rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Race condition in the snd_pcm_period_elapsed function in sound/core/pcm_lib.c in the ALSA subsystem in the Linux kernel before 4.7 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted SNDRV_PCM_TRIGGER_START command.
Vulnerability ID: CVE-2016-9794
CWE: CWE-416
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2016-12-28
File: sound/core/pcm_lib.c
Commit message: ALSA: pcm : Call kill_fasync() in stream lock

Currently kill_fasync() is called outside the stream lock in
snd_pcm_period_elapsed().  This is potentially racy, since the stream
may get released even during the irq handler is running.  Although
snd_pcm_release_substream() calls snd_pcm_drop(), this doesn't
guarantee that the irq handler finishes, thus the kill_fasync() call
outside the stream spin lock may be invoked after the substream is
detached, as recently reported by KASAN.

As a quick workaround, move kill_fasync() call inside the stream
lock.  The fasync is rarely used interface, so this shouldn't have a
big impact from the performance POV.

Ideally, we should implement some sync mechanism for the proper finish
of stream and irq handler.  But this oneliner should suffice for most
cases, so far.

Reported-by: Baozeng Ding <sploving1@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Commit author: Takashi Iwai

Vulnerable version (before fix):
 void snd_pcm_period_elapsed(struct snd_pcm_substream *substream) 		snd_timer_interrupt(substream->timer, 1); #endif  _end: 	snd_pcm_stream_unlock_irqrestore(substream, flags); 	kill_fasync(&runtime->fasync, SIGIO, POLL_IN); }  EXPORT_SYMBOL(snd_pcm_period_elapsed);

Fixed version (after fix):
 void snd_pcm_period_elapsed(struct snd_pcm_substream *substream) 		snd_timer_interrupt(substream->timer, 1); #endif  _end: 	kill_fasync(&runtime->fasync, SIGIO, POLL_IN); 	snd_pcm_stream_unlock_irqrestore(substream, flags); }  EXPORT_SYMBOL(snd_pcm_period_elapsed);

Patch:
patch: @@ -1886,8 +1886,8 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream)
 		snd_timer_interrupt(substream->timer, 1);
 #endif
  _end:
-	snd_pcm_stream_unlock_irqrestore(substream, flags);
 	kill_fasync(&runtime->fasync, SIGIO, POLL_IN);
+	snd_pcm_stream_unlock_irqrestore(substream, flags);
 }
 
 EXPORT_SYMBOL(snd_pcm_period_elapsed);
path: sound/core/pcm_lib.c
Vulnerability: Race condition in the snd_pcm_period_elapsed function in sound/core/pcm_lib.c in the ALSA subsystem in the Linux kernel before 4.7 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted SNDRV_PCM_TRIGGER_START command.
Vulnerability ID: CVE-2016-9794
CWE: CWE-362
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2016-12-28
File: sound/core/pcm_lib.c
Commit message: ALSA: pcm : Call kill_fasync() in stream lock

Currently kill_fasync() is called outside the stream lock in
snd_pcm_period_elapsed().  This is potentially racy, since the stream
may get released even during the irq handler is running.  Although
snd_pcm_release_substream() calls snd_pcm_drop(), this doesn't
guarantee that the irq handler finishes, thus the kill_fasync() call
outside the stream spin lock may be invoked after the substream is
detached, as recently reported by KASAN.

As a quick workaround, move kill_fasync() call inside the stream
lock.  The fasync is rarely used interface, so this shouldn't have a
big impact from the performance POV.

Ideally, we should implement some sync mechanism for the proper finish
of stream and irq handler.  But this oneliner should suffice for most
cases, so far.

Reported-by: Baozeng Ding <sploving1@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Commit author: Takashi Iwai

Vulnerable version (before fix):
 void snd_pcm_period_elapsed(struct snd_pcm_substream *substream) 		snd_timer_interrupt(substream->timer, 1); #endif  _end: 	snd_pcm_stream_unlock_irqrestore(substream, flags); 	kill_fasync(&runtime->fasync, SIGIO, POLL_IN); }  EXPORT_SYMBOL(snd_pcm_period_elapsed);

Fixed version (after fix):
 void snd_pcm_period_elapsed(struct snd_pcm_substream *substream) 		snd_timer_interrupt(substream->timer, 1); #endif  _end: 	kill_fasync(&runtime->fasync, SIGIO, POLL_IN); 	snd_pcm_stream_unlock_irqrestore(substream, flags); }  EXPORT_SYMBOL(snd_pcm_period_elapsed);

Patch:
patch: @@ -1886,8 +1886,8 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream)
 		snd_timer_interrupt(substream->timer, 1);
 #endif
  _end:
-	snd_pcm_stream_unlock_irqrestore(substream, flags);
 	kill_fasync(&runtime->fasync, SIGIO, POLL_IN);
+	snd_pcm_stream_unlock_irqrestore(substream, flags);
 }
 
 EXPORT_SYMBOL(snd_pcm_period_elapsed);
path: sound/core/pcm_lib.c
Vulnerability: Race condition in the netlink_dump function in net/netlink/af_netlink.c in the Linux kernel before 4.6.3 allows local users to cause a denial of service (double free) or possibly have unspecified other impact via a crafted application that makes sendmsg system calls, leading to a free operation associated with a new dump that started earlier than anticipated.
Vulnerability ID: CVE-2016-9806
CWE: CWE-415
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2016-12-28
File: net/netlink/af_netlink.c
Commit message: netlink: Fix dump skb leak/double free

When we free cb->skb after a dump, we do it after releasing the
lock.  This means that a new dump could have started in the time
being and we'll end up freeing their skb instead of ours.

This patch saves the skb and module before we unlock so we free
the right memory.

Fixes: 16b304f3404f ("netlink: Eliminate kmalloc in netlink dump operation.")
Reported-by: Baozeng Ding <sploving1@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Herbert Xu

Vulnerable version (before fix):
 static int netlink_dump(struct sock *sk) 	struct netlink_callback *cb; 	struct sk_buff *skb = NULL; 	struct nlmsghdr *nlh; 	int len, err = -ENOBUFS; 	int alloc_min_size; 	int alloc_size; static int netlink_dump(struct sock *sk) 		cb->done(cb);  	nlk->cb_running = false; 	mutex_unlock(nlk->cb_mutex); 	module_put(cb->module); 	consume_skb(cb->skb); 	return 0;  errout_skb:

Fixed version (after fix):
 static int netlink_dump(struct sock *sk) 	struct netlink_callback *cb; 	struct sk_buff *skb = NULL; 	struct nlmsghdr *nlh; 	struct module *module; 	int len, err = -ENOBUFS; 	int alloc_min_size; 	int alloc_size; static int netlink_dump(struct sock *sk) 		cb->done(cb);  	nlk->cb_running = false; 	module = cb->module; 	skb = cb->skb; 	mutex_unlock(nlk->cb_mutex); 	module_put(module); 	consume_skb(skb); 	return 0;  errout_skb:

Patch:
patch: @@ -2059,6 +2059,7 @@ static int netlink_dump(struct sock *sk)
 	struct netlink_callback *cb;
 	struct sk_buff *skb = NULL;
 	struct nlmsghdr *nlh;
+	struct module *module;
 	int len, err = -ENOBUFS;
 	int alloc_min_size;
 	int alloc_size;
@@ -2134,9 +2135,11 @@ static int netlink_dump(struct sock *sk)
 		cb->done(cb);
 
 	nlk->cb_running = false;
+	module = cb->module;
+	skb = cb->skb;
 	mutex_unlock(nlk->cb_mutex);
-	module_put(cb->module);
-	consume_skb(cb->skb);
+	module_put(module);
+	consume_skb(skb);
 	return 0;
 
 errout_skb:
path: net/netlink/af_netlink.c
Vulnerability: Race condition in the netlink_dump function in net/netlink/af_netlink.c in the Linux kernel before 4.6.3 allows local users to cause a denial of service (double free) or possibly have unspecified other impact via a crafted application that makes sendmsg system calls, leading to a free operation associated with a new dump that started earlier than anticipated.
Vulnerability ID: CVE-2016-9806
CWE: CWE-362
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2016-12-28
File: net/netlink/af_netlink.c
Commit message: netlink: Fix dump skb leak/double free

When we free cb->skb after a dump, we do it after releasing the
lock.  This means that a new dump could have started in the time
being and we'll end up freeing their skb instead of ours.

This patch saves the skb and module before we unlock so we free
the right memory.

Fixes: 16b304f3404f ("netlink: Eliminate kmalloc in netlink dump operation.")
Reported-by: Baozeng Ding <sploving1@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Herbert Xu

Vulnerable version (before fix):
 static int netlink_dump(struct sock *sk) 	struct netlink_callback *cb; 	struct sk_buff *skb = NULL; 	struct nlmsghdr *nlh; 	int len, err = -ENOBUFS; 	int alloc_min_size; 	int alloc_size; static int netlink_dump(struct sock *sk) 		cb->done(cb);  	nlk->cb_running = false; 	mutex_unlock(nlk->cb_mutex); 	module_put(cb->module); 	consume_skb(cb->skb); 	return 0;  errout_skb:

Fixed version (after fix):
 static int netlink_dump(struct sock *sk) 	struct netlink_callback *cb; 	struct sk_buff *skb = NULL; 	struct nlmsghdr *nlh; 	struct module *module; 	int len, err = -ENOBUFS; 	int alloc_min_size; 	int alloc_size; static int netlink_dump(struct sock *sk) 		cb->done(cb);  	nlk->cb_running = false; 	module = cb->module; 	skb = cb->skb; 	mutex_unlock(nlk->cb_mutex); 	module_put(module); 	consume_skb(skb); 	return 0;  errout_skb:

Patch:
patch: @@ -2059,6 +2059,7 @@ static int netlink_dump(struct sock *sk)
 	struct netlink_callback *cb;
 	struct sk_buff *skb = NULL;
 	struct nlmsghdr *nlh;
+	struct module *module;
 	int len, err = -ENOBUFS;
 	int alloc_min_size;
 	int alloc_size;
@@ -2134,9 +2135,11 @@ static int netlink_dump(struct sock *sk)
 		cb->done(cb);
 
 	nlk->cb_running = false;
+	module = cb->module;
+	skb = cb->skb;
 	mutex_unlock(nlk->cb_mutex);
-	module_put(cb->module);
-	consume_skb(cb->skb);
+	module_put(module);
+	consume_skb(skb);
 	return 0;
 
 errout_skb:
path: net/netlink/af_netlink.c
Vulnerability: The tcmu-runner daemon in tcmu-runner version 1.0.5 to 1.2.0 is vulnerable to a local denial of service attack
Vulnerability ID: CVE-2017-1000201
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/open-iscsi/tcmu-runner
Published: 2017-11-17
File: main.c
Commit message: fixed local DoS when UnregisterHandler was called for a not existing handler

Any user with DBUS access could cause a SEGFAULT in tcmu-runner by
running something like this:

dbus-send --system --print-reply --dest=org.kernel.TCMUService1 /org/kernel/TCMUService1/HandlerManager1 org.kernel.TCMUService1.HandlerManager1.UnregisterHandler string:123
Commit author: Matthias Gerstner

Vulnerable version (before fix):
 on_unregister_handler(TCMUService1HandlerManager1 *interface, 		      gpointer user_data) { 	struct tcmur_handler *handler = find_handler_by_subtype(subtype); 	struct dbus_info *info = handler->opaque;  	if (!handler) { 		g_dbus_method_invocation_return_value(invocation,

Fixed version (after fix):
 on_unregister_handler(TCMUService1HandlerManager1 *interface, 		      gpointer user_data) { 	struct tcmur_handler *handler = find_handler_by_subtype(subtype); 	struct dbus_info *info = handler ? handler->opaque : NULL;  	if (!handler) { 		g_dbus_method_invocation_return_value(invocation,

Patch:
patch: @@ -386,7 +386,7 @@ on_unregister_handler(TCMUService1HandlerManager1 *interface,
 		      gpointer user_data)
 {
 	struct tcmur_handler *handler = find_handler_by_subtype(subtype);
-	struct dbus_info *info = handler->opaque;
+	struct dbus_info *info = handler ? handler->opaque : NULL;
 
 	if (!handler) {
 		g_dbus_method_invocation_return_value(invocation,
path: main.c
Vulnerability: Cross-site scripting (XSS) vulnerability in Help.aspx in mojoPortal version 2.5.0.0 allows remote attackers to inject arbitrary web script or HTML via the helpkey parameter. Exploitation requires authenticated reflected cross-site scripting for user accounts assigned either the "Administrators" or "Content Administrators" role.
Vulnerability ID: CVE-2017-1000457
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/i7MEDIA/mojoportal
Published: 2018-01-02
File: Web/Help.aspx.cs
Commit message: Fix possible XSS bug in help dialog
Commit author: Elijah Fowler

Vulnerable version (before fix):
 using System; using System.Web.UI; using mojoPortal.Business.WebHelpers; using mojoPortal.Web.Framework; using Resources;  namespace mojoPortal.Web.UI.Pages { protected void ShowHelp() 					Resource.HelpNoHelpAvailable; 			}  			litHelp.Text = helpText; 		} 	} }\ No newline at end of file

Fixed version (after fix):
 using mojoPortal.Business.WebHelpers; using mojoPortal.Web.Framework; using Resources; using System; using System.Web; using System.Web.UI;  namespace mojoPortal.Web.UI.Pages { protected void ShowHelp() 					Resource.HelpNoHelpAvailable; 			}  			litHelp.Text = HttpUtility.HtmlDecode(SecurityHelper.RemoveMarkup(helpText)); 		} 	} }\ No newline at end of file

Patch:
patch: @@ -1,8 +1,9 @@
-using System;
-using System.Web.UI;
 using mojoPortal.Business.WebHelpers;
 using mojoPortal.Web.Framework;
 using Resources;
+using System;
+using System.Web;
+using System.Web.UI;
 
 namespace mojoPortal.Web.UI.Pages
 {
@@ -61,7 +62,7 @@ protected void ShowHelp()
 					Resource.HelpNoHelpAvailable;
 			}
 
-			litHelp.Text = helpText;
+			litHelp.Text = HttpUtility.HtmlDecode(SecurityHelper.RemoveMarkup(helpText));
 		}
 	}
-}
+}
\ No newline at end of file
path: Web/Help.aspx.cs
Vulnerability: Bro before Bro v2.5.2 is vulnerable to an out of bounds write in the ContentLine analyzer allowing remote attackers to cause a denial of service (crash) and possibly other exploitation.
Vulnerability ID: CVE-2017-1000458
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/bro/bro
Published: 2018-01-02
File: src/analyzer/protocol/tcp/ContentLine.cc
Commit message: Patch OOB write in content-line analyzer.

A combination of packets can trigger an out of bound write of '0' byte
in the content-line analyzer.

This bug was found by Frank Meier.

Addresses BIT-1856.
Commit author: Johanna Amann

Vulnerable version (before fix):
 int ContentLine_Analyzer::DoDeliverOnce(int len, const u_char* data) 		case '\n': 			if ( last_char == '\r' ) 				{ 				--offset; // remove '\r' 				EMIT_LINE 				}

Fixed version (after fix):
 int ContentLine_Analyzer::DoDeliverOnce(int len, const u_char* data) 		case '\n': 			if ( last_char == '\r' ) 				{ 				// Weird corner-case: 				// this can happen if we see a \r at the end of a packet where crlf is 				// set to CR_as_EOL | LF_as_EOL, with the packet causing crlf to be set to 				// 0 and the next packet beginning with a \n. In this case we just swallow 				// the character and re-set last_char. 				if ( offset == 0 ) 					{ 					last_char = c; 					break; 					} 				--offset; // remove '\r' 				EMIT_LINE 				}

Patch:
patch: @@ -250,6 +250,16 @@ int ContentLine_Analyzer::DoDeliverOnce(int len, const u_char* data)
 		case '\n':
 			if ( last_char == '\r' )
 				{
+				// Weird corner-case:
+				// this can happen if we see a \r at the end of a packet where crlf is
+				// set to CR_as_EOL | LF_as_EOL, with the packet causing crlf to be set to
+				// 0 and the next packet beginning with a \n. In this case we just swallow
+				// the character and re-set last_char.
+				if ( offset == 0 )
+					{
+					last_char = c;
+					break;
+					}
 				--offset; // remove '\r'
 				EMIT_LINE
 				}
path: src/analyzer/protocol/tcp/ContentLine.cc
Vulnerability: Leanote-desktop version v2.5 is vulnerable to a XSS which leads to code execution due to enabled node integration
Vulnerability ID: CVE-2017-1000492
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/leanote/desktop-app
Published: 2018-01-03
File: public/js/app/note.js
Commit message: Starred notes XXS
Commit author: life

Vulnerable version (before fix):
 Note.renderNote = function(note) {     if (!note) {         return;     }     // title     $("#noteTitle").val(note.Title);      // 当前正在编辑的     // tags Note.renderStars = function(notes) {     me.starNotesO.html('');     for (var i = 0; i < notes.length; ++i) {         var note = notes[i];         var t = tt(me.starItemT, note.NoteId, note.Title || getMsg('Untitled'));         me.starNotesO.append(t);     } 

Fixed version (after fix):
 Note.renderNote = function(note) {     if (!note) {         return;     }     var title = note.Title || '';     title = title.replace(/&lt;/g, '<').replace(/&gt;/g, '>');     // title     $("#noteTitle").val(title);      // 当前正在编辑的     // tags Note.renderStars = function(notes) {     me.starNotesO.html('');     for (var i = 0; i < notes.length; ++i) {         var note = notes[i];         var t = tt(me.starItemT, note.NoteId, trimTitle(note.Title) || getMsg('Untitled'));         me.starNotesO.append(t);     } 

Patch:
patch: @@ -956,8 +956,10 @@ Note.renderNote = function(note) {
     if (!note) {
         return;
     }
+    var title = note.Title || '';
+    title = title.replace(/&lt;/g, '<').replace(/&gt;/g, '>');
     // title
-    $("#noteTitle").val(note.Title);
+    $("#noteTitle").val(title);
 
     // 当前正在编辑的
     // tags
@@ -1997,7 +1999,7 @@ Note.renderStars = function(notes) {
     me.starNotesO.html('');
     for (var i = 0; i < notes.length; ++i) {
         var note = notes[i];
-        var t = tt(me.starItemT, note.NoteId, note.Title || getMsg('Untitled'));
+        var t = tt(me.starItemT, note.NoteId, trimTitle(note.Title) || getMsg('Untitled'));
         me.starNotesO.append(t);
     }
path: public/js/app/note.js
Vulnerability: Heap-based Buffer Overflow in the de_dotdot function in libhttpd.c in sthttpd before 2.27.1 allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a crafted filename.
Vulnerability ID: CVE-2017-10671
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/blueness/sthttpd
Published: 2017-06-29
File: src/libhttpd.c
Commit message: Fix heap buffer overflow in de_dotdot
Commit author: Alexandre Rebert

Vulnerable version (before fix):
 de_dotdot( char* file )     while ( strncmp( file, "./", 2 ) == 0 ) 	(void) memmove( file, file + 2, strlen( file ) - 1 );     while ( ( cp = strstr( file, "/./") ) != (char*) 0 ) 	(void) memmove( cp, cp + 2, strlen( file ) - 1 );      /* Alternate between removing leading ../ and removing xxx/../ */     for (;;)

Fixed version (after fix):
 de_dotdot( char* file )     while ( strncmp( file, "./", 2 ) == 0 ) 	(void) memmove( file, file + 2, strlen( file ) - 1 );     while ( ( cp = strstr( file, "/./") ) != (char*) 0 ) 	(void) memmove( cp, cp + 2, strlen( cp ) - 1 );      /* Alternate between removing leading ../ and removing xxx/../ */     for (;;)

Patch:
patch: @@ -2410,7 +2410,7 @@ de_dotdot( char* file )
     while ( strncmp( file, "./", 2 ) == 0 )
 	(void) memmove( file, file + 2, strlen( file ) - 1 );
     while ( ( cp = strstr( file, "/./") ) != (char*) 0 )
-	(void) memmove( cp, cp + 2, strlen( file ) - 1 );
+	(void) memmove( cp, cp + 2, strlen( cp ) - 1 );
 
     /* Alternate between removing leading ../ and removing xxx/../ */
     for (;;)
path: src/libhttpd.c
Vulnerability: SQL injection vulnerability in the administrative backend in Piwigo through 2.9.1 allows remote users to execute arbitrary SQL commands via the cat_false or cat_true parameter in the comments or status page to cat_options.php.
Vulnerability ID: CVE-2017-10682
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/Piwigo/Piwigo
Published: 2017-06-29
File: admin/cat_options.php
Commit message: check input parameter for cat_options pages

solving https://github.com/Piwigo/Piwigo/issues/724
Commit author: flop25

Vulnerable version (before fix):
     and count($_POST['cat_true']) > 0) {   check_pwg_token();   switch ($_GET['section'])   {     case 'comments' :          and isset($_POST['cat_false'])          and count($_POST['cat_false']) > 0) {   switch ($_GET['section'])   {     case 'comments' :

Fixed version (after fix):
     and count($_POST['cat_true']) > 0) {   check_pwg_token();   check_input_parameter('cat_true', $_POST, true, PATTERN_ID);   switch ($_GET['section'])   {     case 'comments' :          and isset($_POST['cat_false'])          and count($_POST['cat_false']) > 0) {   check_input_parameter('cat_false', $_POST, true, PATTERN_ID);   switch ($_GET['section'])   {     case 'comments' :

Patch:
patch: @@ -44,6 +44,7 @@
     and count($_POST['cat_true']) > 0)
 {
   check_pwg_token();
+  check_input_parameter('cat_true', $_POST, true, PATTERN_ID);
   switch ($_GET['section'])
   {
     case 'comments' :
@@ -82,6 +83,7 @@
          and isset($_POST['cat_false'])
          and count($_POST['cat_false']) > 0)
 {
+  check_input_parameter('cat_false', $_POST, true, PATTERN_ID);
   switch ($_GET['section'])
   {
     case 'comments' :
path: admin/cat_options.php
Vulnerability: The grub_memmove function in shlr/grub/kern/misc.c in radare2 1.5.0 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, possibly related to a read overflow in the grub_disk_read_small_real function in kern/disk.c in GNU GRUB 2.02.
Vulnerability ID: CVE-2017-10929
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/radare/radare2
Published: 2017-07-05
File: shlr/grub/kern/disk.c
Commit message: Fix r2_hbo_grub_memmove ext2 crash
Commit author: pancake

Vulnerable version (before fix):
 grub_disk_read (grub_disk_t disk, grub_disk_addr_t sector,       if (data) 	{ 	  /* Just copy it!  */ 	  if (buf) 	    grub_memcpy (buf, data + pos + real_offset, len); 	  grub_disk_cache_unlock (disk->dev->id, disk->id, start_sector); 	}       else

Fixed version (after fix):
 grub_disk_read (grub_disk_t disk, grub_disk_addr_t sector,       if (data) 	{ 	  /* Just copy it!  */ 	  if (buf) { 	    if (pos + real_offset + len >= size) {               // prevent read overflow               grub_errno = GRUB_ERR_BAD_FS;               return grub_errno; 	    } 	    grub_memcpy (buf, data + pos + real_offset, len);           } 	  grub_disk_cache_unlock (disk->dev->id, disk->id, start_sector); 	}       else

Patch:
patch: @@ -449,8 +449,14 @@ grub_disk_read (grub_disk_t disk, grub_disk_addr_t sector,
       if (data)
 	{
 	  /* Just copy it!  */
-	  if (buf)
+	  if (buf) {
+	    if (pos + real_offset + len >= size) {
+              // prevent read overflow
+              grub_errno = GRUB_ERR_BAD_FS;
+              return grub_errno;
+	    }
 	    grub_memcpy (buf, data + pos + real_offset, len);
+          }
 	  grub_disk_cache_unlock (disk->dev->id, disk->id, start_sector);
 	}
       else
path: shlr/grub/kern/disk.c