rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The Device Model in ACRN through 2.5 has a devicemodel/core/mem.c use-after-free for a freed rb_entry.
Vulnerability ID: CVE-2021-36145
CWE: CWE-416
Severity score: 2.9
Project: https://github.com/projectacrn/acrn-hypervisor
Published: 2021-07-02
File: devicemodel/core/mem.c
Commit message: dm: rb: only free rb_entry when we remove this entry from the rb tree

Only free rb_entry when we remove this entry from the rb tree, otherwise, a
page fault would trigger when next rb itreation would access the freed rb_entry.

Tracked-On: #6056
Signed-off-by: Li Fei1 <fei1.li@intel.com>
Commit author: Li Fei1

Vulnerable version (before fix):
 unregister_mem_int(struct mmio_rb_tree *rbt, struct mem_range *memp) 			/* flush Per-VM cache */ 			if (mmio_hint == entry) 				mmio_hint = NULL; 		} 	} 	pthread_rwlock_unlock(&mmio_rwlock);  	if (entry) 		free(entry);  	return err; } 

Fixed version (after fix):
 unregister_mem_int(struct mmio_rb_tree *rbt, struct mem_range *memp) 			/* flush Per-VM cache */ 			if (mmio_hint == entry) 				mmio_hint = NULL;  			if (entry) 				free(entry); 		} 	} 	pthread_rwlock_unlock(&mmio_rwlock);  	return err; } 

Patch:
patch: @@ -248,13 +248,13 @@ unregister_mem_int(struct mmio_rb_tree *rbt, struct mem_range *memp)
 			/* flush Per-VM cache */
 			if (mmio_hint == entry)
 				mmio_hint = NULL;
+
+			if (entry)
+				free(entry);
 		}
 	}
 	pthread_rwlock_unlock(&mmio_rwlock);
 
-	if (entry)
-		free(entry);
-
 	return err;
 }
path: devicemodel/core/mem.c
Vulnerability: ACRN before 2.5 has a devicemodel/hw/pci/xhci.c NULL Pointer Dereference for a trb pointer.
Vulnerability ID: CVE-2021-36146
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/projectacrn/acrn-hypervisor
Published: 2021-07-02
File: devicemodel/hw/pci/xhci.c
Commit message: DM: xHCI: Check trb pointer before use it

The trb pointer may be NULL when get the address from user space, add
the pointer check before use the trb.

Tracked-On: #6172
Signed-off-by: Liu Long <long.liu@intel.com>
Reviewed-by: Shuo A Liu <shuo.a.liu@intel.com>
Acked-by: Yu Wang <yu1.wang@intel.com>
Commit author: Liu Long

Vulnerable version (before fix):
 pci_xhci_complete_commands(struct pci_xhci_vdev *xdev) 	trb = xdev->opregs.cr_p; 	ccs = xdev->opregs.crcr & XHCI_CRCR_LO_RCS; 	crcr = xdev->opregs.crcr & ~0xF;  	while (1) { 		xdev->opregs.cr_p = trb; pci_xhci_complete_commands(struct pci_xhci_vdev *xdev) 		} 	}  	xdev->opregs.crcr = crcr | (xdev->opregs.crcr & XHCI_CRCR_LO_CA) | ccs; 	xdev->opregs.crcr &= ~XHCI_CRCR_LO_CRR; 	return 0;

Fixed version (after fix):
 pci_xhci_complete_commands(struct pci_xhci_vdev *xdev) 	trb = xdev->opregs.cr_p; 	ccs = xdev->opregs.crcr & XHCI_CRCR_LO_RCS; 	crcr = xdev->opregs.crcr & ~0xF; 	if (!trb) { 		UPRINTF(LDBG, "Get the invalid guest address!\r\n"); 		goto out; 	}  	while (1) { 		xdev->opregs.cr_p = trb; pci_xhci_complete_commands(struct pci_xhci_vdev *xdev) 		} 	}  out: 	xdev->opregs.crcr = crcr | (xdev->opregs.crcr & XHCI_CRCR_LO_CA) | ccs; 	xdev->opregs.crcr &= ~XHCI_CRCR_LO_CRR; 	return 0;

Patch:
patch: @@ -2627,6 +2627,10 @@ pci_xhci_complete_commands(struct pci_xhci_vdev *xdev)
 	trb = xdev->opregs.cr_p;
 	ccs = xdev->opregs.crcr & XHCI_CRCR_LO_RCS;
 	crcr = xdev->opregs.crcr & ~0xF;
+	if (!trb) {
+		UPRINTF(LDBG, "Get the invalid guest address!\r\n");
+		goto out;
+	}
 
 	while (1) {
 		xdev->opregs.cr_p = trb;
@@ -2759,6 +2763,7 @@ pci_xhci_complete_commands(struct pci_xhci_vdev *xdev)
 		}
 	}
 
+out:
 	xdev->opregs.crcr = crcr | (xdev->opregs.crcr & XHCI_CRCR_LO_CA) | ccs;
 	xdev->opregs.crcr &= ~XHCI_CRCR_LO_CRR;
 	return 0;
path: devicemodel/hw/pci/xhci.c
Vulnerability: An issue was discovered in ACRN before 2.5. It allows a devicemodel/hw/pci/virtio/virtio_net.c virtio_net_ping_rxq NULL pointer dereference for vq->used.
Vulnerability ID: CVE-2021-36147
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/projectacrn/acrn-hypervisor
Published: 2021-07-02
File: devicemodel/hw/pci/virtio/virtio_net.c
Commit message: dm: NULL check of vq->used in virtio_net_ping_rxq

Add a check on this place to avoid NULL access issue.

Tracked-On: #6100
Signed-off-by: Jie Deng <jie.deng@intel.com>
Commit author: Jie Deng

Vulnerable version (before fix):
 virtio_net_ping_rxq(void *vdev, struct virtio_vq_info *vq) 	 */ 	if (net->rx_ready == 0) { 		net->rx_ready = 1; 		vq->used->flags |= VRING_USED_F_NO_NOTIFY; 	} } 

Fixed version (after fix):
 virtio_net_ping_rxq(void *vdev, struct virtio_vq_info *vq) 	 */ 	if (net->rx_ready == 0) { 		net->rx_ready = 1; 		if (vq->used != NULL) { 			vq->used->flags |= VRING_USED_F_NO_NOTIFY; 		} 	} } 

Patch:
patch: @@ -490,7 +490,9 @@ virtio_net_ping_rxq(void *vdev, struct virtio_vq_info *vq)
 	 */
 	if (net->rx_ready == 0) {
 		net->rx_ready = 1;
-		vq->used->flags |= VRING_USED_F_NO_NOTIFY;
+		if (vq->used != NULL) {
+			vq->used->flags |= VRING_USED_F_NO_NOTIFY;
+		}
 	}
 }
path: devicemodel/hw/pci/virtio/virtio_net.c
Vulnerability: A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server.
Vulnerability ID: CVE-2021-3671
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/heimdal/heimdal
Published: 2021-10-12
File: kdc/krb5tgs.c
Commit message: kdc: validate sname in TGS-REQ

In tgs_build_reply(), validate the server name in the TGS-REQ is present before
dereferencing.
Commit author: Luke Howard

Vulnerable version (before fix):
 tgs_build_reply(astgs_request_t priv,  	s = &adtkt.cname; 	r = adtkt.crealm;     }      _krb5_principalname2krb5_principal(context, &sp, *s, r);

Fixed version (after fix):
 tgs_build_reply(astgs_request_t priv,  	s = &adtkt.cname; 	r = adtkt.crealm;     } else if (s == NULL) { 	ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN; 	_kdc_set_e_text(r, "No server in request"); 	goto out;     }      _krb5_principalname2krb5_principal(context, &sp, *s, r);

Patch:
patch: @@ -1699,6 +1699,10 @@ tgs_build_reply(astgs_request_t priv,
 
 	s = &adtkt.cname;
 	r = adtkt.crealm;
+    } else if (s == NULL) {
+	ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
+	_kdc_set_e_text(r, "No server in request");
+	goto out;
     }
 
     _krb5_principalname2krb5_principal(context, &sp, *s, r);
path: kdc/krb5tgs.c
Vulnerability: A flaw was found in the "Routing decision" classifier in the Linux kernel's Traffic Control networking subsystem in the way it handled changing of classification filters, leading to a use-after-free condition. This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Vulnerability ID: CVE-2021-3715
CWE: CWE-416
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2022-03-02
File: net/sched/cls_route.c
Commit message: net_sched: cls_route: remove the right filter from hashtable

route4_change() allocates a new filter and copies values from
the old one. After the new filter is inserted into the hash
table, the old filter should be removed and freed, as the final
step of the update.

However, the current code mistakenly removes the new one. This
looks apparently wrong to me, and it causes double "free" and
use-after-free too, as reported by syzbot.

Reported-and-tested-by: syzbot+f9b32aaacd60305d9687@syzkaller.appspotmail.com
Reported-and-tested-by: syzbot+2f8c233f131943d6056d@syzkaller.appspotmail.com
Reported-and-tested-by: syzbot+9c2df9fd5e9445b74e01@syzkaller.appspotmail.com
Fixes: 1109c00547fc ("net: sched: RCU cls_route")
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Cc: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Cong Wang

Vulnerable version (before fix):
 static int route4_change(struct net *net, struct sk_buff *in_skb, 			fp = &b->ht[h]; 			for (pfp = rtnl_dereference(*fp); pfp; 			     fp = &pfp->next, pfp = rtnl_dereference(*fp)) { 				if (pfp == f) { 					*fp = f->next; 					break; 				} 			}

Fixed version (after fix):
 static int route4_change(struct net *net, struct sk_buff *in_skb, 			fp = &b->ht[h]; 			for (pfp = rtnl_dereference(*fp); pfp; 			     fp = &pfp->next, pfp = rtnl_dereference(*fp)) { 				if (pfp == fold) { 					rcu_assign_pointer(*fp, fold->next); 					break; 				} 			}

Patch:
patch: @@ -534,8 +534,8 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
 			fp = &b->ht[h];
 			for (pfp = rtnl_dereference(*fp); pfp;
 			     fp = &pfp->next, pfp = rtnl_dereference(*fp)) {
-				if (pfp == f) {
-					*fp = f->next;
+				if (pfp == fold) {
+					rcu_assign_pointer(*fp, fold->next);
 					break;
 				}
 			}
path: net/sched/cls_route.c
Vulnerability: A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/social/search.php, main/inc/lib/social.lib.php and steal cookies or execute arbitrary code on the administration side via a stored XSS vulnerability via social network the send invitation feature.
Vulnerability ID: CVE-2021-37391
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/chamilo/chamilo-lms
Published: 2021-08-10
File: main/inc/lib/social.lib.php
Commit message: Security: Add script tags filter for users invitations in social network
Commit author: Yannick Warnier

Vulnerable version (before fix):
 public static function sendInvitationToUser($userId, $subject = '', $content = '         $user_info = api_get_user_info($userId);         $success = get_lang('MessageSentTo');         $success .= ' : '.api_get_person_name($user_info['firstName'], $user_info['lastName']);          if (isset($subject) && isset($content) && isset($userId)) {             $result = MessageManager::send_message($userId, $subject, $content);

Fixed version (after fix):
 public static function sendInvitationToUser($userId, $subject = '', $content = '         $user_info = api_get_user_info($userId);         $success = get_lang('MessageSentTo');         $success .= ' : '.api_get_person_name($user_info['firstName'], $user_info['lastName']);         $content = strip_tags($content);          if (isset($subject) && isset($content) && isset($userId)) {             $result = MessageManager::send_message($userId, $subject, $content);

Patch:
patch: @@ -662,6 +662,7 @@ public static function sendInvitationToUser($userId, $subject = '', $content = '
         $user_info = api_get_user_info($userId);
         $success = get_lang('MessageSentTo');
         $success .= ' : '.api_get_person_name($user_info['firstName'], $user_info['lastName']);
+        $content = strip_tags($content);
 
         if (isset($subject) && isset($content) && isset($userId)) {
             $result = MessageManager::send_message($userId, $subject, $content);
path: main/inc/lib/social.lib.php
Vulnerability: An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sanity check allows a local attacker to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability.
Vulnerability ID: CVE-2021-3743
CWE: CWE-125
Severity score: 4.9
Project: https://github.com/torvalds/linux
Published: 2022-03-04
File: net/qrtr/qrtr.c
Commit message: net: qrtr: fix another OOB Read in qrtr_endpoint_post

This check was incomplete, did not consider size is 0:

	if (len != ALIGN(size, 4) + hdrlen)
                    goto err;

if size from qrtr_hdr is 0, the result of ALIGN(size, 4)
will be 0, In case of len == hdrlen and size == 0
in header this check won't fail and

	if (cb->type == QRTR_TYPE_NEW_SERVER) {
                /* Remote node endpoint can bridge other distant nodes */
                const struct qrtr_ctrl_pkt *pkt = data + hdrlen;

                qrtr_node_assign(node, le32_to_cpu(pkt->server.node));
        }

will also read out of bound from data, which is hdrlen allocated block.

Fixes: 194ccc88297a ("net: qrtr: Support decoding incoming v2 packets")
Fixes: ad9d24c9429e ("net: qrtr: fix OOB Read in qrtr_endpoint_post")
Signed-off-by: Xiaolong Huang <butterflyhuangxx@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Xiaolong Huang

Vulnerable version (before fix):
 int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len) 		goto err; 	}  	if (len != ALIGN(size, 4) + hdrlen) 		goto err;  	if (cb->dst_port != QRTR_PORT_CTRL && cb->type != QRTR_TYPE_DATA &&

Fixed version (after fix):
 int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len) 		goto err; 	}  	if (!size || len != ALIGN(size, 4) + hdrlen) 		goto err;  	if (cb->dst_port != QRTR_PORT_CTRL && cb->type != QRTR_TYPE_DATA &&

Patch:
patch: @@ -493,7 +493,7 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len)
 		goto err;
 	}
 
-	if (len != ALIGN(size, 4) + hdrlen)
+	if (!size || len != ALIGN(size, 4) + hdrlen)
 		goto err;
 
 	if (cb->dst_port != QRTR_PORT_CTRL && cb->type != QRTR_TYPE_DATA &&
path: net/qrtr/qrtr.c
Vulnerability: libmobi is vulnerable to Out-of-bounds Write
Vulnerability ID: CVE-2021-3751
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/bfabiszewski/libmobi
Published: 2021-09-15
File: src/buffer.c
Commit message: fix oob write bug inside libmobi
Commit author: Cen Zhang

Vulnerable version (before fix):
 void mobi_buffer_move(MOBIBuffer *buf, const int offset, const size_t len) {         }         source += aoffset;     } else {         if (buf->offset < aoffset) {             debug_print("%s", "End of buffer\n");             buf->error = MOBI_BUFFER_END;             return;         }

Fixed version (after fix):
 void mobi_buffer_move(MOBIBuffer *buf, const int offset, const size_t len) {         }         source += aoffset;     } else {         if ( (buf->offset < aoffset) || (buf->offset + len > buf->maxlen) ) {             debug_print("%s", "Beyond start/end of buffer\n");             buf->error = MOBI_BUFFER_END;             return;         }

Patch:
patch: @@ -510,8 +510,8 @@ void mobi_buffer_move(MOBIBuffer *buf, const int offset, const size_t len) {
         }
         source += aoffset;
     } else {
-        if (buf->offset < aoffset) {
-            debug_print("%s", "End of buffer\n");
+        if ( (buf->offset < aoffset) || (buf->offset + len > buf->maxlen) ) {
+            debug_print("%s", "Beyond start/end of buffer\n");
             buf->error = MOBI_BUFFER_END;
             return;
         }
path: src/buffer.c
Vulnerability: Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.26 allows remote unauthenticated users to inject arbitrary web script or HTML via an unsanitized "path" parameter in resources/login.php.
Vulnerability ID: CVE-2021-37524
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/fusionpbx/fusionpbx
Published: 2022-07-01
File: resources/login.php
Commit message: Fix XSS on login page by removing $_REQUEST[path]
Commit author: markjcrane

Vulnerable version (before fix):
 //set variable if not set 	if (!isset($_SESSION['login']['domain_name_visible']['boolean'])) { $_SESSION['login']['domain_name_visible']['boolean'] = null; }  //set the requested destination after login 	if (!empty($_REQUEST['path'])) { 		$_SESSION['login']['destination']['url'] = $_REQUEST['path']; 	}  //set a default login destination 	if (strlen($_SESSION['login']['destination']['url']) == 0) { 		$_SESSION['login']['destination']['url'] = PROJECT_PATH."/core/user_settings/user_dashboard.php";

Fixed version (after fix):
 //set variable if not set 	if (!isset($_SESSION['login']['domain_name_visible']['boolean'])) { $_SESSION['login']['domain_name_visible']['boolean'] = null; }  //set a default login destination 	if (strlen($_SESSION['login']['destination']['url']) == 0) { 		$_SESSION['login']['destination']['url'] = PROJECT_PATH."/core/user_settings/user_dashboard.php";

Patch:
patch: @@ -242,11 +242,6 @@
 //set variable if not set
 	if (!isset($_SESSION['login']['domain_name_visible']['boolean'])) { $_SESSION['login']['domain_name_visible']['boolean'] = null; }
 
-//set the requested destination after login
-	if (!empty($_REQUEST['path'])) {
-		$_SESSION['login']['destination']['url'] = $_REQUEST['path'];
-	}
-
 //set a default login destination
 	if (strlen($_SESSION['login']['destination']['url']) == 0) {
 		$_SESSION['login']['destination']['url'] = PROJECT_PATH."/core/user_settings/user_dashboard.php";
path: resources/login.php
Vulnerability: libmysofa is vulnerable to Heap-based Buffer Overflow
Vulnerability ID: CVE-2021-3756
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/hoene/libmysofa
Published: 2021-10-29
File: src/hdf/dataobject.c
Commit message: Fix for issue 163
Commit author: Christian Hoene

Vulnerable version (before fix):
 static int readOHDRHeaderMessageDataLayout(struct READER *reader,       store = ftell(reader->fhd);       if (fseek(reader->fhd, data_address, SEEK_SET) < 0)         return errno; // LCOV_EXCL_LINE       if (!data->data) {         if (data_size > 0x10000000)           return MYSOFA_INVALID_FORMAT;         data->data_len = data_size;         data->data = calloc(1, data_size);         if (!data->data)           return MYSOFA_NO_MEMORY; // LCOV_EXCL_LINE       }       err = fread(data->data, 1, data_size, reader->fhd);       if (err != data_size)         return MYSOFA_READ_ERROR; // LCOV_EXCL_LINE

Fixed version (after fix):
 static int readOHDRHeaderMessageDataLayout(struct READER *reader,       store = ftell(reader->fhd);       if (fseek(reader->fhd, data_address, SEEK_SET) < 0)         return errno; // LCOV_EXCL_LINE       if (data->data) {         free(data->data);         data->data = NULL;       }       if (data_size > 0x10000000)         return MYSOFA_INVALID_FORMAT;       data->data_len = data_size;       data->data = calloc(1, data_size);       if (!data->data)         return MYSOFA_NO_MEMORY; // LCOV_EXCL_LINE        err = fread(data->data, 1, data_size, reader->fhd);       if (err != data_size)         return MYSOFA_READ_ERROR; // LCOV_EXCL_LINE

Patch:
patch: @@ -500,14 +500,17 @@ static int readOHDRHeaderMessageDataLayout(struct READER *reader,
       store = ftell(reader->fhd);
       if (fseek(reader->fhd, data_address, SEEK_SET) < 0)
         return errno; // LCOV_EXCL_LINE
-      if (!data->data) {
-        if (data_size > 0x10000000)
-          return MYSOFA_INVALID_FORMAT;
-        data->data_len = data_size;
-        data->data = calloc(1, data_size);
-        if (!data->data)
-          return MYSOFA_NO_MEMORY; // LCOV_EXCL_LINE
+      if (data->data) {
+        free(data->data);
+        data->data = NULL;
       }
+      if (data_size > 0x10000000)
+        return MYSOFA_INVALID_FORMAT;
+      data->data_len = data_size;
+      data->data = calloc(1, data_size);
+      if (!data->data)
+        return MYSOFA_NO_MEMORY; // LCOV_EXCL_LINE
+
       err = fread(data->data, 1, data_size, reader->fhd);
       if (err != data_size)
         return MYSOFA_READ_ERROR; // LCOV_EXCL_LINE
path: src/hdf/dataobject.c
Vulnerability: In FreeRDP before 2.4.0 on Windows, wf_cliprdr_server_file_contents_request in client/Windows/wf_cliprdr.c has missing input checks for a FILECONTENTS_SIZE File Contents Request PDU.
Vulnerability ID: CVE-2021-37594
CWE: CWE-20
Severity score: 6.4
Project: https://github.com/FreeRDP/FreeRDP
Published: 2021-07-30
File: client/Windows/wf_cliprdr.c
Commit message: Fixed missing input checks for file contents request

reported by Valentino Ricotta (Thalium)
Commit author: Armin Novak

Vulnerable version (before fix):
 wf_cliprdr_server_file_contents_request(CliprdrClientContext* context, 	{ 		if (fileContentsRequest->dwFlags == FILECONTENTS_SIZE) 		{ 			*((UINT32*)&pData[0]) = 			    clipboard->fileDescriptor[fileContentsRequest->listIndex]->nFileSizeLow; 			*((UINT32*)&pData[4]) = wf_cliprdr_server_file_contents_request(CliprdrClientContext* context, 		else if (fileContentsRequest->dwFlags == FILECONTENTS_RANGE) 		{ 			BOOL bRet; 			bRet = wf_cliprdr_get_file_contents( 			    clipboard->file_names[fileContentsRequest->listIndex], pData, 			    fileContentsRequest->nPositionLow, fileContentsRequest->nPositionHigh, cbRequested,

Fixed version (after fix):
 wf_cliprdr_server_file_contents_request(CliprdrClientContext* context, 	{ 		if (fileContentsRequest->dwFlags == FILECONTENTS_SIZE) 		{ 			if (clipboard->nFiles <= fileContentsRequest->listIndex) 				goto error; 			*((UINT32*)&pData[0]) = 			    clipboard->fileDescriptor[fileContentsRequest->listIndex]->nFileSizeLow; 			*((UINT32*)&pData[4]) = wf_cliprdr_server_file_contents_request(CliprdrClientContext* context, 		else if (fileContentsRequest->dwFlags == FILECONTENTS_RANGE) 		{ 			BOOL bRet; 			if (clipboard->nFiles <= fileContentsRequest->listIndex) 				goto error; 			bRet = wf_cliprdr_get_file_contents( 			    clipboard->file_names[fileContentsRequest->listIndex], pData, 			    fileContentsRequest->nPositionLow, fileContentsRequest->nPositionHigh, cbRequested,

Patch:
patch: @@ -2363,6 +2363,8 @@ wf_cliprdr_server_file_contents_request(CliprdrClientContext* context,
 	{
 		if (fileContentsRequest->dwFlags == FILECONTENTS_SIZE)
 		{
+			if (clipboard->nFiles <= fileContentsRequest->listIndex)
+				goto error;
 			*((UINT32*)&pData[0]) =
 			    clipboard->fileDescriptor[fileContentsRequest->listIndex]->nFileSizeLow;
 			*((UINT32*)&pData[4]) =
@@ -2372,6 +2374,8 @@ wf_cliprdr_server_file_contents_request(CliprdrClientContext* context,
 		else if (fileContentsRequest->dwFlags == FILECONTENTS_RANGE)
 		{
 			BOOL bRet;
+			if (clipboard->nFiles <= fileContentsRequest->listIndex)
+				goto error;
 			bRet = wf_cliprdr_get_file_contents(
 			    clipboard->file_names[fileContentsRequest->listIndex], pData,
 			    fileContentsRequest->nPositionLow, fileContentsRequest->nPositionHigh, cbRequested,
path: client/Windows/wf_cliprdr.c
Vulnerability: ** DISPUTED ** An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments.
Vulnerability ID: CVE-2021-37600
CWE: CWE-190
Severity score: 2.9
Project: https://github.com/karelzak/util-linux
Published: 2021-07-30
File: sys-utils/ipcutils.c
Commit message: sys-utils/ipcutils: be careful when call calloc() for uint64 nmembs

Fix: https://github.com/karelzak/util-linux/issues/1395
Signed-off-by: Karel Zak <kzak@redhat.com>
Commit author: Karel Zak

Vulnerable version (before fix):
 static void get_sem_elements(struct sem_data *p) { 	size_t i;  	if (!p || !p->sem_nsems || p->sem_perm.id < 0) 		return;  	p->elements = xcalloc(p->sem_nsems, sizeof(struct sem_elem));

Fixed version (after fix):
 static void get_sem_elements(struct sem_data *p) { 	size_t i;  	if (!p || !p->sem_nsems || p->sem_nsems > SIZE_MAX || p->sem_perm.id < 0) 		return;  	p->elements = xcalloc(p->sem_nsems, sizeof(struct sem_elem));

Patch:
patch: @@ -218,7 +218,7 @@ static void get_sem_elements(struct sem_data *p)
 {
 	size_t i;
 
-	if (!p || !p->sem_nsems || p->sem_perm.id < 0)
+	if (!p || !p->sem_nsems || p->sem_nsems > SIZE_MAX || p->sem_perm.id < 0)
 		return;
 
 	p->elements = xcalloc(p->sem_nsems, sizeof(struct sem_elem));
path: sys-utils/ipcutils.c