rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action.
Vulnerability ID: CVE-2014-2853
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/wikimedia/mediawiki-core
Published: 2014-04-29
File: includes/actions/InfoAction.php
Commit message: SECURITY: escape sortKey in pageInfo

DEFAULTSORT isn't escaped before being added to the action=info table.

Bug: 63251
Change-Id: I087bfde8cbc69c3507f68ee3cb6e22aba0ffa7db
Commit author: csteipp

Vulnerable version (before fix):
 protected function pageInfo() { 			$sortKey = $pageProperties['defaultsort']; 		}  		$pageInfo['header-basic'][] = array( $this->msg( 'pageinfo-default-sort' ), $sortKey );  		// Page length (in bytes)

Fixed version (after fix):
 protected function pageInfo() { 			$sortKey = $pageProperties['defaultsort']; 		}  		$sortKey = htmlspecialchars( $sortKey ); 		$pageInfo['header-basic'][] = array( $this->msg( 'pageinfo-default-sort' ), $sortKey );  		// Page length (in bytes)

Patch:
patch: @@ -262,6 +262,7 @@ protected function pageInfo() {
 			$sortKey = $pageProperties['defaultsort'];
 		}
 
+		$sortKey = htmlspecialchars( $sortKey );
 		$pageInfo['header-basic'][] = array( $this->msg( 'pageinfo-default-sort' ), $sortKey );
 
 		// Page length (in bytes)
path: includes/actions/InfoAction.php
Vulnerability: Off-by-one error in the bpf_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 3.1.8, when BPF JIT is enabled, allows local users to cause a denial of service (system crash) or possibly gain privileges via a long jump after a conditional jump.
Vulnerability ID: CVE-2014-2889
CWE: CWE-189
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2014-04-27
File: arch/x86/net/bpf_jit_comp.c
Commit message: net: bpf_jit: fix an off-one bug in x86_64 cond jump target

x86 jump instruction size is 2 or 5 bytes (near/long jump), not 2 or 6
bytes.

In case a conditional jump is followed by a long jump, conditional jump
target is one byte past the start of target instruction.

Signed-off-by: Markus Kötter <nepenthesdev@gmail.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Markus Kötter

Vulnerable version (before fix):
 cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i]; 					break; 				} 				if (filter[i].jt != 0) { 					if (filter[i].jf) 						t_offset += is_near(f_offset) ? 2 : 6; 					EMIT_COND_JMP(t_op, t_offset); 					if (filter[i].jf) 						EMIT_JMP(f_offset);

Fixed version (after fix):
 cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i]; 					break; 				} 				if (filter[i].jt != 0) { 					if (filter[i].jf && f_offset) 						t_offset += is_near(f_offset) ? 2 : 5; 					EMIT_COND_JMP(t_op, t_offset); 					if (filter[i].jf) 						EMIT_JMP(f_offset);

Patch:
patch: @@ -568,8 +568,8 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
 					break;
 				}
 				if (filter[i].jt != 0) {
-					if (filter[i].jf)
-						t_offset += is_near(f_offset) ? 2 : 6;
+					if (filter[i].jf && f_offset)
+						t_offset += is_near(f_offset) ? 2 : 5;
 					EMIT_COND_JMP(t_op, t_offset);
 					if (filter[i].jf)
 						EMIT_JMP(f_offset);
path: arch/x86/net/bpf_jit_comp.c
Vulnerability: Integer overflow in the getword function in options.c in pppd in Paul's PPP Package (ppp) before 2.4.7 allows attackers to "access privileged options" via a long word in an options file, which triggers a heap-based buffer overflow that "[corrupts] security-relevant variables."
Vulnerability ID: CVE-2014-3158
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/paulusmack/ppp
Published: 2014-11-15
File: pppd/options.c
Commit message: pppd: Eliminate potential integer overflow in option parsing

When we are reading in a word from an options file, we maintain a count
of the length we have seen so far in 'len', which is an int.  When len
exceeds MAXWORDLEN - 1 (i.e. 1023) we cease storing characters in the
buffer but we continue to increment len.  Since len is an int, it will
wrap around to -2147483648 after it reaches 2147483647.  At that point
our test of (len < MAXWORDLEN-1) will succeed and we will start writing
characters to memory again.

This may enable an attacker to overwrite the heap and thereby corrupt
security-relevant variables.  For this reason it has been assigned a
CVE identifier, CVE-2014-3158.

This fixes the bug by ceasing to increment len once it reaches MAXWORDLEN.

Reported-by: Lee Campbell <leecam@google.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>
Commit author: Paul Mackerras

Vulnerable version (before fix):
 getword(f, word, newlinep, filename) 	    /* 	     * Store the resulting character for the escape sequence. 	     */ 	    if (len < MAXWORDLEN-1) 		word[len] = value; 	    ++len;  	    if (!got) 		c = getc(f); getword(f, word, newlinep, filename) 	/* 	 * An ordinary character: store it in the word and get another. 	 */ 	if (len < MAXWORDLEN-1) 	    word[len] = c; 	++len;  	c = getc(f);     }

Fixed version (after fix):
 getword(f, word, newlinep, filename) 	    /* 	     * Store the resulting character for the escape sequence. 	     */ 	    if (len < MAXWORDLEN) { 		word[len] = value; 		++len; 	    }  	    if (!got) 		c = getc(f); getword(f, word, newlinep, filename) 	/* 	 * An ordinary character: store it in the word and get another. 	 */ 	if (len < MAXWORDLEN) { 	    word[len] = c; 	    ++len; 	}  	c = getc(f);     }

Patch:
patch: @@ -1289,9 +1289,10 @@ getword(f, word, newlinep, filename)
 	    /*
 	     * Store the resulting character for the escape sequence.
 	     */
-	    if (len < MAXWORDLEN-1)
+	    if (len < MAXWORDLEN) {
 		word[len] = value;
-	    ++len;
+		++len;
+	    }
 
 	    if (!got)
 		c = getc(f);
@@ -1329,9 +1330,10 @@ getword(f, word, newlinep, filename)
 	/*
 	 * An ordinary character: store it in the word and get another.
 	 */
-	if (len < MAXWORDLEN-1)
+	if (len < MAXWORDLEN) {
 	    word[len] = c;
-	++len;
+	    ++len;
+	}
 
 	c = getc(f);
     }
path: pppd/options.c
Vulnerability: Multiple stack-based buffer overflows in the magicmouse_raw_event function in drivers/hid/hid-magicmouse.c in the Magic Mouse HID driver in the Linux kernel through 3.16.3 allow physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with an event.
Vulnerability ID: CVE-2014-3181
CWE: CWE-119
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2014-09-28
File: drivers/hid/hid-magicmouse.c
Commit message: HID: magicmouse: sanity check report size in raw_event() callback

The report passed to us from transport driver could potentially be
arbitrarily large, therefore we better sanity-check it so that
magicmouse_emit_touch() gets only valid values of raw_id.

Cc: stable@vger.kernel.org
Reported-by: Steven Vittitoe <scvitti@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Commit author: Jiri Kosina

Vulnerable version (before fix):
 static int magicmouse_raw_event(struct hid_device *hdev, 		if (size < 4 || ((size - 4) % 9) != 0) 			return 0; 		npoints = (size - 4) / 9; 		msc->ntouches = 0; 		for (ii = 0; ii < npoints; ii++) 			magicmouse_emit_touch(msc, ii, data + ii * 9 + 4); static int magicmouse_raw_event(struct hid_device *hdev, 		if (size < 6 || ((size - 6) % 8) != 0) 			return 0; 		npoints = (size - 6) / 8; 		msc->ntouches = 0; 		for (ii = 0; ii < npoints; ii++) 			magicmouse_emit_touch(msc, ii, data + ii * 8 + 6);

Fixed version (after fix):
 static int magicmouse_raw_event(struct hid_device *hdev, 		if (size < 4 || ((size - 4) % 9) != 0) 			return 0; 		npoints = (size - 4) / 9; 		if (npoints > 15) { 			hid_warn(hdev, "invalid size value (%d) for TRACKPAD_REPORT_ID\n", 					size); 			return 0; 		} 		msc->ntouches = 0; 		for (ii = 0; ii < npoints; ii++) 			magicmouse_emit_touch(msc, ii, data + ii * 9 + 4); static int magicmouse_raw_event(struct hid_device *hdev, 		if (size < 6 || ((size - 6) % 8) != 0) 			return 0; 		npoints = (size - 6) / 8; 		if (npoints > 15) { 			hid_warn(hdev, "invalid size value (%d) for MOUSE_REPORT_ID\n", 					size); 			return 0; 		} 		msc->ntouches = 0; 		for (ii = 0; ii < npoints; ii++) 			magicmouse_emit_touch(msc, ii, data + ii * 8 + 6);

Patch:
patch: @@ -290,6 +290,11 @@ static int magicmouse_raw_event(struct hid_device *hdev,
 		if (size < 4 || ((size - 4) % 9) != 0)
 			return 0;
 		npoints = (size - 4) / 9;
+		if (npoints > 15) {
+			hid_warn(hdev, "invalid size value (%d) for TRACKPAD_REPORT_ID\n",
+					size);
+			return 0;
+		}
 		msc->ntouches = 0;
 		for (ii = 0; ii < npoints; ii++)
 			magicmouse_emit_touch(msc, ii, data + ii * 9 + 4);
@@ -307,6 +312,11 @@ static int magicmouse_raw_event(struct hid_device *hdev,
 		if (size < 6 || ((size - 6) % 8) != 0)
 			return 0;
 		npoints = (size - 6) / 8;
+		if (npoints > 15) {
+			hid_warn(hdev, "invalid size value (%d) for MOUSE_REPORT_ID\n",
+					size);
+			return 0;
+		}
 		msc->ntouches = 0;
 		for (ii = 0; ii < npoints; ii++)
 			magicmouse_emit_touch(msc, ii, data + ii * 8 + 6);
path: drivers/hid/hid-magicmouse.c
Vulnerability: Heap-based buffer overflow in the logi_dj_ll_raw_request function in drivers/hid/hid-logitech-dj.c in the Linux kernel before 3.16.2 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that specifies a large report size for an LED report.
Vulnerability ID: CVE-2014-3183
CWE: CWE-119
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2014-09-28
File: drivers/hid/hid-logitech-dj.c
Commit message: HID: logitech: fix bounds checking on LED report size

The check on report size for REPORT_TYPE_LEDS in logi_dj_ll_raw_request()
is wrong; the current check doesn't make any sense -- the report allocated
by HID core in hid_hw_raw_request() can be much larger than
DJREPORT_SHORT_LENGTH, and currently logi_dj_ll_raw_request() doesn't
handle this properly at all.

Fix the check by actually trimming down the report size properly if it is
too large.

Cc: stable@vger.kernel.org
Reported-by: Ben Hawkes <hawkes@google.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Commit author: Jiri Kosina

Vulnerable version (before fix):
 static int logi_dj_ll_raw_request(struct hid_device *hid, 	if (!out_buf) 		return -ENOMEM;  	if (count < DJREPORT_SHORT_LENGTH - 2) 		count = DJREPORT_SHORT_LENGTH - 2;  	out_buf[0] = REPORT_ID_DJ_SHORT;

Fixed version (after fix):
 static int logi_dj_ll_raw_request(struct hid_device *hid, 	if (!out_buf) 		return -ENOMEM;  	if (count > DJREPORT_SHORT_LENGTH - 2) 		count = DJREPORT_SHORT_LENGTH - 2;  	out_buf[0] = REPORT_ID_DJ_SHORT;

Patch:
patch: @@ -557,7 +557,7 @@ static int logi_dj_ll_raw_request(struct hid_device *hid,
 	if (!out_buf)
 		return -ENOMEM;
 
-	if (count < DJREPORT_SHORT_LENGTH - 2)
+	if (count > DJREPORT_SHORT_LENGTH - 2)
 		count = DJREPORT_SHORT_LENGTH - 2;
 
 	out_buf[0] = REPORT_ID_DJ_SHORT;
path: drivers/hid/hid-logitech-dj.c
Vulnerability: Buffer overflow in the picolcd_raw_event function in devices/hid/hid-picolcd_core.c in the PicoLCD HID device driver in the Linux kernel through 3.16.3, as used in Android on Nexus 7 devices, allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that sends a large report.
Vulnerability ID: CVE-2014-3186
CWE: CWE-119
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2014-09-28
File: drivers/hid/hid-picolcd_core.c
Commit message: HID: picolcd: sanity check report size in raw_event() callback

The report passed to us from transport driver could potentially be
arbitrarily large, therefore we better sanity-check it so that raw_data
that we hold in picolcd_pending structure are always kept within proper
bounds.

Cc: stable@vger.kernel.org
Reported-by: Steven Vittitoe <scvitti@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Commit author: Jiri Kosina

Vulnerable version (before fix):
 static int picolcd_raw_event(struct hid_device *hdev, 	if (!data) 		return 1;  	if (report->id == REPORT_KEY_STATE) { 		if (data->input_keys) 			ret = picolcd_raw_keypad(data, report, raw_data+1, size-1);

Fixed version (after fix):
 static int picolcd_raw_event(struct hid_device *hdev, 	if (!data) 		return 1;  	if (size > 64) { 		hid_warn(hdev, "invalid size value (%d) for picolcd raw event\n", 				size); 		return 0; 	}  	if (report->id == REPORT_KEY_STATE) { 		if (data->input_keys) 			ret = picolcd_raw_keypad(data, report, raw_data+1, size-1);

Patch:
patch: @@ -350,6 +350,12 @@ static int picolcd_raw_event(struct hid_device *hdev,
 	if (!data)
 		return 1;
 
+	if (size > 64) {
+		hid_warn(hdev, "invalid size value (%d) for picolcd raw event\n",
+				size);
+		return 0;
+	}
+
 	if (report->id == REPORT_KEY_STATE) {
 		if (data->input_keys)
 			ret = picolcd_raw_keypad(data, report, raw_data+1, size-1);
path: drivers/hid/hid-picolcd_core.c
Vulnerability: Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.
Vulnerability ID: CVE-2014-3478
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/file/file
Published: 2014-07-09
File: src/softmagic.c
Commit message: Correctly compute the truncated pascal string size (Francisco Alonso and
Jan Kaluza at RedHat)
Commit author: Christos Zoulas

Vulnerable version (before fix):
 #include "file.h"  #ifndef	lint FILE_RCSID("@(#)$File: softmagic.c,v 1.189 2014/05/30 16:47:44 christos Exp $") #endif	/* lint */  #include "magic.h" mconvert(struct magic_set *ms, struct magic *m, int flip) 		return 1; 	} 	case FILE_PSTRING: { 		char *ptr1 = p->s, *ptr2 = ptr1 + file_pstring_length_size(m); 		size_t len = file_pstring_get_length(m, ptr1); 		if (len >= sizeof(p->s)) 			len = sizeof(p->s) - 1; 		while (len--) 			*ptr1++ = *ptr2++; 		*ptr1 = '\0';

Fixed version (after fix):
 #include "file.h"  #ifndef	lint FILE_RCSID("@(#)$File: softmagic.c,v 1.190 2014/06/03 19:01:34 christos Exp $") #endif	/* lint */  #include "magic.h" mconvert(struct magic_set *ms, struct magic *m, int flip) 		return 1; 	} 	case FILE_PSTRING: { 		size_t sz = file_pstring_length_size(m); 		char *ptr1 = p->s, *ptr2 = ptr1 + sz; 		size_t len = file_pstring_get_length(m, ptr1); 		if (len >= sizeof(p->s)) { 			/* 			 * The size of the pascal string length (sz) 			 * is 1, 2, or 4. We need at least 1 byte for NUL 			 * termination, but we've already truncated the 			 * string by p->s, so we need to deduct sz. 			 */  			len = sizeof(p->s) - sz; 		} 		while (len--) 			*ptr1++ = *ptr2++; 		*ptr1 = '\0';

Patch:
patch: @@ -32,7 +32,7 @@
 #include "file.h"
 
 #ifndef	lint
-FILE_RCSID("@(#)$File: softmagic.c,v 1.189 2014/05/30 16:47:44 christos Exp $")
+FILE_RCSID("@(#)$File: softmagic.c,v 1.190 2014/06/03 19:01:34 christos Exp $")
 #endif	/* lint */
 
 #include "magic.h"
@@ -940,10 +940,18 @@ mconvert(struct magic_set *ms, struct magic *m, int flip)
 		return 1;
 	}
 	case FILE_PSTRING: {
-		char *ptr1 = p->s, *ptr2 = ptr1 + file_pstring_length_size(m);
+		size_t sz = file_pstring_length_size(m);
+		char *ptr1 = p->s, *ptr2 = ptr1 + sz;
 		size_t len = file_pstring_get_length(m, ptr1);
-		if (len >= sizeof(p->s))
-			len = sizeof(p->s) - 1;
+		if (len >= sizeof(p->s)) {
+			/*
+			 * The size of the pascal string length (sz)
+			 * is 1, 2, or 4. We need at least 1 byte for NUL
+			 * termination, but we've already truncated the
+			 * string by p->s, so we need to deduct sz.
+			 */ 
+			len = sizeof(p->s) - sz;
+		}
 		while (len--)
 			*ptr1++ = *ptr2++;
 		*ptr1 = '\0';
path: src/softmagic.c
Vulnerability: The cdf_check_stream_offset function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, relies on incorrect sector-size data, which allows remote attackers to cause a denial of service (application crash) via a crafted stream offset in a CDF file.
Vulnerability ID: CVE-2014-3479
CWE: CWE-189
Severity score: 2.9
Project: https://github.com/file/file
Published: 2014-07-09
File: src/cdf.c
Commit message: Use the proper sector size when checking stream offsets (Francisco Alonso and
Jan Kaluza at RedHat)
Commit author: Christos Zoulas

Vulnerable version (before fix):
 #include "file.h"  #ifndef lint FILE_RCSID("@(#)$File: cdf.c,v 1.60 2014/05/21 13:04:38 christos Exp $") #endif  #include <assert.h> cdf_check_stream_offset(const cdf_stream_t *sst, const cdf_header_t *h, { 	const char *b = (const char *)sst->sst_tab; 	const char *e = ((const char *)p) + tail; 	(void)&line; 	if (e >= b && (size_t)(e - b) <= CDF_SEC_SIZE(h) * sst->sst_len) 		return 0; 	DPRINTF(("%d: offset begin %p < end %p || %" SIZE_T_FORMAT "u" 	    " > %" SIZE_T_FORMAT "u [%" SIZE_T_FORMAT "u %" 	    SIZE_T_FORMAT "u]\n", line, b, e, (size_t)(e - b), 	    CDF_SEC_SIZE(h) * sst->sst_len, CDF_SEC_SIZE(h), sst->sst_len)); 	errno = EFTYPE; 	return -1; }

Fixed version (after fix):
 #include "file.h"  #ifndef lint FILE_RCSID("@(#)$File: cdf.c,v 1.61 2014/06/04 17:23:19 christos Exp $") #endif  #include <assert.h> cdf_check_stream_offset(const cdf_stream_t *sst, const cdf_header_t *h, { 	const char *b = (const char *)sst->sst_tab; 	const char *e = ((const char *)p) + tail; 	size_t ss = sst->sst_dirlen < h->h_min_size_standard_stream ? 	    CDF_SHORT_SEC_SIZE(h) : CDF_SEC_SIZE(h); 	(void)&line; 	if (e >= b && (size_t)(e - b) <= ss * sst->sst_len) 		return 0; 	DPRINTF(("%d: offset begin %p < end %p || %" SIZE_T_FORMAT "u" 	    " > %" SIZE_T_FORMAT "u [%" SIZE_T_FORMAT "u %" 	    SIZE_T_FORMAT "u]\n", line, b, e, (size_t)(e - b), 	    ss * sst->sst_len, ss, sst->sst_len)); 	errno = EFTYPE; 	return -1; }

Patch:
patch: @@ -35,7 +35,7 @@
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: cdf.c,v 1.60 2014/05/21 13:04:38 christos Exp $")
+FILE_RCSID("@(#)$File: cdf.c,v 1.61 2014/06/04 17:23:19 christos Exp $")
 #endif
 
 #include <assert.h>
@@ -267,13 +267,15 @@ cdf_check_stream_offset(const cdf_stream_t *sst, const cdf_header_t *h,
 {
 	const char *b = (const char *)sst->sst_tab;
 	const char *e = ((const char *)p) + tail;
+	size_t ss = sst->sst_dirlen < h->h_min_size_standard_stream ?
+	    CDF_SHORT_SEC_SIZE(h) : CDF_SEC_SIZE(h);
 	(void)&line;
-	if (e >= b && (size_t)(e - b) <= CDF_SEC_SIZE(h) * sst->sst_len)
+	if (e >= b && (size_t)(e - b) <= ss * sst->sst_len)
 		return 0;
 	DPRINTF(("%d: offset begin %p < end %p || %" SIZE_T_FORMAT "u"
 	    " > %" SIZE_T_FORMAT "u [%" SIZE_T_FORMAT "u %"
 	    SIZE_T_FORMAT "u]\n", line, b, e, (size_t)(e - b),
-	    CDF_SEC_SIZE(h) * sst->sst_len, CDF_SEC_SIZE(h), sst->sst_len));
+	    ss * sst->sst_len, ss, sst->sst_len));
 	errno = EFTYPE;
 	return -1;
 }
path: src/cdf.c
Vulnerability: The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.
Vulnerability ID: CVE-2014-3480
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/file/file
Published: 2014-07-09
File: src/cdf.c
Commit message: Fix incorrect bounds check for sector count. (Francisco Alonso and Jan Kaluza
at RedHat)
Commit author: Christos Zoulas

Vulnerable version (before fix):
 #include "file.h"  #ifndef lint FILE_RCSID("@(#)$File: cdf.c,v 1.59 2014/05/14 23:22:48 christos Exp $") #endif  #include <assert.h> size_t cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size) { 	size_t i, j; 	cdf_secid_t maxsector = (cdf_secid_t)(sat->sat_len * size);  	DPRINTF(("Chain:")); 	for (j = i = 0; sid >= 0; i++, j++) { cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size) 			errno = EFTYPE; 			return (size_t)-1; 		} 		if (sid > maxsector) { 			DPRINTF(("Sector %d > %d\n", sid, maxsector)); 			errno = EFTYPE; 			return (size_t)-1; 		}

Fixed version (after fix):
 #include "file.h"  #ifndef lint FILE_RCSID("@(#)$File: cdf.c,v 1.60 2014/05/21 13:04:38 christos Exp $") #endif  #include <assert.h> size_t cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size) { 	size_t i, j; 	cdf_secid_t maxsector = (cdf_secid_t)((sat->sat_len * size) 	    / sizeof(maxsector));  	DPRINTF(("Chain:")); 	for (j = i = 0; sid >= 0; i++, j++) { cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size) 			errno = EFTYPE; 			return (size_t)-1; 		} 		if (sid >= maxsector) { 			DPRINTF(("Sector %d >= %d\n", sid, maxsector)); 			errno = EFTYPE; 			return (size_t)-1; 		}

Patch:
patch: @@ -35,7 +35,7 @@
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: cdf.c,v 1.59 2014/05/14 23:22:48 christos Exp $")
+FILE_RCSID("@(#)$File: cdf.c,v 1.60 2014/05/21 13:04:38 christos Exp $")
 #endif
 
 #include <assert.h>
@@ -455,7 +455,8 @@ size_t
 cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
 {
 	size_t i, j;
-	cdf_secid_t maxsector = (cdf_secid_t)(sat->sat_len * size);
+	cdf_secid_t maxsector = (cdf_secid_t)((sat->sat_len * size)
+	    / sizeof(maxsector));
 
 	DPRINTF(("Chain:"));
 	for (j = i = 0; sid >= 0; i++, j++) {
@@ -465,8 +466,8 @@ cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
 			errno = EFTYPE;
 			return (size_t)-1;
 		}
-		if (sid > maxsector) {
-			DPRINTF(("Sector %d > %d\n", sid, maxsector));
+		if (sid >= maxsector) {
+			DPRINTF(("Sector %d >= %d\n", sid, maxsector));
 			errno = EFTYPE;
 			return (size_t)-1;
 		}
path: src/cdf.c