rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The kvm_set_msr_common function in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 does not ensure a required time_page alignment during an MSR_KVM_SYSTEM_TIME operation, which allows guest OS users to cause a denial of service (buffer overflow and host OS memory corruption) or possibly have unspecified other impact via a crafted application.
Vulnerability ID: CVE-2013-1796
CWE: CWE-119
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2013-03-22
File: arch/x86/kvm/x86.c
Commit message: KVM: x86: fix for buffer overflow in handling of MSR_KVM_SYSTEM_TIME (CVE-2013-1796)

If the guest sets the GPA of the time_page so that the request to update the
time straddles a page then KVM will write onto an incorrect page.  The
write is done byusing kmap atomic to get a pointer to the page for the time
structure and then performing a memcpy to that page starting at an offset
that the guest controls.  Well behaved guests always provide a 32-byte aligned
address, however a malicious guest could use this to corrupt host kernel
memory.

Tested: Tested against kvmclock unit test.

Signed-off-by: Andrew Honig <ahonig@google.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Commit author: Andy Honig

Vulnerable version (before fix):
 int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) 		/* ...but clean it before doing the actual write */ 		vcpu->arch.time_offset = data & ~(PAGE_MASK | 1);  		vcpu->arch.time_page = 				gfn_to_page(vcpu->kvm, data >> PAGE_SHIFT); 

Fixed version (after fix):
 int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) 		/* ...but clean it before doing the actual write */ 		vcpu->arch.time_offset = data & ~(PAGE_MASK | 1);  		/* Check that the address is 32-byte aligned. */ 		if (vcpu->arch.time_offset & 				(sizeof(struct pvclock_vcpu_time_info) - 1)) 			break;  		vcpu->arch.time_page = 				gfn_to_page(vcpu->kvm, data >> PAGE_SHIFT); 

Patch:
patch: @@ -1959,6 +1959,11 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 		/* ...but clean it before doing the actual write */
 		vcpu->arch.time_offset = data & ~(PAGE_MASK | 1);
 
+		/* Check that the address is 32-byte aligned. */
+		if (vcpu->arch.time_offset &
+				(sizeof(struct pvclock_vcpu_time_info) - 1))
+			break;
+
 		vcpu->arch.time_page =
 				gfn_to_page(vcpu->kvm, data >> PAGE_SHIFT);
path: arch/x86/kvm/x86.c
Vulnerability: The ioapic_read_indirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPIC_REG_SELECT and IOAPIC_REG_WINDOW operations, which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of service (host OS OOPS) via a crafted application.
Vulnerability ID: CVE-2013-1798
CWE: CWE-20
Severity score: 9.2
Project: https://github.com/torvalds/linux
Published: 2013-03-22
File: virt/kvm/ioapic.c
Commit message: KVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798)

If the guest specifies a IOAPIC_REG_SELECT with an invalid value and follows
that with a read of the IOAPIC_REG_WINDOW KVM does not properly validate
that request.  ioapic_read_indirect contains an
ASSERT(redir_index < IOAPIC_NUM_PINS), but the ASSERT has no effect in
non-debug builds.  In recent kernels this allows a guest to cause a kernel
oops by reading invalid memory.  In older kernels (pre-3.3) this allows a
guest to read from large ranges of host memory.

Tested: tested against apic unit tests.

Signed-off-by: Andrew Honig <ahonig@google.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Commit author: Andy Honig

Vulnerable version (before fix):
 static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic, 			u32 redir_index = (ioapic->ioregsel - 0x10) >> 1; 			u64 redir_content;  			ASSERT(redir_index < IOAPIC_NUM_PINS);  			redir_content = ioapic->redirtbl[redir_index].bits; 			result = (ioapic->ioregsel & 0x1) ? 			    (redir_content >> 32) & 0xffffffff : 			    redir_content & 0xffffffff;

Fixed version (after fix):
 static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic, 			u32 redir_index = (ioapic->ioregsel - 0x10) >> 1; 			u64 redir_content;  			if (redir_index < IOAPIC_NUM_PINS) 				redir_content = 					ioapic->redirtbl[redir_index].bits; 			else 				redir_content = ~0ULL;  			result = (ioapic->ioregsel & 0x1) ? 			    (redir_content >> 32) & 0xffffffff : 			    redir_content & 0xffffffff;

Patch:
patch: @@ -74,9 +74,12 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
 			u32 redir_index = (ioapic->ioregsel - 0x10) >> 1;
 			u64 redir_content;
 
-			ASSERT(redir_index < IOAPIC_NUM_PINS);
+			if (redir_index < IOAPIC_NUM_PINS)
+				redir_content =
+					ioapic->redirtbl[redir_index].bits;
+			else
+				redir_content = ~0ULL;
 
-			redir_content = ioapic->redirtbl[redir_index].bits;
 			result = (ioapic->ioregsel & 0x1) ?
 			    (redir_content >> 32) & 0xffffffff :
 			    redir_content & 0xffffffff;
path: virt/kvm/ioapic.c
Vulnerability: The sctp_getsockopt_assoc_stats function in net/sctp/socket.c in the Linux kernel before 3.8.4 does not validate a size value before proceeding to a copy_from_user operation, which allows local users to gain privileges via a crafted application that contains an SCTP_GET_ASSOC_STATS getsockopt system call.
Vulnerability ID: CVE-2013-1828
CWE: CWE-20
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2013-03-22
File: net/sctp/socket.c
Commit message: net/sctp: Validate parameter size for SCTP_GET_ASSOC_STATS

Building sctp may fail with:

In function ‘copy_from_user’,
    inlined from ‘sctp_getsockopt_assoc_stats’ at
    net/sctp/socket.c:5656:20:
arch/x86/include/asm/uaccess_32.h:211:26: error: call to
    ‘copy_from_user_overflow’ declared with attribute error: copy_from_user()
    buffer size is not provably correct

if built with W=1 due to a missing parameter size validation
before the call to copy_from_user.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Guenter Roeck

Vulnerable version (before fix):
 static int sctp_getsockopt_assoc_stats(struct sock *sk, int len, 	if (len < sizeof(sctp_assoc_t)) 		return -EINVAL;  	if (copy_from_user(&sas, optval, len)) 		return -EFAULT;  static int sctp_getsockopt_assoc_stats(struct sock *sk, int len, 	/* Mark beginning of a new observation period */ 	asoc->stats.max_obs_rto = asoc->rto_min;  	/* Allow the struct to grow and fill in as much as possible */ 	len = min_t(size_t, len, sizeof(sas));  	if (put_user(len, optlen)) 		return -EFAULT; 

Fixed version (after fix):
 static int sctp_getsockopt_assoc_stats(struct sock *sk, int len, 	if (len < sizeof(sctp_assoc_t)) 		return -EINVAL;  	/* Allow the struct to grow and fill in as much as possible */ 	len = min_t(size_t, len, sizeof(sas));  	if (copy_from_user(&sas, optval, len)) 		return -EFAULT;  static int sctp_getsockopt_assoc_stats(struct sock *sk, int len, 	/* Mark beginning of a new observation period */ 	asoc->stats.max_obs_rto = asoc->rto_min;  	if (put_user(len, optlen)) 		return -EFAULT; 

Patch:
patch: @@ -5653,6 +5653,9 @@ static int sctp_getsockopt_assoc_stats(struct sock *sk, int len,
 	if (len < sizeof(sctp_assoc_t))
 		return -EINVAL;
 
+	/* Allow the struct to grow and fill in as much as possible */
+	len = min_t(size_t, len, sizeof(sas));
+
 	if (copy_from_user(&sas, optval, len))
 		return -EFAULT;
 
@@ -5686,9 +5689,6 @@ static int sctp_getsockopt_assoc_stats(struct sock *sk, int len,
 	/* Mark beginning of a new observation period */
 	asoc->stats.max_obs_rto = asoc->rto_min;
 
-	/* Allow the struct to grow and fill in as much as possible */
-	len = min_t(size_t, len, sizeof(sas));
-
 	if (put_user(len, optlen))
 		return -EFAULT;
path: net/sctp/socket.c
Vulnerability: fs/ext3/super.c in the Linux kernel before 3.8.4 uses incorrect arguments to functions in certain circumstances related to printk input, which allows local users to conduct format-string attacks and possibly gain privileges via a crafted application.
Vulnerability ID: CVE-2013-1848
CWE: CWE-20
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2013-03-22
File: fs/ext3/super.c
Commit message: ext3: Fix format string issues

ext3_msg() takes the printk prefix as the second parameter and the
format string as the third parameter. Two callers of ext3_msg omit the
prefix and pass the format string as the second parameter and the first
parameter to the format string as the third parameter. In both cases
this string comes from an arbitrary source. Which means the string may
contain format string characters, which will
lead to undefined and potentially harmful behavior.

The issue was introduced in commit 4cf46b67eb("ext3: Unify log messages
in ext3") and is fixed by this patch.

CC: stable@vger.kernel.org
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jan Kara <jack@suse.cz>
Commit author: Lars-Peter Clausen

Vulnerable version (before fix):
 static struct block_device *ext3_blkdev_get(dev_t dev, struct super_block *sb) 	return bdev;  fail: 	ext3_msg(sb, "error: failed to open journal device %s: %ld", 		__bdevname(dev, b), PTR_ERR(bdev));  	return NULL; static ext3_fsblk_t get_sb_block(void **data, struct super_block *sb) 	/*todo: use simple_strtoll with >32bit ext3 */ 	sb_block = simple_strtoul(options, &options, 0); 	if (*options && *options != ',') { 		ext3_msg(sb, "error: invalid sb specification: %s", 		       (char *) *data); 		return 1; 	}

Fixed version (after fix):
 static struct block_device *ext3_blkdev_get(dev_t dev, struct super_block *sb) 	return bdev;  fail: 	ext3_msg(sb, KERN_ERR, "error: failed to open journal device %s: %ld", 		__bdevname(dev, b), PTR_ERR(bdev));  	return NULL; static ext3_fsblk_t get_sb_block(void **data, struct super_block *sb) 	/*todo: use simple_strtoll with >32bit ext3 */ 	sb_block = simple_strtoul(options, &options, 0); 	if (*options && *options != ',') { 		ext3_msg(sb, KERN_ERR, "error: invalid sb specification: %s", 		       (char *) *data); 		return 1; 	}

Patch:
patch: @@ -353,7 +353,7 @@ static struct block_device *ext3_blkdev_get(dev_t dev, struct super_block *sb)
 	return bdev;
 
 fail:
-	ext3_msg(sb, "error: failed to open journal device %s: %ld",
+	ext3_msg(sb, KERN_ERR, "error: failed to open journal device %s: %ld",
 		__bdevname(dev, b), PTR_ERR(bdev));
 
 	return NULL;
@@ -887,7 +887,7 @@ static ext3_fsblk_t get_sb_block(void **data, struct super_block *sb)
 	/*todo: use simple_strtoll with >32bit ext3 */
 	sb_block = simple_strtoul(options, &options, 0);
 	if (*options && *options != ',') {
-		ext3_msg(sb, "error: invalid sb specification: %s",
+		ext3_msg(sb, KERN_ERR, "error: invalid sb specification: %s",
 		       (char *) *data);
 		return 1;
 	}
path: fs/ext3/super.c
Vulnerability: Mantis Bug Tracker (aka MantisBT) 1.2.12 before 1.2.15 allows remote attackers to cause a denial of service (resource consumption) via a filter using a criteria, text search, and the "any condition" match type.
Vulnerability ID: CVE-2013-1883
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/mantisbt/mantisbt
Published: 2014-05-27
File: core/filter_api.php
Commit message: Fix filter api issue with 'any condition' and text search

A filter combining some criteria and a text search with 'any condition'
results in a cartesian product, which has the potential to bring down
the site as the RDBMS eats up all available resources.

The root cause of this behavior is joining the bug_text table with a
from clause and setting the join's criteria in the query's where clause,
without taking consideration the operator's precedence (AND/OR).

This commit resolves the problem by using a JOIN clause instead, which
makes the query cleaner.

Fixes #15573
Commit author: Damien Regad

Vulnerable version (before fix):
 function filter_get_bug_rows( &$p_page_number, &$p_per_page, &$p_page_count, &$p  		# add text query elements to arrays 		if ( !$t_first ) { 			$t_from_clauses[] = "$t_bug_text_table"; 			$t_where_clauses[] = "$t_bug_table.bug_text_id = $t_bug_text_table.id"; 			$t_where_clauses[] = $t_textsearch_where_clause; 			$t_join_clauses[] = " LEFT JOIN $t_bugnote_table ON $t_bug_table.id = $t_bugnote_table.bug_id"; 			$t_join_clauses[] = " LEFT JOIN $t_bugnote_text_table ON $t_bugnote_table.bugnote_text_id = $t_bugnote_text_table.id"; 		} 	} 

Fixed version (after fix):
 function filter_get_bug_rows( &$p_page_number, &$p_per_page, &$p_page_count, &$p  		# add text query elements to arrays 		if ( !$t_first ) { 			$t_join_clauses[] = "JOIN $t_bug_text_table ON $t_bug_table.bug_text_id = $t_bug_text_table.id"; 			$t_join_clauses[] = "LEFT JOIN $t_bugnote_table ON $t_bug_table.id = $t_bugnote_table.bug_id"; 			$t_join_clauses[] = "LEFT JOIN $t_bugnote_text_table ON $t_bugnote_table.bugnote_text_id = $t_bugnote_text_table.id"; 			$t_where_clauses[] = $t_textsearch_where_clause; 		} 	} 

Patch:
patch: @@ -1995,11 +1995,10 @@ function filter_get_bug_rows( &$p_page_number, &$p_per_page, &$p_page_count, &$p
 
 		# add text query elements to arrays
 		if ( !$t_first ) {
-			$t_from_clauses[] = "$t_bug_text_table";
-			$t_where_clauses[] = "$t_bug_table.bug_text_id = $t_bug_text_table.id";
+			$t_join_clauses[] = "JOIN $t_bug_text_table ON $t_bug_table.bug_text_id = $t_bug_text_table.id";
+			$t_join_clauses[] = "LEFT JOIN $t_bugnote_table ON $t_bug_table.id = $t_bugnote_table.bug_id";
+			$t_join_clauses[] = "LEFT JOIN $t_bugnote_text_table ON $t_bugnote_table.bugnote_text_id = $t_bugnote_text_table.id";
 			$t_where_clauses[] = $t_textsearch_where_clause;
-			$t_join_clauses[] = " LEFT JOIN $t_bugnote_table ON $t_bug_table.id = $t_bugnote_table.bug_id";
-			$t_join_clauses[] = " LEFT JOIN $t_bugnote_text_table ON $t_bugnote_table.bugnote_text_id = $t_bugnote_text_table.id";
 		}
 	}
path: core/filter_api.php
Vulnerability: The do_video_set_spu_palette function in fs/compat_ioctl.c in the Linux kernel before 3.6.5 on unspecified architectures lacks a certain error check, which might allow local users to obtain sensitive information from kernel stack memory via a crafted VIDEO_SET_SPU_PALETTE ioctl call on a /dev/dvb device.
Vulnerability ID: CVE-2013-1928
CWE: CWE-200
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-04-29
File: fs/compat_ioctl.c
Commit message: fs/compat_ioctl.c: VIDEO_SET_SPU_PALETTE missing error check

The compat ioctl for VIDEO_SET_SPU_PALETTE was missing an error check
while converting ioctl arguments.  This could lead to leaking kernel
stack contents into userspace.

Patch extracted from existing fix in grsecurity.

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: David Miller <davem@davemloft.net>
Cc: Brad Spengler <spender@grsecurity.net>
Cc: PaX Team <pageexec@freemail.hu>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Kees Cook

Vulnerable version (before fix):
 static int do_video_set_spu_palette(unsigned int fd, unsigned int cmd,  	err  = get_user(palp, &up->palette); 	err |= get_user(length, &up->length);  	up_native = compat_alloc_user_space(sizeof(struct video_spu_palette)); 	err  = put_user(compat_ptr(palp), &up_native->palette);

Fixed version (after fix):
 static int do_video_set_spu_palette(unsigned int fd, unsigned int cmd,  	err  = get_user(palp, &up->palette); 	err |= get_user(length, &up->length); 	if (err) 		return -EFAULT;  	up_native = compat_alloc_user_space(sizeof(struct video_spu_palette)); 	err  = put_user(compat_ptr(palp), &up_native->palette);

Patch:
patch: @@ -210,6 +210,8 @@ static int do_video_set_spu_palette(unsigned int fd, unsigned int cmd,
 
 	err  = get_user(palp, &up->palette);
 	err |= get_user(length, &up->length);
+	if (err)
+		return -EFAULT;
 
 	up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
 	err  = put_user(compat_ptr(palp), &up_native->palette);
path: fs/compat_ioctl.c
Vulnerability: Heap-based buffer overflow in the tg3_read_vpd function in drivers/net/ethernet/broadcom/tg3.c in the Linux kernel before 3.8.6 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via crafted firmware that specifies a long string in the Vital Product Data (VPD) data structure.
Vulnerability ID: CVE-2013-1929
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2013-06-07
File: drivers/net/ethernet/broadcom/tg3.c
Commit message: tg3: fix length overflow in VPD firmware parsing

Commit 184b89044fb6e2a74611dafa69b1dce0d98612c6 ("tg3: Use VPD fw version
when present") introduced VPD parsing that contained a potential length
overflow.

Limit the hardware's reported firmware string length (max 255 bytes) to
stay inside the driver's firmware string length (32 bytes). On overflow,
truncate the formatted firmware string instead of potentially overwriting
portions of the tg3 struct.

http://cansecwest.com/slides/2013/PrivateCore%20CSW%202013.pdf

Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Oded Horovitz <oded@privatecore.com>
Reported-by: Brad Spengler <spender@grsecurity.net>
Cc: stable@vger.kernel.org
Cc: Matt Carlson <mcarlson@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Kees Cook

Vulnerable version (before fix):
 static void tg3_read_vpd(struct tg3 *tp) 		if (j + len > block_end) 			goto partno;  		memcpy(tp->fw_ver, &vpd_data[j], len); 		strncat(tp->fw_ver, " bc ", vpdlen - len - 1); 	}  partno:

Fixed version (after fix):
 static void tg3_read_vpd(struct tg3 *tp) 		if (j + len > block_end) 			goto partno;  		if (len >= sizeof(tp->fw_ver)) 			len = sizeof(tp->fw_ver) - 1; 		memset(tp->fw_ver, 0, sizeof(tp->fw_ver)); 		snprintf(tp->fw_ver, sizeof(tp->fw_ver), "%.*s bc ", len, 			 &vpd_data[j]); 	}  partno:

Patch:
patch: @@ -14604,8 +14604,11 @@ static void tg3_read_vpd(struct tg3 *tp)
 		if (j + len > block_end)
 			goto partno;
 
-		memcpy(tp->fw_ver, &vpd_data[j], len);
-		strncat(tp->fw_ver, " bc ", vpdlen - len - 1);
+		if (len >= sizeof(tp->fw_ver))
+			len = sizeof(tp->fw_ver) - 1;
+		memset(tp->fw_ver, 0, sizeof(tp->fw_ver));
+		snprintf(tp->fw_ver, sizeof(tp->fw_ver), "%.*s bc ", len,
+			 &vpd_data[j]);
 	}
 
 partno:
path: drivers/net/ethernet/broadcom/tg3.c
Vulnerability: ** DISPUTED ** Multiple cross-site scripting (XSS) vulnerabilities in tbl_gis_visualization.php in phpMyAdmin 3.5.x before 3.5.8 might allow remote attackers to inject arbitrary web script or HTML via the (1) visualizationSettings[width] or (2) visualizationSettings[height] parameter. NOTE: a third party reports that this is "not exploitable."
Vulnerability ID: CVE-2013-1937
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/phpmyadmin/phpmyadmin
Published: 2013-04-16
File: tbl_gis_visualization.php
Commit message: fix XSS reported by Janek Vind
Commit author: Dieter Adriaenssens

Vulnerable version (before fix):
 <?php echo PMA_generate_common_hidden_inputs($url_params); ?> <fieldset>     <legend><?php echo __('Display GIS Visualization'); ?></legend>     <div id="placeholder" style="width:<?php echo($visualizationSettings['width']); ?>px;height:<?php echo($visualizationSettings['height']); ?>px;">         <?php echo $visualization; ?>     </div>     <div id="openlayersmap"></div> function drawOpenLayers() {  */ require './libraries/footer.inc.php';  ?>\ No newline at end of file

Fixed version (after fix):
 <?php echo PMA_generate_common_hidden_inputs($url_params); ?> <fieldset>     <legend><?php echo __('Display GIS Visualization'); ?></legend>     <div id="placeholder" style="width:<?php echo(htmlspecialchars($visualizationSettings['width'])); ?>px;height:<?php echo(htmlspecialchars($visualizationSettings['height'])); ?>px;">         <?php echo $visualization; ?>     </div>     <div id="openlayersmap"></div> function drawOpenLayers() {  */ require './libraries/footer.inc.php'; \ No newline at end of file ?>

Patch:
patch: @@ -110,7 +110,7 @@
 <?php echo PMA_generate_common_hidden_inputs($url_params); ?>
 <fieldset>
     <legend><?php echo __('Display GIS Visualization'); ?></legend>
-    <div id="placeholder" style="width:<?php echo($visualizationSettings['width']); ?>px;height:<?php echo($visualizationSettings['height']); ?>px;">
+    <div id="placeholder" style="width:<?php echo(htmlspecialchars($visualizationSettings['width'])); ?>px;height:<?php echo(htmlspecialchars($visualizationSettings['height'])); ?>px;">
         <?php echo $visualization; ?>
     </div>
     <div id="openlayersmap"></div>
@@ -202,4 +202,4 @@ function drawOpenLayers() {
  */
 require './libraries/footer.inc.php';
 
-?>
\ No newline at end of file
+?>
path: tbl_gis_visualization.php
Vulnerability: The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL.
Vulnerability ID: CVE-2013-1944
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/bagder/curl
Published: 2013-04-29
File: lib/cookie.c
Commit message: cookie: fix tailmatching to prevent cross-domain leakage

Cookies set for 'example.com' could accidentaly also be sent by libcurl
to the 'bexample.com' (ie with a prefix to the first domain name).

This is a security vulnerabilty, CVE-2013-1944.

Bug: http://curl.haxx.se/docs/adv_20130412.html
Commit author: YAMADA Yasuharu

Vulnerable version (before fix):
 static void freecookie(struct Cookie *co)   free(co); }  static bool tailmatch(const char *little, const char *bigone) {   size_t littlelen = strlen(little);   size_t biglen = strlen(bigone);    if(littlelen > biglen)     return FALSE;    return Curl_raw_equal(little, bigone+biglen-littlelen) ? TRUE : FALSE; }  /*

Fixed version (after fix):
 static void freecookie(struct Cookie *co)   free(co); }  static bool tailmatch(const char *cooke_domain, const char *hostname) {   size_t cookie_domain_len = strlen(cooke_domain);   size_t hostname_len = strlen(hostname);    if(hostname_len < cookie_domain_len)     return FALSE;    if(!Curl_raw_equal(cooke_domain, hostname+hostname_len-cookie_domain_len))     return FALSE;    /* A lead char of cookie_domain is not '.'.      RFC6265 4.1.2.3. The Domain Attribute says:        For example, if the value of the Domain attribute is        "example.com", the user agent will include the cookie in the Cookie        header when making HTTP requests to example.com, www.example.com, and        www.corp.example.com.    */   if(hostname_len == cookie_domain_len)     return TRUE;   if('.' == *(hostname + hostname_len - cookie_domain_len - 1))     return TRUE;   return FALSE; }  /*

Patch:
patch: @@ -118,15 +118,29 @@ static void freecookie(struct Cookie *co)
   free(co);
 }
 
-static bool tailmatch(const char *little, const char *bigone)
+static bool tailmatch(const char *cooke_domain, const char *hostname)
 {
-  size_t littlelen = strlen(little);
-  size_t biglen = strlen(bigone);
+  size_t cookie_domain_len = strlen(cooke_domain);
+  size_t hostname_len = strlen(hostname);
 
-  if(littlelen > biglen)
+  if(hostname_len < cookie_domain_len)
     return FALSE;
 
-  return Curl_raw_equal(little, bigone+biglen-littlelen) ? TRUE : FALSE;
+  if(!Curl_raw_equal(cooke_domain, hostname+hostname_len-cookie_domain_len))
+    return FALSE;
+
+  /* A lead char of cookie_domain is not '.'.
+     RFC6265 4.1.2.3. The Domain Attribute says:
+       For example, if the value of the Domain attribute is
+       "example.com", the user agent will include the cookie in the Cookie
+       header when making HTTP requests to example.com, www.example.com, and
+       www.corp.example.com.
+   */
+  if(hostname_len == cookie_domain_len)
+    return TRUE;
+  if('.' == *(hostname + hostname_len - cookie_domain_len - 1))
+    return TRUE;
+  return FALSE;
 }
 
 /*
path: lib/cookie.c