rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: An issue was discovered in NeoMutt before 2018-07-16. nntp_add_group in newsrc.c has a stack-based buffer overflow because of incorrect sscanf usage.
Vulnerability ID: CVE-2018-14360
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/neomutt/neomutt
Published: 2018-07-17
File: newsrc.c
Commit message: Set length modifiers for group and desc

nntp_add_group parses a line controlled by the connected nntp server.
Restrict the maximum lengths read into the stack buffers group, and
desc.
Commit author: JerikoOne

Vulnerable version (before fix):
 int nntp_add_group(char *line, void *data) {   struct NntpServer *nserv = data;   struct NntpData *nntp_data = NULL;   char group[LONG_STRING];   char desc[HUGE_STRING] = "";   char mod;   anum_t first, last;    if (!nserv || !line)     return 0;    if (sscanf(line, "%s " ANUM " " ANUM " %c %[^\n]", group, &last, &first, &mod, desc) < 4)     return 0;    nntp_data = nntp_data_find(nserv, group);   nntp_data->deleted = false;

Fixed version (after fix):
 int nntp_add_group(char *line, void *data) {   struct NntpServer *nserv = data;   struct NntpData *nntp_data = NULL;   char group[LONG_STRING] = "";   char desc[HUGE_STRING] = "";   char mod;   anum_t first, last;    if (!nserv || !line)     return 0;    /* These sscanf limits must match the sizes of the group and desc arrays */   if (sscanf(line, "%1023s " ANUM " " ANUM " %c %8191[^\n]", group, &last, &first, &mod, desc) < 4)   {     mutt_debug(4, "Cannot parse server line: %s\n", line);     return 0;   }    nntp_data = nntp_data_find(nserv, group);   nntp_data->deleted = false;

Patch:
patch: @@ -592,16 +592,20 @@ int nntp_add_group(char *line, void *data)
 {
   struct NntpServer *nserv = data;
   struct NntpData *nntp_data = NULL;
-  char group[LONG_STRING];
+  char group[LONG_STRING] = "";
   char desc[HUGE_STRING] = "";
   char mod;
   anum_t first, last;
 
   if (!nserv || !line)
     return 0;
 
-  if (sscanf(line, "%s " ANUM " " ANUM " %c %[^\n]", group, &last, &first, &mod, desc) < 4)
+  /* These sscanf limits must match the sizes of the group and desc arrays */
+  if (sscanf(line, "%1023s " ANUM " " ANUM " %c %8191[^\n]", group, &last, &first, &mod, desc) < 4)
+  {
+    mutt_debug(4, "Cannot parse server line: %s\n", line);
     return 0;
+  }
 
   nntp_data = nntp_data_find(nserv, group);
   nntp_data->deleted = false;
path: newsrc.c
Vulnerability: An issue was discovered in NeoMutt before 2018-07-16. nntp.c proceeds even if memory allocation fails for messages data.
Vulnerability ID: CVE-2018-14361
CWE: CWE-20
Severity score: 6.4
Project: https://github.com/neomutt/neomutt
Published: 2018-07-17
File: nntp.c
Commit message: Add alloc fail check in nntp_fetch_headers
Commit author: JerikoOne

Vulnerable version (before fix):
 static int nntp_fetch_headers(struct Context *ctx, void *hc, anum_t first,   fc.last = last;   fc.restore = restore;   fc.messages = mutt_mem_calloc(last - first + 1, sizeof(unsigned char)); #ifdef USE_HCACHE   fc.hc = hc; #endif

Fixed version (after fix):
 static int nntp_fetch_headers(struct Context *ctx, void *hc, anum_t first,   fc.last = last;   fc.restore = restore;   fc.messages = mutt_mem_calloc(last - first + 1, sizeof(unsigned char));   if (fc.messages == NULL) 	  return -1; #ifdef USE_HCACHE   fc.hc = hc; #endif

Patch:
patch: @@ -1288,6 +1288,8 @@ static int nntp_fetch_headers(struct Context *ctx, void *hc, anum_t first,
   fc.last = last;
   fc.restore = restore;
   fc.messages = mutt_mem_calloc(last - first + 1, sizeof(unsigned char));
+  if (fc.messages == NULL)
+	  return -1;
 #ifdef USE_HCACHE
   fc.hc = hc;
 #endif
path: nntp.c
Vulnerability: libavformat/movenc.c in FFmpeg before 4.0.2 allows attackers to cause a denial of service (application crash caused by a divide-by-zero error) with a user crafted Waveform audio file.
Vulnerability ID: CVE-2018-14394
CWE: CWE-369
Severity score: 2.9
Project: https://github.com/FFmpeg/FFmpeg
Published: 2018-07-19
File: libavformat/movenc.c
Commit message: avformat/movenc: Check input sample count

Fixes: division by 0
Fixes: fpe_movenc.c_199_1.wav
Fixes: fpe_movenc.c_199_2.wav
Fixes: fpe_movenc.c_199_3.wav
Fixes: fpe_movenc.c_199_4.wav
Fixes: fpe_movenc.c_199_5.wav
Fixes: fpe_movenc.c_199_6.wav
Fixes: fpe_movenc.c_199_7.wav

Found-by: #CHEN HONGXU# <HCHEN017@e.ntu.edu.sg>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 int ff_mov_write_packet(AVFormatContext *s, AVPacket *pkt)     else         samples_in_chunk = 1;      /* copy extradata if it exists */     if (trk->vos_len == 0 && par->extradata_size > 0 &&         !TAG_IS_AVCI(trk->tag) &&

Fixed version (after fix):
 int ff_mov_write_packet(AVFormatContext *s, AVPacket *pkt)     else         samples_in_chunk = 1;      if (samples_in_chunk < 1) {         av_log(s, AV_LOG_ERROR, "fatal error, input packet contains no samples\n");         return AVERROR_PATCHWELCOME;     }      /* copy extradata if it exists */     if (trk->vos_len == 0 && par->extradata_size > 0 &&         !TAG_IS_AVCI(trk->tag) &&

Patch:
patch: @@ -5269,6 +5269,11 @@ int ff_mov_write_packet(AVFormatContext *s, AVPacket *pkt)
     else
         samples_in_chunk = 1;
 
+    if (samples_in_chunk < 1) {
+        av_log(s, AV_LOG_ERROR, "fatal error, input packet contains no samples\n");
+        return AVERROR_PATCHWELCOME;
+    }
+
     /* copy extradata if it exists */
     if (trk->vos_len == 0 && par->extradata_size > 0 &&
         !TAG_IS_AVCI(trk->tag) &&
path: libavformat/movenc.c
Vulnerability: An issue was discovered in manage_filter_edit_page.php in MantisBT 2.x through 2.15.0. A cross-site scripting (XSS) vulnerability in the Edit Filter page allows execution of arbitrary code (if CSP settings permit it) when displaying a filter with a crafted name (e.g., 'foobar" onclick="alert(1)').
Vulnerability ID: CVE-2018-14504
CWE: CWE-79
Severity score: 2.9
Project: http://github.com/mantisbt/mantisbt
Published: 2018-08-03
File: manage_filter_edit_page.php
Commit message: Fix XSS on filter edit page (CVE-2018-14504)

Teun Beijers reported a cross-site scripting (XSS) vulnerability in
the Edit Filter page which allows execution of arbitrary code
(if CSP settings permit it) when displaying a filter with a crafted
name.

Prevent the attack by sanitizing the filter name before display.

Fixes #24608
Commit author: Roland Becker

Vulnerable version (before fix):
 						<div class="form-inline"> 							<label> 								<?php echo lang_get( 'query_name' ) ?>&nbsp; 								<input type="text" size="25" name="filter_name" maxlength="64" value="<?php echo filter_get_field( $f_filter_id, 'name' ) ?>"> 							</label> 						</div> 					</div>

Fixed version (after fix):
 						<div class="form-inline"> 							<label> 								<?php echo lang_get( 'query_name' ) ?>&nbsp; 								<input type="text" size="25" name="filter_name" maxlength="64" value="<?php echo string_display_line( filter_get_field( $f_filter_id, 'name' ) ) ?>"> 							</label> 						</div> 					</div>

Patch:
patch: @@ -124,7 +124,7 @@
 						<div class="form-inline">
 							<label>
 								<?php echo lang_get( 'query_name' ) ?>&nbsp;
-								<input type="text" size="25" name="filter_name" maxlength="64" value="<?php echo filter_get_field( $f_filter_id, 'name' ) ?>">
+								<input type="text" size="25" name="filter_name" maxlength="64" value="<?php echo string_display_line( filter_get_field( $f_filter_id, 'name' ) ) ?>">
 							</label>
 						</div>
 					</div>
path: manage_filter_edit_page.php
Vulnerability: drivers/infiniband/core/ucma.c in the Linux kernel through 4.17.11 allows ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allows attackers to cause a denial of service (use-after-free).
Vulnerability ID: CVE-2018-14734
CWE: CWE-416
Severity score: 8.5
Project: https://github.com/torvalds/linux
Published: 2018-07-29
File: drivers/infiniband/core/ucma.c
Commit message: infiniband: fix a possible use-after-free bug

ucma_process_join() will free the new allocated "mc" struct,
if there is any error after that, especially the copy_to_user().

But in parallel, ucma_leave_multicast() could find this "mc"
through idr_find() before ucma_process_join() frees it, since it
is already published.

So "mc" could be used in ucma_leave_multicast() after it is been
allocated and freed in ucma_process_join(), since we don't refcnt
it.

Fix this by separating "publish" from ID allocation, so that we
can get an ID first and publish it later after copy_to_user().

Fixes: c8f6a362bf3e ("RDMA/cma: Add multicast communication support")
Reported-by: Noam Rathaus <noamr@beyondsecurity.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Commit author: Cong Wang

Vulnerable version (before fix):
 static struct ucma_multicast* ucma_alloc_multicast(struct ucma_context *ctx) 		return NULL;  	mutex_lock(&mut); 	mc->id = idr_alloc(&multicast_idr, mc, 0, 0, GFP_KERNEL); 	mutex_unlock(&mut); 	if (mc->id < 0) 		goto error; static ssize_t ucma_process_join(struct ucma_file *file, 		goto err3; 	}  	mutex_unlock(&file->mut); 	ucma_put_ctx(ctx); 	return 0;

Fixed version (after fix):
 static struct ucma_multicast* ucma_alloc_multicast(struct ucma_context *ctx) 		return NULL;  	mutex_lock(&mut); 	mc->id = idr_alloc(&multicast_idr, NULL, 0, 0, GFP_KERNEL); 	mutex_unlock(&mut); 	if (mc->id < 0) 		goto error; static ssize_t ucma_process_join(struct ucma_file *file, 		goto err3; 	}  	mutex_lock(&mut); 	idr_replace(&multicast_idr, mc, mc->id); 	mutex_unlock(&mut);  	mutex_unlock(&file->mut); 	ucma_put_ctx(ctx); 	return 0;

Patch:
patch: @@ -235,7 +235,7 @@ static struct ucma_multicast* ucma_alloc_multicast(struct ucma_context *ctx)
 		return NULL;
 
 	mutex_lock(&mut);
-	mc->id = idr_alloc(&multicast_idr, mc, 0, 0, GFP_KERNEL);
+	mc->id = idr_alloc(&multicast_idr, NULL, 0, 0, GFP_KERNEL);
 	mutex_unlock(&mut);
 	if (mc->id < 0)
 		goto error;
@@ -1421,6 +1421,10 @@ static ssize_t ucma_process_join(struct ucma_file *file,
 		goto err3;
 	}
 
+	mutex_lock(&mut);
+	idr_replace(&multicast_idr, mc, mc->id);
+	mutex_unlock(&mut);
+
 	mutex_unlock(&file->mut);
 	ucma_put_ctx(ctx);
 	return 0;
path: drivers/infiniband/core/ucma.c
Vulnerability: The command-line argument parser in tcpdump before 4.9.3 has a buffer overflow in tcpdump.c:get_next_file().
Vulnerability ID: CVE-2018-14879
CWE: CWE-120
Severity score: 6.4
Project: https://github.com/the-tcpdump-group/tcpdump
Published: 2019-10-03
File: tcpdump.c
Commit message: (for 4.9.3) CVE-2018-14879/fix -V to fail invalid input safely

get_next_file() did not check the return value of strlen() and
underflowed an array index if the line read by fgets() from the file
started with \0. This caused an out-of-bounds read and could cause a
write. Add the missing check.

This vulnerability was discovered by Brian Carpenter & Geeknik Labs.
Commit author: Denis Ovsienko

Vulnerable version (before fix):
 static char * get_next_file(FILE *VFile, char *ptr) { 	char *ret;  	ret = fgets(ptr, PATH_MAX, VFile); 	if (!ret) 		return NULL;  	if (ptr[strlen(ptr) - 1] == '\n') 		ptr[strlen(ptr) - 1] = '\0';  	return ret; }

Fixed version (after fix):
 static char * get_next_file(FILE *VFile, char *ptr) { 	char *ret; 	size_t len;  	ret = fgets(ptr, PATH_MAX, VFile); 	if (!ret) 		return NULL;  	len = strlen (ptr); 	if (len > 0 && ptr[len - 1] == '\n') 		ptr[len - 1] = '\0';  	return ret; }

Patch:
patch: @@ -699,13 +699,15 @@ static char *
 get_next_file(FILE *VFile, char *ptr)
 {
 	char *ret;
+	size_t len;
 
 	ret = fgets(ptr, PATH_MAX, VFile);
 	if (!ret)
 		return NULL;
 
-	if (ptr[strlen(ptr) - 1] == '\n')
-		ptr[strlen(ptr) - 1] = '\0';
+	len = strlen (ptr);
+	if (len > 0 && ptr[len - 1] == '\n')
+		ptr[len - 1] = '\0';
 
 	return ret;
 }
path: tcpdump.c
Vulnerability: libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted text with invalid Unicode sequences.
Vulnerability ID: CVE-2018-15120
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/GNOME/pango
Published: 2018-08-24
File: pango/pango-emoji.c
Commit message: Prevent an assertion with invalid Unicode sequences

Invalid Unicode sequences, such as 0x2665 0xfe0e 0xfe0f,
can trick the Emoji iter code into returning an empty
segment, which then triggers an assertion in the itemizer.

Prevent this by ensuring that we make progress.

This issue was reported by Jeffrey M.
Commit author: Matthias Clasen

Vulnerable version (before fix):
 _pango_emoji_iter_next (PangoEmojiIter *iter)     if (iter->is_emoji == PANGO_EMOJI_TYPE_IS_EMOJI (current_emoji_type))     {       iter->is_emoji = !PANGO_EMOJI_TYPE_IS_EMOJI (current_emoji_type);       return TRUE;     }   }

Fixed version (after fix):
 _pango_emoji_iter_next (PangoEmojiIter *iter)     if (iter->is_emoji == PANGO_EMOJI_TYPE_IS_EMOJI (current_emoji_type))     {       iter->is_emoji = !PANGO_EMOJI_TYPE_IS_EMOJI (current_emoji_type);        /* Make sure we make progress.  Weird sequences, like a VC15 followed        * by VC16, can trick us into stalling otherwise. */       if (iter->start == iter->end)         iter->end = g_utf8_next_char (iter->end);        return TRUE;     }   }

Patch:
patch: @@ -253,6 +253,12 @@ _pango_emoji_iter_next (PangoEmojiIter *iter)
     if (iter->is_emoji == PANGO_EMOJI_TYPE_IS_EMOJI (current_emoji_type))
     {
       iter->is_emoji = !PANGO_EMOJI_TYPE_IS_EMOJI (current_emoji_type);
+
+      /* Make sure we make progress.  Weird sequences, like a VC15 followed
+       * by VC16, can trick us into stalling otherwise. */
+      if (iter->start == iter->end)
+        iter->end = g_utf8_next_char (iter->end);
+
       return TRUE;
     }
   }
path: pango/pango-emoji.c
Vulnerability: An issue was discovered in ext/standard/link_win32.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. The linkinfo function on Windows doesn't implement the open_basedir check. This could be abused to find files on paths outside of the allowed directories.
Vulnerability ID: CVE-2018-15132
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/php/php-src
Published: 2018-08-07
File: ext/standard/link_win32.c
Commit message: Fixed bug #76459 windows linkinfo lacks openbasedir check
Commit author: Anatol Belski

Vulnerable version (before fix):
 PHP_FUNCTION(readlink) PHP_FUNCTION(linkinfo) { 	char *link; 	size_t link_len; 	zend_stat_t sb; 	int ret; PHP_FUNCTION(linkinfo) 		return; 	}  	ret = VCWD_STAT(link, &sb); 	if (ret == -1) { 		php_error_docref(NULL, E_WARNING, "%s", strerror(errno)); 		RETURN_LONG(Z_L(-1)); 	}  	RETURN_LONG((zend_long) sb.st_dev); } /* }}} */

Fixed version (after fix):
 PHP_FUNCTION(readlink) PHP_FUNCTION(linkinfo) { 	char *link; 	char *dirname; 	size_t link_len; 	zend_stat_t sb; 	int ret; PHP_FUNCTION(linkinfo) 		return; 	}  	dirname = estrndup(link, link_len); 	php_dirname(dirname, link_len);  	if (php_check_open_basedir(dirname)) { 		efree(dirname); 		RETURN_FALSE; 	}  	ret = VCWD_STAT(link, &sb); 	if (ret == -1) { 		php_error_docref(NULL, E_WARNING, "%s", strerror(errno)); 		efree(dirname); 		RETURN_LONG(Z_L(-1)); 	}  	efree(dirname); 	RETURN_LONG((zend_long) sb.st_dev); } /* }}} */

Patch:
patch: @@ -87,6 +87,7 @@ PHP_FUNCTION(readlink)
 PHP_FUNCTION(linkinfo)
 {
 	char *link;
+	char *dirname;
 	size_t link_len;
 	zend_stat_t sb;
 	int ret;
@@ -95,12 +96,22 @@ PHP_FUNCTION(linkinfo)
 		return;
 	}
 
+	dirname = estrndup(link, link_len);
+	php_dirname(dirname, link_len);
+
+	if (php_check_open_basedir(dirname)) {
+		efree(dirname);
+		RETURN_FALSE;
+	}
+
 	ret = VCWD_STAT(link, &sb);
 	if (ret == -1) {
 		php_error_docref(NULL, E_WARNING, "%s", strerror(errno));
+		efree(dirname);
 		RETURN_LONG(Z_L(-1));
 	}
 
+	efree(dirname);
 	RETURN_LONG((zend_long) sb.st_dev);
 }
 /* }}} */
path: ext/standard/link_win32.c
Vulnerability: apps/filemanager/handlers/upload/drop.php in Elefant CMS 2.0.3 performs a urldecode step too late in the "Cannot upload executable files" protection mechanism.
Vulnerability ID: CVE-2018-15601
CWE: CWE-20
Severity score: 6.4
Project: https://github.com/jbroadway/elefant
Published: 2018-08-21
File: apps/filemanager/handlers/upload/drop.php
Commit message: Decode file names before restricting extensions
Commit author: lux

Vulnerable version (before fix):
 	return; }  if (preg_match ('/\.(php5?|phtml|js|rb|py|pl|sh|bash|exe)$/i', $_FILES['file']['name'])) { 	echo json_encode (array ('success' => false, 'error' => __ ('Cannot upload executable files due to security.'))); 	return; }  // some browsers may urlencode the file name $_FILES['file']['name'] = urldecode ($_FILES['file']['name']);  if (@file_exists ($root . $_POST['path'] . '/' . $_FILES['file']['name'])) { 	echo json_encode (array ('success' => false, 'error' => __ ('A file by that name already exists.'))); 	return;

Fixed version (after fix):
 	return; }  // some browsers may urlencode the file name $_FILES['file']['name'] = urldecode ($_FILES['file']['name']);  if (preg_match ('/\.(php5?|phtml|js|rb|py|pl|sh|bash|exe)$/i', $_FILES['file']['name'])) { 	echo json_encode (array ('success' => false, 'error' => __ ('Cannot upload executable files due to security.'))); 	return; }  if (@file_exists ($root . $_POST['path'] . '/' . $_FILES['file']['name'])) { 	echo json_encode (array ('success' => false, 'error' => __ ('A file by that name already exists.'))); 	return;

Patch:
patch: @@ -37,14 +37,14 @@
 	return;
 }
 
+// some browsers may urlencode the file name
+$_FILES['file']['name'] = urldecode ($_FILES['file']['name']);
+
 if (preg_match ('/\.(php5?|phtml|js|rb|py|pl|sh|bash|exe)$/i', $_FILES['file']['name'])) {
 	echo json_encode (array ('success' => false, 'error' => __ ('Cannot upload executable files due to security.')));
 	return;
 }
 
-// some browsers may urlencode the file name
-$_FILES['file']['name'] = urldecode ($_FILES['file']['name']);
-
 if (@file_exists ($root . $_POST['path'] . '/' . $_FILES['file']['name'])) {
 	echo json_encode (array ('success' => false, 'error' => __ ('A file by that name already exists.')));
 	return;
path: apps/filemanager/handlers/upload/drop.php
Vulnerability: Endless recursion exists in xkbcomp/expr.c in xkbcommon and libxkbcommon before 0.8.1, which could be used by local attackers to crash xkbcommon users by supplying a crafted keymap file that triggers boolean negation.
Vulnerability ID: CVE-2018-15853
CWE: CWE-400
Severity score: 2.9
Project: https://github.com/xkbcommon/libxkbcommon
Published: 2018-08-25
File: src/xkbcomp/expr.c
Commit message: xkbcomp: fix stack overflow when evaluating boolean negation

The expression evaluator would go into an infinite recursion when
evaluating something like this as a boolean: `!True`. Instead of
recursing to just `True` and negating, it recursed to `!True` itself
again.

Bug inherited from xkbcomp.

Caught with the afl fuzzer.

Signed-off-by: Ran Benita <ran234@gmail.com>
Commit author: Ran Benita

Vulnerable version (before fix):
 ExprResolveBoolean(struct xkb_context *ctx, const ExprDef *expr,      case EXPR_INVERT:     case EXPR_NOT:         ok = ExprResolveBoolean(ctx, expr, set_rtrn);         if (ok)             *set_rtrn = !*set_rtrn;         return ok;

Fixed version (after fix):
 ExprResolveBoolean(struct xkb_context *ctx, const ExprDef *expr,      case EXPR_INVERT:     case EXPR_NOT:         ok = ExprResolveBoolean(ctx, expr->unary.child, set_rtrn);         if (ok)             *set_rtrn = !*set_rtrn;         return ok;

Patch:
patch: @@ -165,7 +165,7 @@ ExprResolveBoolean(struct xkb_context *ctx, const ExprDef *expr,
 
     case EXPR_INVERT:
     case EXPR_NOT:
-        ok = ExprResolveBoolean(ctx, expr, set_rtrn);
+        ok = ExprResolveBoolean(ctx, expr->unary.child, set_rtrn);
         if (ok)
             *set_rtrn = !*set_rtrn;
         return ok;
path: src/xkbcomp/expr.c
Vulnerability: An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be used by local attackers to crash xkbcommon keymap parsers or possibly have unspecified other impact by supplying a crafted keymap file.
Vulnerability ID: CVE-2018-15857
CWE: CWE-416
Severity score: 6.4
Project: https://github.com/xkbcommon/libxkbcommon
Published: 2018-08-25
File: src/xkbcomp/ast-build.c
Commit message: xkbcomp: fix pointer value for FreeStmt

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Commit author: Peter Hutterer

Vulnerable version (before fix):
 ExprAppendMultiKeysymList(ExprDef *expr, ExprDef *append)     darray_append(expr->keysym_list.symsNumEntries, numEntries);     darray_concat(expr->keysym_list.syms, append->keysym_list.syms);      FreeStmt((ParseCommon *) &append);      return expr; }

Fixed version (after fix):
 ExprAppendMultiKeysymList(ExprDef *expr, ExprDef *append)     darray_append(expr->keysym_list.symsNumEntries, numEntries);     darray_concat(expr->keysym_list.syms, append->keysym_list.syms);      FreeStmt((ParseCommon *) append);      return expr; }

Patch:
patch: @@ -240,7 +240,7 @@ ExprAppendMultiKeysymList(ExprDef *expr, ExprDef *append)
     darray_append(expr->keysym_list.symsNumEntries, numEntries);
     darray_concat(expr->keysym_list.syms, append->keysym_list.syms);
 
-    FreeStmt((ParseCommon *) &append);
+    FreeStmt((ParseCommon *) append);
 
     return expr;
 }
path: src/xkbcomp/ast-build.c
Vulnerability: Unchecked NULL pointer usage when handling invalid aliases in CopyKeyAliasesToKeymap in xkbcomp/keycodes.c in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file.
Vulnerability ID: CVE-2018-15858
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/xkbcommon/libxkbcommon
Published: 2018-08-25
File: src/xkbcomp/keycodes.c
Commit message: keycodes: don't try to copy zero key aliases

Move the aliases copy to within the (num_key_aliases > 0) block.

Passing info->aliases into this fuction with invalid aliases will
cause log messages but num_key_aliases stays on 0. The key_aliases array
is never allocated and remains NULL. We then loop through the aliases, causing
a null-pointer dereference.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Commit author: Peter Hutterer

Vulnerable version (before fix):
 CopyKeyAliasesToKeymap(struct xkb_keymap *keymap, KeyNamesInfo *info)         key_aliases = calloc(num_key_aliases, sizeof(*key_aliases));         if (!key_aliases)             return false;     }      i = 0;     darray_foreach(alias, info->aliases) {         if (alias->real != XKB_ATOM_NONE) {             key_aliases[i].alias = alias->alias;             key_aliases[i].real = alias->real;             i++;         }     } 

Fixed version (after fix):
 CopyKeyAliasesToKeymap(struct xkb_keymap *keymap, KeyNamesInfo *info)         key_aliases = calloc(num_key_aliases, sizeof(*key_aliases));         if (!key_aliases)             return false;          i = 0;         darray_foreach(alias, info->aliases) {             if (alias->real != XKB_ATOM_NONE) {                 key_aliases[i].alias = alias->alias;                 key_aliases[i].real = alias->real;                 i++;             }         }     } 

Patch:
patch: @@ -596,14 +596,14 @@ CopyKeyAliasesToKeymap(struct xkb_keymap *keymap, KeyNamesInfo *info)
         key_aliases = calloc(num_key_aliases, sizeof(*key_aliases));
         if (!key_aliases)
             return false;
-    }
 
-    i = 0;
-    darray_foreach(alias, info->aliases) {
-        if (alias->real != XKB_ATOM_NONE) {
-            key_aliases[i].alias = alias->alias;
-            key_aliases[i].real = alias->real;
-            i++;
+        i = 0;
+        darray_foreach(alias, info->aliases) {
+            if (alias->real != XKB_ATOM_NONE) {
+                key_aliases[i].alias = alias->alias;
+                key_aliases[i].real = alias->real;
+                i++;
+            }
         }
     }
path: src/xkbcomp/keycodes.c