD_PACKET); 	*cmd++ = *pid; 	plen = len - 2;     if (plen < 0)         return 0;  	last_id = ntohs(*pid); 	if (last_id > 20000)

Patch:
patch: @@ -83,6 +83,8 @@ int handle(int s, unsigned char* data, int len, struct sockaddr_in *s_in)
 	*cmd++ = htons(S_CMD_PACKET);
 	*cmd++ = *pid;
 	plen = len - 2;
+    if (plen < 0)
+        return 0;
 
 	last_id = ntohs(*pid);
 	if (last_id > 20000)
path: src/buddy-ng.c
Vulnerability: network.c in Aircrack-ng before 1.2 Beta 3 allows remote attackers to cause a denial of service (segmentation fault) via a response with a crafted length parameter.
Vulnerability ID: CVE-2014-8324
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/aircrack-ng/aircrack-ng
Published: 2017-10-17
File: src/osdep/network.c
Commit message: OSdep: Fixed segmentation fault that happens with a malicious server sending a negative length (Closes #16 on GitHub).

git-svn-id: http://svn.aircrack-ng.org/trunk@2419 28c6078b-6c39-48e3-add9-af49d547ecab
Commit author: Thomas d'Otreppe

Vulnerable version (before fix):
 int net_get(int s, void *arg, int *len) 	if (!(plen <= *len)) 		printf("PLEN %d type %d len %d\n", 			plen, nh.nh_type, *len); 	assert(plen <= *len); /* XXX */  	*len = plen; 	if ((*len) && (net_read_exact(s, arg, *len) == -1))

Fixed version (after fix):
 int net_get(int s, void *arg, int *len) 	if (!(plen <= *len)) 		printf("PLEN %d type %d len %d\n", 			plen, nh.nh_type, *len); 	assert(plen <= *len && plen > 0); /* XXX */  	*len = plen; 	if ((*len) && (net_read_exact(s, arg, *len) == -1))

Patch:
patch: @@ -131,7 +131,7 @@ int net_get(int s, void *arg, int *len)
 	if (!(plen <= *len))
 		printf("PLEN %d type %d len %d\n",
 			plen, nh.nh_type, *len);
-	assert(plen <= *len); /* XXX */
+	assert(plen <= *len && plen > 0); /* XXX */
 
 	*len = plen;
 	if ((*len) && (net_read_exact(s, arg, *len) == -1))
path: src/osdep/network.c
Vulnerability: The instruction decoder in arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel before 3.18-rc2 does not properly handle invalid instructions, which allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via a crafted application that triggers (1) an improperly fetched instruction or (2) an instruction that occupies too many bytes.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8480.
Vulnerability ID: CVE-2014-8481
CWE: CWE-399
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2014-11-10
File: arch/x86/kvm/emulate.c
Commit message: KVM: emulate: avoid accessing NULL ctxt->memopp

A failure to decode the instruction can cause a NULL pointer access.
This is fixed simply by moving the "done" label as close as possible
to the return.

This fixes CVE-2014-8481.

Reported-by: Andy Lutomirski <luto@amacapital.net>
Cc: stable@vger.kernel.org
Fixes: 41061cdb98a0bec464278b4db8e894a3121671f5
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Commit author: Paolo Bonzini

Vulnerable version (before fix):
 int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len) 	/* Decode and fetch the destination operand: register or memory. */ 	rc = decode_operand(ctxt, &ctxt->dst, (ctxt->d >> DstShift) & OpMask);  done: 	if (ctxt->rip_relative) 		ctxt->memopp->addr.mem.ea += ctxt->_eip;  	return (rc != X86EMUL_CONTINUE) ? EMULATION_FAILED : EMULATION_OK; } 

Fixed version (after fix):
 int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len) 	/* Decode and fetch the destination operand: register or memory. */ 	rc = decode_operand(ctxt, &ctxt->dst, (ctxt->d >> DstShift) & OpMask);  	if (ctxt->rip_relative) 		ctxt->memopp->addr.mem.ea += ctxt->_eip;  done: 	return (rc != X86EMUL_CONTINUE) ? EMULATION_FAILED : EMULATION_OK; } 

Patch:
patch: @@ -4580,10 +4580,10 @@ int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len)
 	/* Decode and fetch the destination operand: register or memory. */
 	rc = decode_operand(ctxt, &ctxt->dst, (ctxt->d >> DstShift) & OpMask);
 
-done:
 	if (ctxt->rip_relative)
 		ctxt->memopp->addr.mem.ea += ctxt->_eip;
 
+done:
 	return (rc != X86EMUL_CONTINUE) ? EMULATION_FAILED : EMULATION_OK;
 }
path: arch/x86/kvm/emulate.c
Vulnerability: The blowfishECB function in core/cipher.cpp in Quassel IRC 0.10.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a malformed string.
Vulnerability ID: CVE-2014-8483
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/quassel/quassel
Published: 2014-11-06
File: src/core/cipher.cpp
Commit message: Check for invalid input in encrypted buffers

The ECB Blowfish decryption function assumed that encrypted input would
always come in blocks of 12 characters, as specified. However, buggy
clients or annoying people may not adhere to that assumption, causing
the core to crash while trying to process the invalid base64 input.

With this commit we make sure that we're not overstepping the bounds of
the input string while decoding it; instead we bail out early and display
the original input. Fixes #1314.

Thanks to Tucos for finding that one!
Commit author: Manuel Nickschas

Vulnerable version (before fix):
 QByteArray Cipher::blowfishECB(QByteArray cipherText, bool direction)     }     else     {         temp = b64ToByte(temp);         while ((temp.length() % 8) != 0) temp.append('\0');     } QByteArray Cipher::blowfishECB(QByteArray cipherText, bool direction)     if (!cipher.ok())         return cipherText;      if (direction)         temp2 = byteToB64(temp2);      return temp2; }

Fixed version (after fix):
 QByteArray Cipher::blowfishECB(QByteArray cipherText, bool direction)     }     else     {         // ECB Blowfish encodes in blocks of 12 chars, so anything else is malformed input         if ((temp.length() % 12) != 0)             return cipherText;          temp = b64ToByte(temp);         while ((temp.length() % 8) != 0) temp.append('\0');     } QByteArray Cipher::blowfishECB(QByteArray cipherText, bool direction)     if (!cipher.ok())         return cipherText;      if (direction) {         // Sanity check         if ((temp2.length() % 8) != 0)             return cipherText;          temp2 = byteToB64(temp2);     }      return temp2; }

Patch:
patch: @@ -364,6 +364,10 @@ QByteArray Cipher::blowfishECB(QByteArray cipherText, bool direction)
     }
     else
     {
+        // ECB Blowfish encodes in blocks of 12 chars, so anything else is malformed input
+        if ((temp.length() % 12) != 0)
+            return cipherText;
+
         temp = b64ToByte(temp);
         while ((temp.length() % 8) != 0) temp.append('\0');
     }
@@ -376,8 +380,13 @@ QByteArray Cipher::blowfishECB(QByteArray cipherText, bool direction)
     if (!cipher.ok())
         return cipherText;
 
-    if (direction)
+    if (direction) {
+        // Sanity check
+        if ((temp2.length() % 8) != 0)
+            return cipherText;
+
         temp2 = byteToB64(temp2);
+    }
 
     return temp2;
 }
path: src/core/cipher.cpp
Vulnerability: The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel before 3.13.5 does not properly maintain a certain tail pointer, which allows remote attackers to obtain sensitive cleartext information by reading packets.
Vulnerability ID: CVE-2014-8709
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2014-11-10
File: net/mac80211/tx.c
Commit message: mac80211: fix fragmentation code, particularly for encryption

The "new" fragmentation code (since my rewrite almost 5 years ago)
erroneously sets skb->len rather than using skb_trim() to adjust
the length of the first fragment after copying out all the others.
This leaves the skb tail pointer pointing to after where the data
originally ended, and thus causes the encryption MIC to be written
at that point, rather than where it belongs: immediately after the
data.

The impact of this is that if software encryption is done, then
 a) encryption doesn't work for the first fragment, the connection
    becomes unusable as the first fragment will never be properly
    verified at the receiver, the MIC is practically guaranteed to
    be wrong
 b) we leak up to 8 bytes of plaintext (!) of the packet out into
    the air

This is only mitigated by the fact that many devices are capable
of doing encryption in hardware, in which case this can't happen
as the tail pointer is irrelevant in that case. Additionally,
fragmentation is not used very frequently and would normally have
to be configured manually.

Fix this by using skb_trim() properly.

Cc: stable@vger.kernel.org
Fixes: 2de8e0d999b8 ("mac80211: rewrite fragmentation")
Reported-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Commit author: Johannes Berg

Vulnerable version (before fix):
 static int ieee80211_fragment(struct ieee80211_tx_data *tx, 	}  	/* adjust first fragment's length */ 	skb->len = hdrlen + per_fragm; 	return 0; } 

Fixed version (after fix):
 static int ieee80211_fragment(struct ieee80211_tx_data *tx, 	}  	/* adjust first fragment's length */ 	skb_trim(skb, hdrlen + per_fragm); 	return 0; } 

Patch:
patch: @@ -878,7 +878,7 @@ static int ieee80211_fragment(struct ieee80211_tx_data *tx,
 	}
 
 	/* adjust first fragment's length */
-	skb->len = hdrlen + per_fragm;
+	skb_trim(skb, hdrlen + per_fragm);
 	return 0;
 }
path: net/mac80211/tx.c
Vulnerability: Stack-based buffer overflow in the ttusbdecfe_dvbs_diseqc_send_master_cmd function in drivers/media/usb/ttusb-dec/ttusbdecfe.c in the Linux kernel before 3.17.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via a large message length in an ioctl call.
Vulnerability ID: CVE-2014-8884
CWE: CWE-119
Severity score: 8.5
Project: https://github.com/torvalds/linux
Published: 2014-11-30
File: drivers/media/usb/ttusb-dec/ttusbdecfe.c
Commit message: [media] ttusb-dec: buffer overflow in ioctl

We need to add a limit check here so we don't overflow the buffer.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Commit author: Dan Carpenter

Vulnerable version (before fix):
 static int ttusbdecfe_dvbs_diseqc_send_master_cmd(struct dvb_frontend* fe, struc 		   0x00, 0x00, 0x00, 0x00, 		   0x00, 0x00 };  	memcpy(&b[4], cmd->msg, cmd->msg_len);  	state->config->send_command(fe, 0x72,

Fixed version (after fix):
 static int ttusbdecfe_dvbs_diseqc_send_master_cmd(struct dvb_frontend* fe, struc 		   0x00, 0x00, 0x00, 0x00, 		   0x00, 0x00 };  	if (cmd->msg_len > sizeof(b) - 4) 		return -EINVAL;  	memcpy(&b[4], cmd->msg, cmd->msg_len);  	state->config->send_command(fe, 0x72,

Patch:
patch: @@ -156,6 +156,9 @@ static int ttusbdecfe_dvbs_diseqc_send_master_cmd(struct dvb_frontend* fe, struc
 		   0x00, 0x00, 0x00, 0x00,
 		   0x00, 0x00 };
 
+	if (cmd->msg_len > sizeof(b) - 4)
+		return -EINVAL;
+
 	memcpy(&b[4], cmd->msg, cmd->msg_len);
 
 	state->config->send_command(fe, 0x72,
path: drivers/media/usb/ttusb-dec/ttusbdecfe.c
Vulnerability: Cross-site scripting (XSS) vulnerability in the "set configuration" box in the Configuration Report page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.17 allows remote administrators to inject arbitrary web script or HTML via the config_option parameter, a different vulnerability than CVE-2014-8986.
Vulnerability ID: CVE-2014-8987
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/mantisbt/mantisbt
Published: 2015-08-24
File: adm_config_report.php
Commit message: Fix #17870: XSS in adm_config_report.php

This is the correct fix for this issue, using string_attribute() to
escape the variable. Thanks to Paul Richards for pointing this out.
Commit author: Damien Regad

Vulnerable version (before fix):
 function print_option_list_from_array( $p_array, $p_filter_value ) { 	</td> 	<td> 		<input type="text" name="config_option" 			value="<?php echo $t_edit_option; ?>" 			size="64" maxlength="64" /> 	</td> </tr>

Fixed version (after fix):
 function print_option_list_from_array( $p_array, $p_filter_value ) { 	</td> 	<td> 		<input type="text" name="config_option" 			value="<?php echo string_attribute( $t_edit_option ); ?>" 			size="64" maxlength="64" /> 	</td> </tr>

Patch:
patch: @@ -480,7 +480,7 @@ function print_option_list_from_array( $p_array, $p_filter_value ) {
 	</td>
 	<td>
 		<input type="text" name="config_option"
-			value="<?php echo $t_edit_option; ?>"
+			value="<?php echo string_attribute( $t_edit_option ); ?>"
 			size="64" maxlength="64" />
 	</td>
 </tr>
path: adm_config_report.php
Vulnerability: MantisBT before 1.2.18 allows remote authenticated users to bypass the $g_download_attachments_threshold and $g_view_attachments_threshold restrictions and read attachments for private projects by leveraging access to a project that does not restrict access to attachments and a request to the download URL.
Vulnerability ID: CVE-2014-8988
CWE: CWE-264
Severity score: 2.9
Project: https://github.com/mantisbt/mantisbt
Published: 2014-11-24
File: core/file_api.php
Commit message: Incorrect access check on attachment downloads

Even if config variables $g_download_attachments_threshold and
$g_view_attachments_threshold are set to 55 (developer), users with
lower privileges can download attachments.

Fixes #17742

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Commit author: Paul Richards

Vulnerable version (before fix):
 function file_can_view_bug_attachments( $p_bug_id, $p_uploader_user_id = null ) # Check if the current user can download attachments for the specified bug. function file_can_download_bug_attachments( $p_bug_id, $p_uploader_user_id = null ) { 	$t_uploaded_by_me = auth_get_current_user_id() === $p_uploader_user_id; 	$t_can_download = access_has_bug_level( config_get( 'download_attachments_threshold' ), $p_bug_id ); 	$t_can_download = $t_can_download || ( $t_uploaded_by_me && config_get( 'allow_download_own_attachments' ) ); 	return $t_can_download; } 

Fixed version (after fix):
 function file_can_view_bug_attachments( $p_bug_id, $p_uploader_user_id = null ) # Check if the current user can download attachments for the specified bug. function file_can_download_bug_attachments( $p_bug_id, $p_uploader_user_id = null ) { 	$t_uploaded_by_me = auth_get_current_user_id() === $p_uploader_user_id; 	$t_can_download = access_has_bug_level( config_get( 'download_attachments_threshold', null, null, bug_get_field( $p_bug_id, 'project_id' ) ), $p_bug_id ); 	$t_can_download = $t_can_download || ( $t_uploaded_by_me && config_get( 'allow_download_own_attachments', null, null, bug_get_field( $p_bug_id, 'project_id' ) ) ); 	return $t_can_download; } 

Patch:
patch: @@ -120,8 +120,8 @@ function file_can_view_bug_attachments( $p_bug_id, $p_uploader_user_id = null )
 # Check if the current user can download attachments for the specified bug.
 function file_can_download_bug_attachments( $p_bug_id, $p_uploader_user_id = null ) {
 	$t_uploaded_by_me = auth_get_current_user_id() === $p_uploader_user_id;
-	$t_can_download = access_has_bug_level( config_get( 'download_attachments_threshold' ), $p_bug_id );
-	$t_can_download = $t_can_download || ( $t_uploaded_by_me && config_get( 'allow_download_own_attachments' ) );
+	$t_can_download = access_has_bug_level( config_get( 'download_attachments_threshold', null, null, bug_get_field( $p_bug_id, 'project_id' ) ), $p_bug_id );
+	$t_can_download = $t_can_download || ( $t_uploaded_by_me && config_get( 'allow_download_own_attachments', null, null, bug_get_field( $p_bug_id, 'project_id' ) ) );
 	return $t_can_download;
 }
path: core/file_api.php
Vulnerability: Multiple SQL injection vulnerabilities in view_all_bug_page.php in MantisBT before 1.2.18 allow remote attackers to execute arbitrary SQL commands via the (1) sort or (2) dir parameter to view_all_set.php.
Vulnerability ID: CVE-2014-9089
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/mantisbt/mantisbt
Published: 2014-11-28
File: core/filter_api.php
Commit message: Improve validation for filter sort and direction

Fixes #17841
Commit author: Victor Boctor

Vulnerable version (before fix):
 function filter_ensure_valid_filter( $p_filter_arr ) { 			unset( $t_fields[$i] ); 		} 	} 	$t_sort_fields = explode( ',', $p_filter_arr['sort'] ); 	$t_dir_fields = explode( ',', $p_filter_arr['dir'] ); 	for( $i = 0;$i < 2;$i++ ) { 		if( isset( $t_sort_fields[$i] ) ) { 			$t_drop = false;

Fixed version (after fix):
 function filter_ensure_valid_filter( $p_filter_arr ) { 			unset( $t_fields[$i] ); 		} 	}  	# Make sure array is no longer than 2 elements 	$t_sort_fields = explode( ',', $p_filter_arr['sort'] ); 	if( count( $t_sort_fields ) > 2 ) { 		$t_sort_fields = array_slice( $t_sort_fields, 0, 2 ); 	}  	# Make sure array is no longer than 2 elements 	$t_dir_fields = explode( ',', $p_filter_arr['dir'] ); 	if( count( $t_dir_fields ) > 2 ) { 		$t_dir_fields = array_slice( $t_dir_fields, 0, 2 ); 	}  	# Validate the max of two segments for $t_sort_fields and $t_dir_fields 	for( $i = 0;$i < 2;$i++ ) { 		if( isset( $t_sort_fields[$i] ) ) { 			$t_drop = false;

Patch:
patch: @@ -606,8 +606,20 @@ function filter_ensure_valid_filter( $p_filter_arr ) {
 			unset( $t_fields[$i] );
 		}
 	}
+
+	# Make sure array is no longer than 2 elements
 	$t_sort_fields = explode( ',', $p_filter_arr['sort'] );
+	if( count( $t_sort_fields ) > 2 ) {
+		$t_sort_fields = array_slice( $t_sort_fields, 0, 2 );
+	}
+
+	# Make sure array is no longer than 2 elements
 	$t_dir_fields = explode( ',', $p_filter_arr['dir'] );
+	if( count( $t_dir_fields ) > 2 ) {
+		$t_dir_fields = array_slice( $t_dir_fields, 0, 2 );
+	}
+
+	# Validate the max of two segments for $t_sort_fields and $t_dir_fields
 	for( $i = 0;$i < 2;$i++ ) {
 		if( isset( $t_sort_fields[$i] ) ) {
 			$t_drop = false;
path: core/filter_api.php