rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to the initrd.
Vulnerability ID: CVE-2015-2666
CWE: CWE-119
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2015-05-27
File: arch/x86/kernel/cpu/microcode/intel_early.c
Commit message: x86/microcode/intel: Guard against stack overflow in the loader

mc_saved_tmp is a static array allocated on the stack, we need to make
sure mc_saved_count stays within its bounds, otherwise we're overflowing
the stack in _save_mc(). A specially crafted microcode header could lead
to a kernel crash or potentially kernel execution.

Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Link: http://lkml.kernel.org/r/1422964824-22056-1-git-send-email-quentin.casasnovas@oracle.com
Signed-off-by: Borislav Petkov <bp@suse.de>
Commit author: Quentin Casasnovas

Vulnerable version (before fix):
 get_matching_model_microcode(int cpu, unsigned long start, 	unsigned int mc_saved_count = mc_saved_data->mc_saved_count; 	int i;  	while (leftover) { 		mc_header = (struct microcode_header_intel *)ucode_ptr;  		mc_size = get_totalsize(mc_header);

Fixed version (after fix):
 get_matching_model_microcode(int cpu, unsigned long start, 	unsigned int mc_saved_count = mc_saved_data->mc_saved_count; 	int i;  	while (leftover && mc_saved_count < ARRAY_SIZE(mc_saved_tmp)) { 		mc_header = (struct microcode_header_intel *)ucode_ptr;  		mc_size = get_totalsize(mc_header);

Patch:
patch: @@ -321,7 +321,7 @@ get_matching_model_microcode(int cpu, unsigned long start,
 	unsigned int mc_saved_count = mc_saved_data->mc_saved_count;
 	int i;
 
-	while (leftover) {
+	while (leftover && mc_saved_count < ARRAY_SIZE(mc_saved_tmp)) {
 		mc_header = (struct microcode_header_intel *)ucode_ptr;
 
 		mc_size = get_totalsize(mc_header);
path: arch/x86/kernel/cpu/microcode/intel_early.c
Vulnerability: net/socket.c in the Linux kernel 3.19 before 3.19.3 does not validate certain range data for (1) sendto and (2) recvfrom system calls, which allows local users to gain privileges by leveraging a subsystem that uses the copy_from_iter function in the iov_iter interface, as demonstrated by the Bluetooth subsystem.
Vulnerability ID: CVE-2015-2686
CWE: CWE-264
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2016-05-02
File: net/socket.c
Commit message: net: validate the range we feed to iov_iter_init() in sys_sendto/sys_recvfrom

Cc: stable@vger.kernel.org # v3.19
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Al Viro

Vulnerable version (before fix):
 SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,  	if (len > INT_MAX) 		len = INT_MAX; 	sock = sockfd_lookup_light(fd, &err, &fput_needed); 	if (!sock) 		goto out; SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,  	if (size > INT_MAX) 		size = INT_MAX; 	sock = sockfd_lookup_light(fd, &err, &fput_needed); 	if (!sock) 		goto out;

Fixed version (after fix):
 SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,  	if (len > INT_MAX) 		len = INT_MAX; 	if (unlikely(!access_ok(VERIFY_READ, buff, len))) 		return -EFAULT; 	sock = sockfd_lookup_light(fd, &err, &fput_needed); 	if (!sock) 		goto out; SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,  	if (size > INT_MAX) 		size = INT_MAX; 	if (unlikely(!access_ok(VERIFY_WRITE, ubuf, size))) 		return -EFAULT; 	sock = sockfd_lookup_light(fd, &err, &fput_needed); 	if (!sock) 		goto out;

Patch:
patch: @@ -1702,6 +1702,8 @@ SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
 
 	if (len > INT_MAX)
 		len = INT_MAX;
+	if (unlikely(!access_ok(VERIFY_READ, buff, len)))
+		return -EFAULT;
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (!sock)
 		goto out;
@@ -1760,6 +1762,8 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
 
 	if (size > INT_MAX)
 		size = INT_MAX;
+	if (unlikely(!access_ok(VERIFY_WRITE, ubuf, size)))
+		return -EFAULT;
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
 	if (!sock)
 		goto out;
path: net/socket.c
Vulnerability: The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\0' character in a long realm field within a TGS request.
Vulnerability ID: CVE-2015-2697
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/krb5/krb5
Published: 2015-11-09
File: src/lib/krb5/krb/bld_princ.c
Commit message: Fix build_principal memory bug [CVE-2015-2697]

In build_principal_va(), use k5memdup0() instead of strdup() to make a
copy of the realm, to ensure that we allocate the correct number of
bytes and do not read past the end of the input string.  This bug
affects krb5_build_principal(), krb5_build_principal_va(), and
krb5_build_principal_alloc_va().  krb5_build_principal_ext() is not
affected.

CVE-2015-2697:

In MIT krb5 1.7 and later, an authenticated attacker may be able to
cause a KDC to crash using a TGS request with a large realm field
beginning with a null byte.  If the KDC attempts to find a referral to
answer the request, it constructs a principal name for lookup using
krb5_build_principal() with the requested realm.  Due to a bug in this
function, the null byte causes only one byte be allocated for the
realm field of the constructed principal, far less than its length.
Subsequent operations on the lookup principal may cause a read beyond
the end of the mapped memory region, causing the KDC process to crash.

CVSSv2: AV:N/AC:L/Au:S/C:N/I:N/A:C/E:POC/RL:OF/RC:C

ticket: 8252 (new)
target_version: 1.14
tags: pullup
Commit author: Greg Hudson

Vulnerable version (before fix):
 build_principal_va(krb5_context context, krb5_principal princ,     data = malloc(size * sizeof(krb5_data));     if (!data) { retval = ENOMEM; }      if (!retval) {         r = strdup(realm);         if (!r) { retval = ENOMEM; }     }      while (!retval && (component = va_arg(ap, char *))) {         if (count == size) {

Fixed version (after fix):
 build_principal_va(krb5_context context, krb5_principal princ,     data = malloc(size * sizeof(krb5_data));     if (!data) { retval = ENOMEM; }      if (!retval)         r = k5memdup0(realm, rlen, &retval);      while (!retval && (component = va_arg(ap, char *))) {         if (count == size) {

Patch:
patch: @@ -40,10 +40,8 @@ build_principal_va(krb5_context context, krb5_principal princ,
     data = malloc(size * sizeof(krb5_data));
     if (!data) { retval = ENOMEM; }
 
-    if (!retval) {
-        r = strdup(realm);
-        if (!r) { retval = ENOMEM; }
-    }
+    if (!retval)
+        r = k5memdup0(realm, rlen, &retval);
 
     while (!retval && (component = va_arg(ap, char *))) {
         if (count == size) {
path: src/lib/krb5/krb/bld_princ.c
Vulnerability: The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input.
Vulnerability ID: CVE-2015-2784
CWE: CWE-20
Severity score: 6.4
Project: https://github.com/rsantamaria/papercrop
Published: 2020-01-21
File: lib/paperclip_processors/cropper.rb
Commit message: Sanitized crop input, logs with Paperclip log function if anything weird happens
Commit author: saneki

Vulnerable version (before fix):
 def crop_command       target = @attachment.instance        if target.cropping?(@attachment.name)         w = target.send :"#{@attachment.name}_crop_w"         h = target.send :"#{@attachment.name}_crop_h"         x = target.send :"#{@attachment.name}_crop_x"         y = target.send :"#{@attachment.name}_crop_y"         ["-crop", "#{w}x#{h}+#{x}+#{y}"]       end     end 

Fixed version (after fix):
 def crop_command       target = @attachment.instance        if target.cropping?(@attachment.name)         begin           w = Integer(target.send :"#{@attachment.name}_crop_w")           h = Integer(target.send :"#{@attachment.name}_crop_h")           x = Integer(target.send :"#{@attachment.name}_crop_x")           y = Integer(target.send :"#{@attachment.name}_crop_y")           ["-crop", "#{w}x#{h}+#{x}+#{y}"]         rescue           Paperclip.log("[papercrop] #{@attachment.name} crop w/h/x/y were non-integer")           return         end       end     end 

Patch:
patch: @@ -16,11 +16,16 @@ def crop_command
       target = @attachment.instance
 
       if target.cropping?(@attachment.name)
-        w = target.send :"#{@attachment.name}_crop_w"
-        h = target.send :"#{@attachment.name}_crop_h"
-        x = target.send :"#{@attachment.name}_crop_x"
-        y = target.send :"#{@attachment.name}_crop_y"
-        ["-crop", "#{w}x#{h}+#{x}+#{y}"]
+        begin
+          w = Integer(target.send :"#{@attachment.name}_crop_w")
+          h = Integer(target.send :"#{@attachment.name}_crop_h")
+          x = Integer(target.send :"#{@attachment.name}_crop_x")
+          y = Integer(target.send :"#{@attachment.name}_crop_y")
+          ["-crop", "#{w}x#{h}+#{x}+#{y}"]
+        rescue
+          Paperclip.log("[papercrop] #{@attachment.name} crop w/h/x/y were non-integer")
+          return
+        end
       end
     end
path: lib/paperclip_processors/cropper.rb
Vulnerability: Buffer overflow in das_watchdog 0.9.0 allows local users to execute arbitrary code with root privileges via a large string in the XAUTHORITY environment variable.
Vulnerability ID: CVE-2015-2831
CWE: CWE-119
Severity score: 10
Project: https://github.com/kmatheussen/das_watchdog
Published: 2015-04-14
File: das_watchdog.c
Commit message: Fix memory overflow if the name of an environment is larger than 500 characters. Bug found by Adam Sampson.
Commit author: Kjetil Matheussen

Vulnerable version (before fix):
 static int checksoftirq(int force){   static char *get_pid_environ_val(pid_t pid,char *val){   char temp[500];   int i=0;   int foundit=0;   FILE *fp; static char *get_pid_environ_val(pid_t pid,char *val){       for(;;){     temp[i]=fgetc(fp);          if(foundit==1 && (temp[i]==0 || temp[i]=='\0' || temp[i]==EOF)){

Fixed version (after fix):
 static int checksoftirq(int force){   static char *get_pid_environ_val(pid_t pid,char *val){   int temp_size = 500;   char *temp = malloc(temp_size);      int i=0;   int foundit=0;   FILE *fp; static char *get_pid_environ_val(pid_t pid,char *val){       for(;;){          if (i >= temp_size) {       temp_size *= 2;       temp = realloc(temp, temp_size);     }            temp[i]=fgetc(fp);          if(foundit==1 && (temp[i]==0 || temp[i]=='\0' || temp[i]==EOF)){

Patch:
patch: @@ -306,7 +306,9 @@ static int checksoftirq(int force){
 
 
 static char *get_pid_environ_val(pid_t pid,char *val){
-  char temp[500];
+  int temp_size = 500;
+  char *temp = malloc(temp_size);
+  
   int i=0;
   int foundit=0;
   FILE *fp;
@@ -319,6 +321,12 @@ static char *get_pid_environ_val(pid_t pid,char *val){
 
   
   for(;;){
+    
+    if (i >= temp_size) {
+      temp_size *= 2;
+      temp = realloc(temp, temp_size);
+    }
+      
     temp[i]=fgetc(fp);    
 
     if(foundit==1 && (temp[i]==0 || temp[i]=='\0' || temp[i]==EOF)){
path: das_watchdog.c
Vulnerability: print-wb.c in tcpdump before 4.7.4 allows remote attackers to cause a denial of service (segmentation fault and process crash).
Vulnerability ID: CVE-2015-3138
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/the-tcpdump-group/tcpdump
Published: 2017-09-28
File: print-wb.c
Commit message: whiteboard: fixup a few reversed tests (GH #446)

This is a follow-up to commit 3a3ec26.
Commit author: Denis Ovsienko

Vulnerable version (before fix):
 wb_id(netdissect_options *ndo, 	len -= sizeof(*io) * nid; 	io = (struct id_off *)(id + 1); 	cp = (char *)(io + nid); 	if (!ND_TTEST2(cp, len)) { 		ND_PRINT((ndo, "\"")); 		fn_print(ndo, (u_char *)cp, (u_char *)cp + len); 		ND_PRINT((ndo, "\"")); wb_prep(netdissect_options *ndo, 	} 	n = EXTRACT_32BITS(&prep->pp_n); 	ps = (const struct pgstate *)(prep + 1); 	while (--n >= 0 && !ND_TTEST(*ps)) { 		const struct id_off *io, *ie; 		char c = '<';  wb_prep(netdissect_options *ndo, 		    ipaddr_string(ndo, &ps->page.p_sid), 		    EXTRACT_32BITS(&ps->page.p_uid))); 		io = (struct id_off *)(ps + 1); 		for (ie = io + ps->nid; io < ie && !ND_TTEST(*io); ++io) { 			ND_PRINT((ndo, "%c%s:%u", c, ipaddr_string(ndo, &io->id), 			    EXTRACT_32BITS(&io->off))); 			c = ',';

Fixed version (after fix):
 wb_id(netdissect_options *ndo, 	len -= sizeof(*io) * nid; 	io = (struct id_off *)(id + 1); 	cp = (char *)(io + nid); 	if (ND_TTEST2(cp, len)) { 		ND_PRINT((ndo, "\"")); 		fn_print(ndo, (u_char *)cp, (u_char *)cp + len); 		ND_PRINT((ndo, "\"")); wb_prep(netdissect_options *ndo, 	} 	n = EXTRACT_32BITS(&prep->pp_n); 	ps = (const struct pgstate *)(prep + 1); 	while (--n >= 0 && ND_TTEST(*ps)) { 		const struct id_off *io, *ie; 		char c = '<';  wb_prep(netdissect_options *ndo, 		    ipaddr_string(ndo, &ps->page.p_sid), 		    EXTRACT_32BITS(&ps->page.p_uid))); 		io = (struct id_off *)(ps + 1); 		for (ie = io + ps->nid; io < ie && ND_TTEST(*io); ++io) { 			ND_PRINT((ndo, "%c%s:%u", c, ipaddr_string(ndo, &io->id), 			    EXTRACT_32BITS(&io->off))); 			c = ',';

Patch:
patch: @@ -201,7 +201,7 @@ wb_id(netdissect_options *ndo,
 	len -= sizeof(*io) * nid;
 	io = (struct id_off *)(id + 1);
 	cp = (char *)(io + nid);
-	if (!ND_TTEST2(cp, len)) {
+	if (ND_TTEST2(cp, len)) {
 		ND_PRINT((ndo, "\""));
 		fn_print(ndo, (u_char *)cp, (u_char *)cp + len);
 		ND_PRINT((ndo, "\""));
@@ -266,7 +266,7 @@ wb_prep(netdissect_options *ndo,
 	}
 	n = EXTRACT_32BITS(&prep->pp_n);
 	ps = (const struct pgstate *)(prep + 1);
-	while (--n >= 0 && !ND_TTEST(*ps)) {
+	while (--n >= 0 && ND_TTEST(*ps)) {
 		const struct id_off *io, *ie;
 		char c = '<';
 
@@ -275,7 +275,7 @@ wb_prep(netdissect_options *ndo,
 		    ipaddr_string(ndo, &ps->page.p_sid),
 		    EXTRACT_32BITS(&ps->page.p_uid)));
 		io = (struct id_off *)(ps + 1);
-		for (ie = io + ps->nid; io < ie && !ND_TTEST(*io); ++io) {
+		for (ie = io + ps->nid; io < ie && ND_TTEST(*io); ++io) {
 			ND_PRINT((ndo, "%c%s:%u", c, ipaddr_string(ndo, &io->id),
 			    EXTRACT_32BITS(&io->off)));
 			c = ',';
path: print-wb.c
Vulnerability: The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index.
Vulnerability ID: CVE-2015-3214
CWE: CWE-119
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2015-08-31
File: arch/x86/kvm/i8254.c
Commit message: KVM: PIT: control word is write-only

PIT control word (address 0x43) is write-only, reads are undefined.

Cc: stable@kernel.org
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Commit author: Marcelo Tosatti

Vulnerable version (before fix):
 static int pit_ioport_read(struct kvm_io_device *this, 		return -EOPNOTSUPP;  	addr &= KVM_PIT_CHANNEL_MASK; 	s = &pit_state->channels[addr];  	mutex_lock(&pit_state->lock);

Fixed version (after fix):
 static int pit_ioport_read(struct kvm_io_device *this, 		return -EOPNOTSUPP;  	addr &= KVM_PIT_CHANNEL_MASK; 	if (addr == 3) 		return 0;  	s = &pit_state->channels[addr];  	mutex_lock(&pit_state->lock);

Patch:
patch: @@ -467,6 +467,9 @@ static int pit_ioport_read(struct kvm_io_device *this,
 		return -EOPNOTSUPP;
 
 	addr &= KVM_PIT_CHANNEL_MASK;
+	if (addr == 3)
+		return 0;
+
 	s = &pit_state->channels[addr];
 
 	mutex_lock(&pit_state->lock);
path: arch/x86/kvm/i8254.c
Vulnerability: Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by leveraging replacement of backslashes with slashes in the path parameter of HTTP API requests.
Vulnerability ID: CVE-2015-3297
CWE: CWE-22
Severity score: 2.9
Project: https://github.com/ether/etherpad-lite
Published: 2017-07-07
File: src/node/utils/Minify.js
Commit message: dont allow directory traversal
Commit author: John McLear

Vulnerable version (before fix):
 function minify(req, res, next)   filename = path.normalize(path.join(ROOT_DIR, filename));   if (filename.indexOf(ROOT_DIR) == 0) {     filename = filename.slice(ROOT_DIR.length);     filename = filename.replace(/\\/g, '/'); // Windows (safe generally?)   } else {     res.writeHead(404, {});     res.end();

Fixed version (after fix):
 function minify(req, res, next)   filename = path.normalize(path.join(ROOT_DIR, filename));   if (filename.indexOf(ROOT_DIR) == 0) {     filename = filename.slice(ROOT_DIR.length);   } else {     res.writeHead(404, {});     res.end();

Patch:
patch: @@ -145,7 +145,6 @@ function minify(req, res, next)
   filename = path.normalize(path.join(ROOT_DIR, filename));
   if (filename.indexOf(ROOT_DIR) == 0) {
     filename = filename.slice(ROOT_DIR.length);
-    filename = filename.replace(/\\/g, '/'); // Windows (safe generally?)
   } else {
     res.writeHead(404, {});
     res.end();
path: src/node/utils/Minify.js
Vulnerability: Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. (dot dot) in the path parameter of HTTP API requests. NOTE: This vulnerability is due to an incomplete fix to CVE-2015-3297.
Vulnerability ID: CVE-2015-3309
CWE: CWE-22
Severity score: 2.9
Project: https://github.com/ether/etherpad-lite
Published: 2020-02-13
File: src/node/utils/Minify.js
Commit message: dont allow directory traversal #2
Commit author: louis

Vulnerable version (before fix):
 function minify(req, res, next)       var plugin = plugins.plugins[library];       var pluginPath = plugin.package.realPath;       filename = path.relative(ROOT_DIR, pluginPath + libraryPath);       filename = filename.replace(/\\/g, '/'); // Windows (safe generally?)     } else if (LIBRARY_WHITELIST.indexOf(library) != -1) {       // Go straight into node_modules       // Avoid `require.resolve()`, since 'mustache' and 'mustache/index.js'

Fixed version (after fix):
 function minify(req, res, next)       var plugin = plugins.plugins[library];       var pluginPath = plugin.package.realPath;       filename = path.relative(ROOT_DIR, pluginPath + libraryPath);     } else if (LIBRARY_WHITELIST.indexOf(library) != -1) {       // Go straight into node_modules       // Avoid `require.resolve()`, since 'mustache' and 'mustache/index.js'

Patch:
patch: @@ -165,7 +165,6 @@ function minify(req, res, next)
       var plugin = plugins.plugins[library];
       var pluginPath = plugin.package.realPath;
       filename = path.relative(ROOT_DIR, pluginPath + libraryPath);
-      filename = filename.replace(/\\/g, '/'); // Windows (safe generally?)
     } else if (LIBRARY_WHITELIST.indexOf(library) != -1) {
       // Go straight into node_modules
       // Avoid `require.resolve()`, since 'mustache' and 'mustache/index.js'
path: src/node/utils/Minify.js
Vulnerability: Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1.
Vulnerability ID: CVE-2015-4085
CWE: CWE-22
Severity score: 2.9
Project: https://github.com/ether/etherpad-lite
Published: 2017-09-07
File: src/node/hooks/express/tests.js
Commit message: fix an issue in the path handling that allowed directory traversal
Commit author: Tom Hunkapiller

Vulnerable version (before fix):
 exports.expressCreateServer = function (hook_name, args, cb) {    });    var url2FilePath = function(url){     var subPath = url.substr("/tests/frontend".length);     if (subPath == ""){       subPath = "index.html"     }     subPath = subPath.split("?")[0];      var filePath = path.normalize(npm.root + "/../tests/frontend/")     filePath += subPath.replace("..", "");     return filePath;   } 

Fixed version (after fix):
 exports.expressCreateServer = function (hook_name, args, cb) {    });    var rootTestFolder = path.join(npm.root, "..", "/tests/frontend/");   var url2FilePath = function(url){     var subPath = url.substr("/tests/frontend".length);     if (subPath == ""){       subPath = "index.html"     }     subPath = subPath.split("?")[0];      var filePath = path.normalize(path.join(rootTestFolder, subPath));     // make sure we jail the paths to the test folder, otherwise serve index     if (filePath.indexOf(rootTestFolder) !== 0) {       filePath = path.normalize(path.join(rootTestFolder, "index.html"));     }     return filePath;   } 

Patch:
patch: @@ -23,15 +23,19 @@ exports.expressCreateServer = function (hook_name, args, cb) {
 
   });
 
+  var rootTestFolder = path.join(npm.root, "..", "/tests/frontend/");
   var url2FilePath = function(url){
     var subPath = url.substr("/tests/frontend".length);
     if (subPath == ""){
       subPath = "index.html"
     }
     subPath = subPath.split("?")[0];
 
-    var filePath = path.normalize(npm.root + "/../tests/frontend/")
-    filePath += subPath.replace("..", "");
+    var filePath = path.normalize(path.join(rootTestFolder, subPath));
+    // make sure we jail the paths to the test folder, otherwise serve index
+    if (filePath.indexOf(rootTestFolder) !== 0) {
+      filePath = path.normalize(path.join(rootTestFolder, "index.html"));
+    }
     return filePath;
   }
path: src/node/hooks/express/tests.js
Vulnerability: The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.19.1 does not validate certain length values, which allows local users to cause a denial of service (incorrect data representation or integer overflow, and OOPS) via a crafted UDF filesystem.
Vulnerability ID: CVE-2015-4167
CWE: CWE-189
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2015-08-05
File: fs/udf/inode.c
Commit message: udf: Check length of extended attributes and allocation descriptors

Check length of extended attributes and allocation descriptors when
loading inodes from disk. Otherwise corrupted filesystems could confuse
the code and make the kernel oops.

Reported-by: Carl Henrik Lunde <chlunde@ping.uio.no>
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Commit author: Jan Kara

Vulnerable version (before fix):
 static int udf_read_inode(struct inode *inode, bool hidden_inode) 	} 	inode->i_generation = iinfo->i_unique;  	/* Sanity checks for files in ICB so that we don't get confused later */ 	if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) { 		/*

Fixed version (after fix):
 static int udf_read_inode(struct inode *inode, bool hidden_inode) 	} 	inode->i_generation = iinfo->i_unique;  	/* 	 * Sanity check length of allocation descriptors and extended attrs to 	 * avoid integer overflows 	 */ 	if (iinfo->i_lenEAttr > bs || iinfo->i_lenAlloc > bs) 		goto out; 	/* Now do exact checks */ 	if (udf_file_entry_alloc_offset(inode) + iinfo->i_lenAlloc > bs) 		goto out; 	/* Sanity checks for files in ICB so that we don't get confused later */ 	if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) { 		/*

Patch:
patch: @@ -1487,6 +1487,15 @@ static int udf_read_inode(struct inode *inode, bool hidden_inode)
 	}
 	inode->i_generation = iinfo->i_unique;
 
+	/*
+	 * Sanity check length of allocation descriptors and extended attrs to
+	 * avoid integer overflows
+	 */
+	if (iinfo->i_lenEAttr > bs || iinfo->i_lenAlloc > bs)
+		goto out;
+	/* Now do exact checks */
+	if (udf_file_entry_alloc_offset(inode) + iinfo->i_lenAlloc > bs)
+		goto out;
 	/* Sanity checks for files in ICB so that we don't get confused later */
 	if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
 		/*
path: fs/udf/inode.c