rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Buffer overflow in the tenc_box_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file, related invalid IV sizes.
Vulnerability ID: CVE-2021-31254
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/gpac/gpac
Published: 2021-04-19
File: src/isomedia/box_code_drm.c
Commit message: fixed #1703
Commit author: jeanlf

Vulnerable version (before fix):
 GF_Err tenc_box_read(GF_Box *s, GF_BitStream *bs) 		ISOM_DECREASE_SIZE(ptr, 1); 		iv_size = ptr->key_info[20] = gf_bs_read_u8(bs); 		ISOM_DECREASE_SIZE(ptr, ptr->key_info[20]); 		gf_bs_read_data(bs, ptr->key_info+21, iv_size); 	} 	return GF_OK; } 

Fixed version (after fix):
 GF_Err tenc_box_read(GF_Box *s, GF_BitStream *bs) 		ISOM_DECREASE_SIZE(ptr, 1); 		iv_size = ptr->key_info[20] = gf_bs_read_u8(bs); 		ISOM_DECREASE_SIZE(ptr, ptr->key_info[20]); 		if ((iv_size!=8) && (iv_size!=16)) { 			GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[iso file] Invalid constant IV size %d, must be 8 or 16\n", (u32) iv_size)); 			ptr->key_info[20] = 16; 			return GF_NON_COMPLIANT_BITSTREAM; 		} 		gf_bs_read_data(bs, ptr->key_info+21, iv_size); 	} 	else if ((iv_size!=0) && (iv_size!=8) && (iv_size!=16)) { 		GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[iso file] Invalid IV size %d, must be 0, 8 or 16\n", (u32) iv_size)); 		return GF_NON_COMPLIANT_BITSTREAM; 	} 	return GF_OK; } 

Patch:
patch: @@ -876,8 +876,17 @@ GF_Err tenc_box_read(GF_Box *s, GF_BitStream *bs)
 		ISOM_DECREASE_SIZE(ptr, 1);
 		iv_size = ptr->key_info[20] = gf_bs_read_u8(bs);
 		ISOM_DECREASE_SIZE(ptr, ptr->key_info[20]);
+		if ((iv_size!=8) && (iv_size!=16)) {
+			GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[iso file] Invalid constant IV size %d, must be 8 or 16\n", (u32) iv_size));
+			ptr->key_info[20] = 16;
+			return GF_NON_COMPLIANT_BITSTREAM;
+		}
 		gf_bs_read_data(bs, ptr->key_info+21, iv_size);
 	}
+	else if ((iv_size!=0) && (iv_size!=8) && (iv_size!=16)) {
+		GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[iso file] Invalid IV size %d, must be 0, 8 or 16\n", (u32) iv_size));
+		return GF_NON_COMPLIANT_BITSTREAM;
+	}
 	return GF_OK;
 }
path: src/isomedia/box_code_drm.c
Vulnerability: Memory leak in the stbl_GetSampleInfos function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
Vulnerability ID: CVE-2021-31256
CWE: CWE-401
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2021-04-19
File: src/isomedia/stbl_read.c
Commit message: fixed #1705
Commit author: jeanlf

Vulnerable version (before fix):
 GF_Err stbl_GetSampleInfos(GF_SampleTableBox *stbl, u32 sampleNumber, u64 *offse 		if ( stbl->ChunkOffset->type == GF_ISOM_BOX_TYPE_STCO) { 			stco = (GF_ChunkOffsetBox *)stbl->ChunkOffset; 			if (!stco->offsets) return GF_ISOM_INVALID_FILE;  			(*offset) = (u64) stco->offsets[sampleNumber - 1]; 		} else { 			co64 = (GF_ChunkLargeOffsetBox *)stbl->ChunkOffset; 			if (!co64->offsets) return GF_ISOM_INVALID_FILE;  			(*offset) = co64->offsets[sampleNumber - 1]; 		}

Fixed version (after fix):
 GF_Err stbl_GetSampleInfos(GF_SampleTableBox *stbl, u32 sampleNumber, u64 *offse 		if ( stbl->ChunkOffset->type == GF_ISOM_BOX_TYPE_STCO) { 			stco = (GF_ChunkOffsetBox *)stbl->ChunkOffset; 			if (!stco->offsets) return GF_ISOM_INVALID_FILE; 			if (stco->nb_entries < sampleNumber) return GF_ISOM_INVALID_FILE;  			(*offset) = (u64) stco->offsets[sampleNumber - 1]; 		} else { 			co64 = (GF_ChunkLargeOffsetBox *)stbl->ChunkOffset; 			if (!co64->offsets) return GF_ISOM_INVALID_FILE; 			if (co64->nb_entries < sampleNumber) return GF_ISOM_INVALID_FILE;  			(*offset) = co64->offsets[sampleNumber - 1]; 		}

Patch:
patch: @@ -419,11 +419,13 @@ GF_Err stbl_GetSampleInfos(GF_SampleTableBox *stbl, u32 sampleNumber, u64 *offse
 		if ( stbl->ChunkOffset->type == GF_ISOM_BOX_TYPE_STCO) {
 			stco = (GF_ChunkOffsetBox *)stbl->ChunkOffset;
 			if (!stco->offsets) return GF_ISOM_INVALID_FILE;
+			if (stco->nb_entries < sampleNumber) return GF_ISOM_INVALID_FILE;
 
 			(*offset) = (u64) stco->offsets[sampleNumber - 1];
 		} else {
 			co64 = (GF_ChunkLargeOffsetBox *)stbl->ChunkOffset;
 			if (!co64->offsets) return GF_ISOM_INVALID_FILE;
+			if (co64->nb_entries < sampleNumber) return GF_ISOM_INVALID_FILE;
 
 			(*offset) = co64->offsets[sampleNumber - 1];
 		}
path: src/isomedia/stbl_read.c
Vulnerability: The HintFile function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
Vulnerability ID: CVE-2021-31257
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2021-04-19
File: applications/mp4box/main.c
Commit message: fixed #1734
Commit author: jeanlf

Vulnerable version (before fix):
 GF_Err HintFile(GF_ISOFile *file, u32 MTUSize, u32 max_ptime, u32 rtp_rate, u32  		streamType = 0; 		esd = gf_isom_get_esd(file, i+1, 1); 		if (esd) { 			streamType = esd->decoderConfig->streamType; 			if (!prev_ocr) { 				prev_ocr = esd->OCRESID;

Fixed version (after fix):
 GF_Err HintFile(GF_ISOFile *file, u32 MTUSize, u32 max_ptime, u32 rtp_rate, u32  		streamType = 0; 		esd = gf_isom_get_esd(file, i+1, 1); 		if (esd && esd->decoderConfig) { 			streamType = esd->decoderConfig->streamType; 			if (!prev_ocr) { 				prev_ocr = esd->OCRESID;

Patch:
patch: @@ -3370,7 +3370,7 @@ GF_Err HintFile(GF_ISOFile *file, u32 MTUSize, u32 max_ptime, u32 rtp_rate, u32
 
 		streamType = 0;
 		esd = gf_isom_get_esd(file, i+1, 1);
-		if (esd) {
+		if (esd && esd->decoderConfig) {
 			streamType = esd->decoderConfig->streamType;
 			if (!prev_ocr) {
 				prev_ocr = esd->OCRESID;
path: applications/mp4box/main.c
Vulnerability: The gf_isom_cenc_get_default_info_internal function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
Vulnerability ID: CVE-2021-31259
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2021-04-19
File: src/isomedia/drm_sample.c
Commit message: fixed #1735
Commit author: jeanlf

Vulnerable version (before fix):
 void gf_isom_cenc_get_default_info_internal(GF_TrackBox *trak, u32 sampleDescrip 				seig_entry = gf_list_get(sgdesc->group_descriptions, sgdesc->default_description_index-1); 			else 				seig_entry = gf_list_get(sgdesc->group_descriptions, 0); 			if (!seig_entry->key_info[0]) 				seig_entry = NULL; 			break; 		}

Fixed version (after fix):
 void gf_isom_cenc_get_default_info_internal(GF_TrackBox *trak, u32 sampleDescrip 				seig_entry = gf_list_get(sgdesc->group_descriptions, sgdesc->default_description_index-1); 			else 				seig_entry = gf_list_get(sgdesc->group_descriptions, 0); 			if (seig_entry && !seig_entry->key_info[0]) 				seig_entry = NULL; 			break; 		}

Patch:
patch: @@ -1686,7 +1686,7 @@ void gf_isom_cenc_get_default_info_internal(GF_TrackBox *trak, u32 sampleDescrip
 				seig_entry = gf_list_get(sgdesc->group_descriptions, sgdesc->default_description_index-1);
 			else
 				seig_entry = gf_list_get(sgdesc->group_descriptions, 0);
-			if (!seig_entry->key_info[0])
+			if (seig_entry && !seig_entry->key_info[0])
 				seig_entry = NULL;
 			break;
 		}
path: src/isomedia/drm_sample.c
Vulnerability: The MergeTrack function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
Vulnerability ID: CVE-2021-31260
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2021-04-19
File: src/isomedia/track.c
Commit message: fixed #1736
Commit author: jeanlf

Vulnerable version (before fix):
 GF_Err MergeTrack(GF_TrackBox *trak, GF_TrackFragmentBox *traf, GF_MovieFragment 				if ((aux_info_type == GF_ISOM_CENC_SCHEME) || (aux_info_type == GF_ISOM_CBC_SCHEME) || 					(aux_info_type == GF_ISOM_CENS_SCHEME) || (aux_info_type == GF_ISOM_CBCS_SCHEME) || 					(gf_list_count(traf->sai_offsets) == 1)) { 					offset = saio->offsets[0] + moof_offset; 					nb_saio = saio->entry_count; 					break; 				} 			} 			for (i = 0; i < gf_list_count(traf->sai_sizes); i++) { 				saiz = (GF_SampleAuxiliaryInfoSizeBox *)gf_list_get(traf->sai_sizes, i); GF_Err MergeTrack(GF_TrackBox *trak, GF_TrackFragmentBox *traf, GF_MovieFragment 					(gf_list_count(traf->sai_sizes) == 1)) { 					break; 				} 			} 			if (saiz && saio && senc) { 				for (i = 0; i < saiz->sample_count; i++) {

Fixed version (after fix):
 GF_Err MergeTrack(GF_TrackBox *trak, GF_TrackFragmentBox *traf, GF_MovieFragment 				if ((aux_info_type == GF_ISOM_CENC_SCHEME) || (aux_info_type == GF_ISOM_CBC_SCHEME) || 					(aux_info_type == GF_ISOM_CENS_SCHEME) || (aux_info_type == GF_ISOM_CBCS_SCHEME) || 					(gf_list_count(traf->sai_offsets) == 1)) { 					if (saio->offsets && saio->entry_count) { 						offset = saio->offsets[0] + moof_offset; 						nb_saio = saio->entry_count; 						break; 					} 				} 				saio = NULL; 			} 			for (i = 0; i < gf_list_count(traf->sai_sizes); i++) { 				saiz = (GF_SampleAuxiliaryInfoSizeBox *)gf_list_get(traf->sai_sizes, i); GF_Err MergeTrack(GF_TrackBox *trak, GF_TrackFragmentBox *traf, GF_MovieFragment 					(gf_list_count(traf->sai_sizes) == 1)) { 					break; 				} 				saiz = NULL; 			} 			if (saiz && saio && senc) { 				for (i = 0; i < saiz->sample_count; i++) {

Patch:
patch: @@ -1035,10 +1035,13 @@ GF_Err MergeTrack(GF_TrackBox *trak, GF_TrackFragmentBox *traf, GF_MovieFragment
 				if ((aux_info_type == GF_ISOM_CENC_SCHEME) || (aux_info_type == GF_ISOM_CBC_SCHEME) ||
 					(aux_info_type == GF_ISOM_CENS_SCHEME) || (aux_info_type == GF_ISOM_CBCS_SCHEME) ||
 					(gf_list_count(traf->sai_offsets) == 1)) {
-					offset = saio->offsets[0] + moof_offset;
-					nb_saio = saio->entry_count;
-					break;
+					if (saio->offsets && saio->entry_count) {
+						offset = saio->offsets[0] + moof_offset;
+						nb_saio = saio->entry_count;
+						break;
+					}
 				}
+				saio = NULL;
 			}
 			for (i = 0; i < gf_list_count(traf->sai_sizes); i++) {
 				saiz = (GF_SampleAuxiliaryInfoSizeBox *)gf_list_get(traf->sai_sizes, i);
@@ -1050,6 +1053,7 @@ GF_Err MergeTrack(GF_TrackBox *trak, GF_TrackFragmentBox *traf, GF_MovieFragment
 					(gf_list_count(traf->sai_sizes) == 1)) {
 					break;
 				}
+				saiz = NULL;
 			}
 			if (saiz && saio && senc) {
 				for (i = 0; i < saiz->sample_count; i++) {
path: src/isomedia/track.c
Vulnerability: The gf_hinter_track_new function in GPAC 1.0.1 allows attackers to read memory via a crafted file in the MP4Box command.
Vulnerability ID: CVE-2021-31261
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2021-04-19
File: src/media_tools/isom_hinter.c
Commit message: fixed #1737
Commit author: jeanlf

Vulnerable version (before fix):
 GF_RTPHinter *gf_hinter_track_new(GF_ISOFile *file, u32 TrackNum, 				else if (gf_isom_has_sync_shadows(file, TrackNum) || gf_isom_has_sample_dependency(file, TrackNum)) { 					flags |= GP_RTP_PCK_SYSTEMS_CAROUSEL; 				} 				gf_odf_desc_del((GF_Descriptor*)esd); 			} 			break; 		case GF_ISOM_SUBTYPE_3GP_H263: 			hintType = GF_RTP_PAYT_H263;

Fixed version (after fix):
 GF_RTPHinter *gf_hinter_track_new(GF_ISOFile *file, u32 TrackNum, 				else if (gf_isom_has_sync_shadows(file, TrackNum) || gf_isom_has_sample_dependency(file, TrackNum)) { 					flags |= GP_RTP_PCK_SYSTEMS_CAROUSEL; 				} 			} 			if (esd) 				gf_odf_desc_del((GF_Descriptor*)esd); 			break; 		case GF_ISOM_SUBTYPE_3GP_H263: 			hintType = GF_RTP_PAYT_H263;

Patch:
patch: @@ -402,8 +402,9 @@ GF_RTPHinter *gf_hinter_track_new(GF_ISOFile *file, u32 TrackNum,
 				else if (gf_isom_has_sync_shadows(file, TrackNum) || gf_isom_has_sample_dependency(file, TrackNum)) {
 					flags |= GP_RTP_PCK_SYSTEMS_CAROUSEL;
 				}
-				gf_odf_desc_del((GF_Descriptor*)esd);
 			}
+			if (esd)
+				gf_odf_desc_del((GF_Descriptor*)esd);
 			break;
 		case GF_ISOM_SUBTYPE_3GP_H263:
 			hintType = GF_RTP_PAYT_H263;
path: src/media_tools/isom_hinter.c
Vulnerability: The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in queue.c for queue creation.
Vulnerability ID: CVE-2021-31571
CWE: CWE-190
Severity score: 6.4
Project: https://github.com/FreeRTOS/FreeRTOS-Kernel
Published: 2021-04-22
File: queue.c
Commit message: add assert for addition overflow on queue creation (#225)
Commit author: Cobus van Eeden

Vulnerable version (before fix):
 BaseType_t xQueueGenericReset( QueueHandle_t xQueue,         /* Check for multiplication overflow. */         configASSERT( ( uxItemSize == 0 ) || ( uxQueueLength == ( xQueueSizeInBytes / uxItemSize ) ) );          /* Allocate the queue and storage area.  Justification for MISRA          * deviation as follows:  pvPortMalloc() always ensures returned memory          * blocks are aligned per the requirements of the MCU stack.  In this case

Fixed version (after fix):
 BaseType_t xQueueGenericReset( QueueHandle_t xQueue,         /* Check for multiplication overflow. */         configASSERT( ( uxItemSize == 0 ) || ( uxQueueLength == ( xQueueSizeInBytes / uxItemSize ) ) );          /* Check for addition overflow. */         configASSERT( ( sizeof( Queue_t ) + xQueueSizeInBytes ) >  xQueueSizeInBytes );          /* Allocate the queue and storage area.  Justification for MISRA          * deviation as follows:  pvPortMalloc() always ensures returned memory          * blocks are aligned per the requirements of the MCU stack.  In this case

Patch:
patch: @@ -397,6 +397,9 @@ BaseType_t xQueueGenericReset( QueueHandle_t xQueue,
         /* Check for multiplication overflow. */
         configASSERT( ( uxItemSize == 0 ) || ( uxQueueLength == ( xQueueSizeInBytes / uxItemSize ) ) );
 
+        /* Check for addition overflow. */
+        configASSERT( ( sizeof( Queue_t ) + xQueueSizeInBytes ) >  xQueueSizeInBytes );
+
         /* Allocate the queue and storage area.  Justification for MISRA
          * deviation as follows:  pvPortMalloc() always ensures returned memory
          * blocks are aligned per the requirements of the MCU stack.  In this case
path: queue.c
Vulnerability: The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in stream_buffer.c for a stream buffer.
Vulnerability ID: CVE-2021-31572
CWE: CWE-190
Severity score: 6.4
Project: https://github.com/FreeRTOS/FreeRTOS-Kernel
Published: 2021-04-22
File: stream_buffer.c
Commit message: Add addition overflow check for stream buffer (#226)
Commit author: Cobus van Eeden

Vulnerable version (before fix):
 static void prvInitialiseNewStreamBuffer( StreamBuffer_t * const pxStreamBuffer,          * this is a quirk of the implementation that means otherwise the free          * space would be reported as one byte smaller than would be logically          * expected. */         xBufferSizeBytes++;         pucAllocatedMemory = ( uint8_t * ) pvPortMalloc( xBufferSizeBytes + sizeof( StreamBuffer_t ) ); /*lint !e9079 malloc() only returns void*. */          if( pucAllocatedMemory != NULL )         {

Fixed version (after fix):
 static void prvInitialiseNewStreamBuffer( StreamBuffer_t * const pxStreamBuffer,          * this is a quirk of the implementation that means otherwise the free          * space would be reported as one byte smaller than would be logically          * expected. */         if( xBufferSizeBytes < ( xBufferSizeBytes + 1 + sizeof( StreamBuffer_t ) ) )         {             xBufferSizeBytes++;             pucAllocatedMemory = ( uint8_t * ) pvPortMalloc( xBufferSizeBytes + sizeof( StreamBuffer_t ) ); /*lint !e9079 malloc() only returns void*. */         }         else         {             pucAllocatedMemory = NULL;         }                   if( pucAllocatedMemory != NULL )         {

Patch:
patch: @@ -258,8 +258,16 @@ static void prvInitialiseNewStreamBuffer( StreamBuffer_t * const pxStreamBuffer,
          * this is a quirk of the implementation that means otherwise the free
          * space would be reported as one byte smaller than would be logically
          * expected. */
-        xBufferSizeBytes++;
-        pucAllocatedMemory = ( uint8_t * ) pvPortMalloc( xBufferSizeBytes + sizeof( StreamBuffer_t ) ); /*lint !e9079 malloc() only returns void*. */
+        if( xBufferSizeBytes < ( xBufferSizeBytes + 1 + sizeof( StreamBuffer_t ) ) )
+        {
+            xBufferSizeBytes++;
+            pucAllocatedMemory = ( uint8_t * ) pvPortMalloc( xBufferSizeBytes + sizeof( StreamBuffer_t ) ); /*lint !e9079 malloc() only returns void*. */
+        }
+        else
+        {
+            pucAllocatedMemory = NULL;
+        }
+        
 
         if( pucAllocatedMemory != NULL )
         {
path: stream_buffer.c
Vulnerability: RIOT-OS 2021.01 before commit 44741ff99f7a71df45420635b238b9c22093647a contains a buffer overflow which could allow attackers to obtain sensitive information.
Vulnerability ID: CVE-2021-31664
CWE: CWE-120
Severity score: 2.9
Project: https://github.com/RIOT-OS/RIOT
Published: 2021-06-18
File: sys/net/application_layer/dns/dns.c
Commit message: Merge pull request #15345 from nmeum/pr/sock_dns_overflow

sock_dns: Fix incorrect buffer bounds check
Commit author: Martine Lenders

Vulnerable version (before fix):
 static int _parse_dns_reply(uint8_t *buf, size_t len, void* addr_out, int family             return tmp;         }         bufpos += tmp;         if ((bufpos + RR_TYPE_LENGTH + RR_CLASS_LENGTH + RR_TTL_LENGTH) >= buflim) {             return -EBADMSG;         }         uint16_t _type = ntohs(_get_short(bufpos));

Fixed version (after fix):
 static int _parse_dns_reply(uint8_t *buf, size_t len, void* addr_out, int family             return tmp;         }         bufpos += tmp;         if ((bufpos + RR_TYPE_LENGTH + RR_CLASS_LENGTH +              RR_TTL_LENGTH + sizeof(uint16_t)) >= buflim) {             return -EBADMSG;         }         uint16_t _type = ntohs(_get_short(bufpos));

Patch:
patch: @@ -125,7 +125,8 @@ static int _parse_dns_reply(uint8_t *buf, size_t len, void* addr_out, int family
             return tmp;
         }
         bufpos += tmp;
-        if ((bufpos + RR_TYPE_LENGTH + RR_CLASS_LENGTH + RR_TTL_LENGTH) >= buflim) {
+        if ((bufpos + RR_TYPE_LENGTH + RR_CLASS_LENGTH +
+             RR_TTL_LENGTH + sizeof(uint16_t)) >= buflim) {
             return -EBADMSG;
         }
         uint16_t _type = ntohs(_get_short(bufpos));
path: sys/net/application_layer/dns/dns.c
Vulnerability: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel before 5.12. A bound check failure allows an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability.
Vulnerability ID: CVE-2021-31916
CWE: CWE-787
Severity score: 8.5
Project: https://github.com/torvalds/linux
Published: 2021-05-06
File: drivers/md/dm-ioctl.c
Commit message: dm ioctl: fix out of bounds array access when no devices

If there are not any dm devices, we need to zero the "dev" argument in
the first structure dm_name_list. However, this can cause out of
bounds write, because the "needed" variable is zero and len may be
less than eight.

Fix this bug by reporting DM_BUFFER_FULL_FLAG if the result buffer is
too small to hold the "nl->dev" value.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Commit author: Mikulas Patocka

Vulnerable version (before fix):
 static int list_devices(struct file *filp, struct dm_ioctl *param, size_t param_ 	 * Grab our output buffer. 	 */ 	nl = orig_nl = get_result_buffer(param, param_size, &len); 	if (len < needed) { 		param->flags |= DM_BUFFER_FULL_FLAG; 		goto out; 	}

Fixed version (after fix):
 static int list_devices(struct file *filp, struct dm_ioctl *param, size_t param_ 	 * Grab our output buffer. 	 */ 	nl = orig_nl = get_result_buffer(param, param_size, &len); 	if (len < needed || len < sizeof(nl->dev)) { 		param->flags |= DM_BUFFER_FULL_FLAG; 		goto out; 	}

Patch:
patch: @@ -529,7 +529,7 @@ static int list_devices(struct file *filp, struct dm_ioctl *param, size_t param_
 	 * Grab our output buffer.
 	 */
 	nl = orig_nl = get_result_buffer(param, param_size, &len);
-	if (len < needed) {
+	if (len < needed || len < sizeof(nl->dev)) {
 		param->flags |= DM_BUFFER_FULL_FLAG;
 		goto out;
 	}
path: drivers/md/dm-ioctl.c
Vulnerability: Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt 2019-10-25 through 2021-05-04) has a $imap_qresync issue in which imap/util.c has an out-of-bounds read in situations where an IMAP sequence set ends with a comma. NOTE: the $imap_qresync setting for QRESYNC is not enabled by default.
Vulnerability ID: CVE-2021-32055
CWE: CWE-125
Severity score: 4.9
Project: https://github.com/neomutt/neomutt
Published: 2021-05-05
File: imap/util.c
Commit message: Fix seqset iterator when it ends in a comma

If the seqset ended with a comma, the substr_end marker would be just
before the trailing nul.  In the next call, the loop to skip the
marker would iterate right past the end of string too.

The fix is simple: place the substr_end marker and skip past it
immediately.
Commit author: Kevin McCarthy

Vulnerable version (before fix):
 int mutt_seqset_iterator_next(struct SeqsetIterator *iter, unsigned int *next)     if (iter->substr_cur == iter->eostr)       return 1;      while (!*(iter->substr_cur))       iter->substr_cur++;     iter->substr_end = strchr(iter->substr_cur, ',');     if (!iter->substr_end)       iter->substr_end = iter->eostr;     else       *(iter->substr_end) = '\0';      char *range_sep = strchr(iter->substr_cur, ':');     if (range_sep)

Fixed version (after fix):
 int mutt_seqset_iterator_next(struct SeqsetIterator *iter, unsigned int *next)     if (iter->substr_cur == iter->eostr)       return 1;      iter->substr_end = strchr(iter->substr_cur, ',');     if (!iter->substr_end)       iter->substr_end = iter->eostr;     else       *(iter->substr_end++) = '\0';      char *range_sep = strchr(iter->substr_cur, ':');     if (range_sep)

Patch:
patch: @@ -1119,13 +1119,11 @@ int mutt_seqset_iterator_next(struct SeqsetIterator *iter, unsigned int *next)
     if (iter->substr_cur == iter->eostr)
       return 1;
 
-    while (!*(iter->substr_cur))
-      iter->substr_cur++;
     iter->substr_end = strchr(iter->substr_cur, ',');
     if (!iter->substr_end)
       iter->substr_end = iter->eostr;
     else
-      *(iter->substr_end) = '\0';
+      *(iter->substr_end++) = '\0';
 
     char *range_sep = strchr(iter->substr_cur, ':');
     if (range_sep)
path: imap/util.c
Vulnerability: The trak_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
Vulnerability ID: CVE-2021-32135
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2021-09-13
File: src/isomedia/box_code_base.c
Commit message: fixed #1757
Commit author: jeanlf

Vulnerable version (before fix):
 GF_Err trak_box_size(GF_Box *s) 	GF_TrackBox *ptr = (GF_TrackBox *)s;  	if (ptr->sample_encryption && ptr->sample_encryption->load_needed) { 		GF_Err e = senc_Parse(ptr->moov->mov->movieFileMap->bs, ptr, NULL, ptr->sample_encryption); 		if (e) return e; 	}

Fixed version (after fix):
 GF_Err trak_box_size(GF_Box *s) 	GF_TrackBox *ptr = (GF_TrackBox *)s;  	if (ptr->sample_encryption && ptr->sample_encryption->load_needed) { 		if (!ptr->moov || !!ptr->moov->mov || !ptr->moov->mov->movieFileMap) 			return GF_ISOM_INVALID_FILE; 		GF_Err e = senc_Parse(ptr->moov->mov->movieFileMap->bs, ptr, NULL, ptr->sample_encryption); 		if (e) return e; 	}

Patch:
patch: @@ -6743,6 +6743,8 @@ GF_Err trak_box_size(GF_Box *s)
 	GF_TrackBox *ptr = (GF_TrackBox *)s;
 
 	if (ptr->sample_encryption && ptr->sample_encryption->load_needed) {
+		if (!ptr->moov || !!ptr->moov->mov || !ptr->moov->mov->movieFileMap)
+			return GF_ISOM_INVALID_FILE;
 		GF_Err e = senc_Parse(ptr->moov->mov->movieFileMap->bs, ptr, NULL, ptr->sample_encryption);
 		if (e) return e;
 	}
path: src/isomedia/box_code_base.c