rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The aac_send_raw_srb function in drivers/scsi/aacraid/commctrl.c in the Linux kernel through 3.12.1 does not properly validate a certain size value, which allows local users to cause a denial of service (invalid pointer dereference) or possibly have unspecified other impact via an FSACTL_SEND_RAW_SRB ioctl call that triggers a crafted SRB command.
Vulnerability ID: CVE-2013-6380
CWE: CWE-20
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-11-27
File: drivers/scsi/aacraid/commctrl.c
Commit message: aacraid: prevent invalid pointer dereference

It appears that driver runs into a problem here if fibsize is too small
because we allocate user_srbcmd with fibsize size only but later we
access it until user_srbcmd->sg.count to copy it over to srbcmd.

It is not correct to test (fibsize < sizeof(*user_srbcmd)) because this
structure already includes one sg element and this is not needed for
commands without data.  So, we would recommend to add the following
(instead of test for fibsize == 0).

Signed-off-by: Mahesh Rajashekhara <Mahesh.Rajashekhara@pmcs.com>
Reported-by: Nico Golde <nico@ngolde.de>
Reported-by: Fabian Yamaguchi <fabs@goesec.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Mahesh Rajashekhara

Vulnerable version (before fix):
 static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg) 		goto cleanup; 	}  	if (fibsize > (dev->max_fib_size - sizeof(struct aac_fibhdr))) { 		rcode = -EINVAL; 		goto cleanup; 	}

Fixed version (after fix):
 static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg) 		goto cleanup; 	}  	if ((fibsize < (sizeof(struct user_aac_srb) - sizeof(struct user_sgentry))) || 	    (fibsize > (dev->max_fib_size - sizeof(struct aac_fibhdr)))) { 		rcode = -EINVAL; 		goto cleanup; 	}

Patch:
patch: @@ -511,7 +511,8 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 		goto cleanup;
 	}
 
-	if (fibsize > (dev->max_fib_size - sizeof(struct aac_fibhdr))) {
+	if ((fibsize < (sizeof(struct user_aac_srb) - sizeof(struct user_sgentry))) ||
+	    (fibsize > (dev->max_fib_size - sizeof(struct aac_fibhdr)))) {
 		rcode = -EINVAL;
 		goto cleanup;
 	}
path: drivers/scsi/aacraid/commctrl.c
Vulnerability: The aac_compat_ioctl function in drivers/scsi/aacraid/linit.c in the Linux kernel before 3.11.8 does not require the CAP_SYS_RAWIO capability, which allows local users to bypass intended access restrictions via a crafted ioctl call.
Vulnerability ID: CVE-2013-6383
CWE: CWE-264
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2013-11-27
File: drivers/scsi/aacraid/linit.c
Commit message: aacraid: missing capable() check in compat ioctl

In commit d496f94d22d1 ('[SCSI] aacraid: fix security weakness') we
added a check on CAP_SYS_RAWIO to the ioctl.  The compat ioctls need the
check as well.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Dan Carpenter

Vulnerable version (before fix):
 static long aac_compat_do_ioctl(struct aac_dev *dev, unsigned cmd, unsigned long static int aac_compat_ioctl(struct scsi_device *sdev, int cmd, void __user *arg) { 	struct aac_dev *dev = (struct aac_dev *)sdev->host->hostdata; 	return aac_compat_do_ioctl(dev, cmd, (unsigned long)arg); } 

Fixed version (after fix):
 static long aac_compat_do_ioctl(struct aac_dev *dev, unsigned cmd, unsigned long static int aac_compat_ioctl(struct scsi_device *sdev, int cmd, void __user *arg) { 	struct aac_dev *dev = (struct aac_dev *)sdev->host->hostdata; 	if (!capable(CAP_SYS_RAWIO)) 		return -EPERM; 	return aac_compat_do_ioctl(dev, cmd, (unsigned long)arg); } 

Patch:
patch: @@ -771,6 +771,8 @@ static long aac_compat_do_ioctl(struct aac_dev *dev, unsigned cmd, unsigned long
 static int aac_compat_ioctl(struct scsi_device *sdev, int cmd, void __user *arg)
 {
 	struct aac_dev *dev = (struct aac_dev *)sdev->host->hostdata;
+	if (!capable(CAP_SYS_RAWIO))
+		return -EPERM;
 	return aac_compat_do_ioctl(dev, cmd, (unsigned long)arg);
 }
path: drivers/scsi/aacraid/linit.c
Vulnerability: The fib6_add function in net/ipv6/ip6_fib.c in the Linux kernel before 3.11.5 does not properly implement error-code encoding, which allows local users to cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability for an IPv6 SIOCADDRT ioctl call.
Vulnerability ID: CVE-2013-6431
CWE: CWE-264
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-12-09
File: net/ipv6/ip6_fib.c
Commit message: net: fib: fib6_add: fix potential NULL pointer dereference

When the kernel is compiled with CONFIG_IPV6_SUBTREES, and we return
with an error in fn = fib6_add_1(), then error codes are encoded into
the return pointer e.g. ERR_PTR(-ENOENT). In such an error case, we
write the error code into err and jump to out, hence enter the if(err)
condition. Now, if CONFIG_IPV6_SUBTREES is enabled, we check for:

  if (pn != fn && pn->leaf == rt)
    ...
  if (pn != fn && !pn->leaf && !(pn->fn_flags & RTN_RTINFO))
    ...

Since pn is NULL and fn is f.e. ERR_PTR(-ENOENT), then pn != fn
evaluates to true and causes a NULL-pointer dereference on further
checks on pn. Fix it, by setting both NULL in error case, so that
pn != fn already evaluates to false and no further dereference
takes place.

This was first correctly implemented in 4a287eba2 ("IPv6 routing,
NLM_F_* flag support: REPLACE and EXCL flags support, warn about
missing CREATE flag"), but the bug got later on introduced by
188c517a0 ("ipv6: return errno pointers consistently for fib6_add_1()").

Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Lin Ming <mlin@ss.pku.edu.cn>
Cc: Matti Vaittinen <matti.vaittinen@nsn.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Matti Vaittinen <matti.vaittinen@nsn.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Daniel Borkmann

Vulnerable version (before fix):
 int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info) 	fn = fib6_add_1(root, &rt->rt6i_dst.addr, rt->rt6i_dst.plen, 			offsetof(struct rt6_info, rt6i_dst), allow_create, 			replace_required);  	if (IS_ERR(fn)) { 		err = PTR_ERR(fn); 		goto out; 	} 

Fixed version (after fix):
 int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info) 	fn = fib6_add_1(root, &rt->rt6i_dst.addr, rt->rt6i_dst.plen, 			offsetof(struct rt6_info, rt6i_dst), allow_create, 			replace_required); 	if (IS_ERR(fn)) { 		err = PTR_ERR(fn); 		fn = NULL; 		goto out; 	} 

Patch:
patch: @@ -825,9 +825,9 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info)
 	fn = fib6_add_1(root, &rt->rt6i_dst.addr, rt->rt6i_dst.plen,
 			offsetof(struct rt6_info, rt6i_dst), allow_create,
 			replace_required);
-
 	if (IS_ERR(fn)) {
 		err = PTR_ERR(fn);
+		fn = NULL;
 		goto out;
 	}
path: net/ipv6/ip6_fib.c
Vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in JBPM KIE Workbench 6.0.x allow remote authenticated users to inject arbitrary web script or HTML via vectors related to task name html inputs.
Vulnerability ID: CVE-2013-6465
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/kiegroup/jbpm-wb
Published: 2017-12-19
File: jbpm-console-ng-human-tasks/jbpm-console-ng-human-tasks-client/src/main/java/org/jbpm/console/ng/ht/client/editors/taskdetailsmulti/TaskDetailsMultiPresenter.java
Commit message: BZ-1049109: escaping task name html inputs
Commit author: Salaboy

Vulnerable version (before fix):
 import javax.inject.Inject;  import com.google.gwt.core.client.GWT; import com.google.gwt.user.client.ui.HTMLPanel; import com.google.gwt.user.client.ui.IsWidget; import java.util.HashMap; public void onTaskSelectionEvent(@Observes TaskSelectionEvent event){         selectedTaskId = event.getTaskId();         selectedTaskName = event.getTaskName();                  view.getTaskIdAndName().setText(String.valueOf(selectedTaskId) + " - "+selectedTaskName);                  view.getContent().clear();         

Fixed version (after fix):
 import javax.inject.Inject;  import com.google.gwt.core.client.GWT; import com.google.gwt.safehtml.shared.SafeHtmlUtils; import com.google.gwt.user.client.ui.HTMLPanel; import com.google.gwt.user.client.ui.IsWidget; import java.util.HashMap; public void onTaskSelectionEvent(@Observes TaskSelectionEvent event){         selectedTaskId = event.getTaskId();         selectedTaskName = event.getTaskName();                  view.getTaskIdAndName().setText(SafeHtmlUtils.htmlEscape(String.valueOf(selectedTaskId) + " - "+selectedTaskName));                  view.getContent().clear();         

Patch:
patch: @@ -20,6 +20,7 @@
 import javax.inject.Inject;
 
 import com.google.gwt.core.client.GWT;
+import com.google.gwt.safehtml.shared.SafeHtmlUtils;
 import com.google.gwt.user.client.ui.HTMLPanel;
 import com.google.gwt.user.client.ui.IsWidget;
 import java.util.HashMap;
@@ -117,7 +118,7 @@ public void onTaskSelectionEvent(@Observes TaskSelectionEvent event){
         selectedTaskId = event.getTaskId();
         selectedTaskName = event.getTaskName();
         
-        view.getTaskIdAndName().setText(String.valueOf(selectedTaskId) + " - "+selectedTaskName);
+        view.getTaskIdAndName().setText(SafeHtmlUtils.htmlEscape(String.valueOf(selectedTaskId) + " - "+selectedTaskName));
         
         view.getContent().clear();
path: jbpm-console-ng-human-tasks/jbpm-console-ng-human-tasks-client/src/main/java/org/jbpm/console/ng/ht/client/editors/taskdetailsmulti/TaskDetailsMultiPresenter.java
Vulnerability: Multiple integer signedness errors in libavcodec/dsputil.c in FFmpeg before 2.1 allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted data.
Vulnerability ID: CVE-2013-7010
CWE: CWE-189
Severity score: 6.4
Project: https://github.com/FFmpeg/FFmpeg
Published: 2013-12-09
File: libavcodec/dsputil.c
Commit message: avcodec/dsputil: fix signedness in sizeof() comparissions

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 void ff_set_cmp(DSPContext* c, me_cmp_func *cmp, int type){  static void add_bytes_c(uint8_t *dst, uint8_t *src, int w){     long i;     for(i=0; i<=w-sizeof(long); i+=sizeof(long)){         long a = *(long*)(src+i);         long b = *(long*)(dst+i);         *(long*)(dst+i) = ((a&pb_7f) + (b&pb_7f)) ^ ((a^b)&pb_80); static void diff_bytes_c(uint8_t *dst, const uint8_t *src1, const uint8_t *src2,         }     }else #endif     for(i=0; i<=w-sizeof(long); i+=sizeof(long)){         long a = *(long*)(src1+i);         long b = *(long*)(src2+i);         *(long*)(dst+i) = ((a|pb_80) - (b&pb_7f)) ^ ((a^b^pb_80)&pb_80);

Fixed version (after fix):
 void ff_set_cmp(DSPContext* c, me_cmp_func *cmp, int type){  static void add_bytes_c(uint8_t *dst, uint8_t *src, int w){     long i;     for(i=0; i<=w-(int)sizeof(long); i+=sizeof(long)){         long a = *(long*)(src+i);         long b = *(long*)(dst+i);         *(long*)(dst+i) = ((a&pb_7f) + (b&pb_7f)) ^ ((a^b)&pb_80); static void diff_bytes_c(uint8_t *dst, const uint8_t *src1, const uint8_t *src2,         }     }else #endif     for(i=0; i<=w-(int)sizeof(long); i+=sizeof(long)){         long a = *(long*)(src1+i);         long b = *(long*)(src2+i);         *(long*)(dst+i) = ((a|pb_80) - (b&pb_7f)) ^ ((a^b^pb_80)&pb_80);

Patch:
patch: @@ -1931,7 +1931,7 @@ void ff_set_cmp(DSPContext* c, me_cmp_func *cmp, int type){
 
 static void add_bytes_c(uint8_t *dst, uint8_t *src, int w){
     long i;
-    for(i=0; i<=w-sizeof(long); i+=sizeof(long)){
+    for(i=0; i<=w-(int)sizeof(long); i+=sizeof(long)){
         long a = *(long*)(src+i);
         long b = *(long*)(dst+i);
         *(long*)(dst+i) = ((a&pb_7f) + (b&pb_7f)) ^ ((a^b)&pb_80);
@@ -1956,7 +1956,7 @@ static void diff_bytes_c(uint8_t *dst, const uint8_t *src1, const uint8_t *src2,
         }
     }else
 #endif
-    for(i=0; i<=w-sizeof(long); i+=sizeof(long)){
+    for(i=0; i<=w-(int)sizeof(long); i+=sizeof(long)){
         long a = *(long*)(src1+i);
         long b = *(long*)(src2+i);
         *(long*)(dst+i) = ((a|pb_80) - (b&pb_7f)) ^ ((a^b^pb_80)&pb_80);
path: libavcodec/dsputil.c
Vulnerability: The get_siz function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not prevent attempts to use non-zero image offsets, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG2000 data.
Vulnerability ID: CVE-2013-7012
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/FFmpeg/FFmpeg
Published: 2013-12-09
File: libavcodec/jpeg2000dec.c
Commit message: avcodec/jpeg2000dec: non zero image offsets are not supported

Fixes out of array accesses
Fixes Ticket3080
Found-by: ami_stuff
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static int get_siz(Jpeg2000DecoderContext *s)     s->tile_offset_y  = bytestream2_get_be32u(&s->g); // YT0Siz     ncomponents       = bytestream2_get_be16u(&s->g); // CSiz      if (ncomponents <= 0) {         av_log(s->avctx, AV_LOG_ERROR, "Invalid number of components: %d\n",                s->ncomponents);

Fixed version (after fix):
 static int get_siz(Jpeg2000DecoderContext *s)     s->tile_offset_y  = bytestream2_get_be32u(&s->g); // YT0Siz     ncomponents       = bytestream2_get_be16u(&s->g); // CSiz      if (s->image_offset_x || s->image_offset_y) {         avpriv_request_sample(s->avctx, "Support for image offsets");         return AVERROR_PATCHWELCOME;     }      if (ncomponents <= 0) {         av_log(s->avctx, AV_LOG_ERROR, "Invalid number of components: %d\n",                s->ncomponents);

Patch:
patch: @@ -243,6 +243,11 @@ static int get_siz(Jpeg2000DecoderContext *s)
     s->tile_offset_y  = bytestream2_get_be32u(&s->g); // YT0Siz
     ncomponents       = bytestream2_get_be16u(&s->g); // CSiz
 
+    if (s->image_offset_x || s->image_offset_y) {
+        avpriv_request_sample(s->avctx, "Support for image offsets");
+        return AVERROR_PATCHWELCOME;
+    }
+
     if (ncomponents <= 0) {
         av_log(s->avctx, AV_LOG_ERROR, "Invalid number of components: %d\n",
                s->ncomponents);
path: libavcodec/jpeg2000dec.c
Vulnerability: The g2m_init_buffers function in libavcodec/g2meet.c in FFmpeg before 2.1 uses an incorrect ordering of arithmetic operations, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Go2Webinar data.
Vulnerability ID: CVE-2013-7013
CWE: CWE-189
Severity score: 6.4
Project: https://github.com/FFmpeg/FFmpeg
Published: 2013-12-09
File: libavcodec/g2meet.c
Commit message: avcodec/g2meet: Fix order of align and pixel size multiplication.

Fixes out of array accesses
Fixes Ticket2922

Found-by: ami_stuff
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static int g2m_init_buffers(G2MContext *c)     if (!c->synth_tile || !c->jpeg_tile ||         c->old_tile_w < c->tile_width ||         c->old_tile_h < c->tile_height) {         c->tile_stride = FFALIGN(c->tile_width * 3, 16);         aligned_height = FFALIGN(c->tile_height,    16);         av_free(c->synth_tile);         av_free(c->jpeg_tile);

Fixed version (after fix):
 static int g2m_init_buffers(G2MContext *c)     if (!c->synth_tile || !c->jpeg_tile ||         c->old_tile_w < c->tile_width ||         c->old_tile_h < c->tile_height) {         c->tile_stride = FFALIGN(c->tile_width, 16) * 3;         aligned_height = FFALIGN(c->tile_height,    16);         av_free(c->synth_tile);         av_free(c->jpeg_tile);

Patch:
patch: @@ -453,7 +453,7 @@ static int g2m_init_buffers(G2MContext *c)
     if (!c->synth_tile || !c->jpeg_tile ||
         c->old_tile_w < c->tile_width ||
         c->old_tile_h < c->tile_height) {
-        c->tile_stride = FFALIGN(c->tile_width * 3, 16);
+        c->tile_stride = FFALIGN(c->tile_width, 16) * 3;
         aligned_height = FFALIGN(c->tile_height,    16);
         av_free(c->synth_tile);
         av_free(c->jpeg_tile);
path: libavcodec/g2meet.c
Vulnerability: Integer signedness error in the add_bytes_l2_c function in libavcodec/pngdsp.c in FFmpeg before 2.1 allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted PNG data.
Vulnerability ID: CVE-2013-7014
CWE: CWE-189
Severity score: 6.4
Project: https://github.com/FFmpeg/FFmpeg
Published: 2013-12-09
File: libavcodec/pngdsp.c
Commit message: avcodec/pngdsp: fix (un)signed type in end comparission

Fixes out of array accesses
Fixes Ticket2919

Found_by: ami_stuff
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static void add_bytes_l2_c(uint8_t *dst, uint8_t *src1, uint8_t *src2, int w) {     long i;     for (i = 0; i <= w - sizeof(long); i += sizeof(long)) {         long a = *(long *)(src1 + i);         long b = *(long *)(src2 + i);         *(long *)(dst + i) = ((a & pb_7f) + (b & pb_7f)) ^ ((a ^ b) & pb_80);

Fixed version (after fix):
 static void add_bytes_l2_c(uint8_t *dst, uint8_t *src1, uint8_t *src2, int w) {     long i;     for (i = 0; i <= w - (int)sizeof(long); i += sizeof(long)) {         long a = *(long *)(src1 + i);         long b = *(long *)(src2 + i);         *(long *)(dst + i) = ((a & pb_7f) + (b & pb_7f)) ^ ((a ^ b) & pb_80);

Patch:
patch: @@ -31,7 +31,7 @@
 static void add_bytes_l2_c(uint8_t *dst, uint8_t *src1, uint8_t *src2, int w)
 {
     long i;
-    for (i = 0; i <= w - sizeof(long); i += sizeof(long)) {
+    for (i = 0; i <= w - (int)sizeof(long); i += sizeof(long)) {
         long a = *(long *)(src1 + i);
         long b = *(long *)(src2 + i);
         *(long *)(dst + i) = ((a & pb_7f) + (b & pb_7f)) ^ ((a ^ b) & pb_80);
path: libavcodec/pngdsp.c
Vulnerability: The flashsv_decode_frame function in libavcodec/flashsv.c in FFmpeg before 2.1 does not properly validate a certain height value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Flash Screen Video data.
Vulnerability ID: CVE-2013-7015
CWE: CWE-20
Severity score: 6.4
Project: https://github.com/FFmpeg/FFmpeg
Published: 2013-12-09
File: libavcodec/flashsv.c
Commit message: avcodec/flashsv: check diff_start/height

Fixes out of array accesses
Fixes Ticket2844

Found-by: ami_stuff
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static int flashsv_decode_frame(AVCodecContext *avctx, void *data,                     }                     s->diff_start  = get_bits(&gb, 8);                     s->diff_height = get_bits(&gb, 8);                     av_log(avctx, AV_LOG_DEBUG,                            "%dx%d diff start %d height %d\n",                            i, j, s->diff_start, s->diff_height);

Fixed version (after fix):
 static int flashsv_decode_frame(AVCodecContext *avctx, void *data,                     }                     s->diff_start  = get_bits(&gb, 8);                     s->diff_height = get_bits(&gb, 8);                     if (s->diff_start + s->diff_height > cur_blk_height) {                         av_log(avctx, AV_LOG_ERROR, "Block parameters invalid\n");                         return AVERROR_INVALIDDATA;                     }                     av_log(avctx, AV_LOG_DEBUG,                            "%dx%d diff start %d height %d\n",                            i, j, s->diff_start, s->diff_height);

Patch:
patch: @@ -387,6 +387,10 @@ static int flashsv_decode_frame(AVCodecContext *avctx, void *data,
                     }
                     s->diff_start  = get_bits(&gb, 8);
                     s->diff_height = get_bits(&gb, 8);
+                    if (s->diff_start + s->diff_height > cur_blk_height) {
+                        av_log(avctx, AV_LOG_ERROR, "Block parameters invalid\n");
+                        return AVERROR_INVALIDDATA;
+                    }
                     av_log(avctx, AV_LOG_DEBUG,
                            "%dx%d diff start %d height %d\n",
                            i, j, s->diff_start, s->diff_height);
path: libavcodec/flashsv.c
Vulnerability: The get_siz function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not ensure the expected sample separation, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG2000 data.
Vulnerability ID: CVE-2013-7016
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/FFmpeg/FFmpeg
Published: 2013-12-09
File: libavcodec/jpeg2000dec.c
Commit message: avcodec/jpeg2000dec: Check cdx/y values more carefully

Some invalid values where not handled correctly in the later pixel
format matching code.
Fixes out of array accesses
Fixes Ticket2848

Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static int get_siz(Jpeg2000DecoderContext *s)         s->sgnd[i]   = !!(x & 0x80);         s->cdx[i]    = bytestream2_get_byteu(&s->g);         s->cdy[i]    = bytestream2_get_byteu(&s->g);         if (!s->cdx[i] || !s->cdy[i]) {             av_log(s->avctx, AV_LOG_ERROR, "Invalid sample seperation\n");             return AVERROR_INVALIDDATA;         }

Fixed version (after fix):
 static int get_siz(Jpeg2000DecoderContext *s)         s->sgnd[i]   = !!(x & 0x80);         s->cdx[i]    = bytestream2_get_byteu(&s->g);         s->cdy[i]    = bytestream2_get_byteu(&s->g);         if (   !s->cdx[i] || s->cdx[i] == 3 || s->cdx[i] > 4             || !s->cdy[i] || s->cdy[i] == 3 || s->cdy[i] > 4) {             av_log(s->avctx, AV_LOG_ERROR, "Invalid sample seperation\n");             return AVERROR_INVALIDDATA;         }

Patch:
patch: @@ -273,7 +273,8 @@ static int get_siz(Jpeg2000DecoderContext *s)
         s->sgnd[i]   = !!(x & 0x80);
         s->cdx[i]    = bytestream2_get_byteu(&s->g);
         s->cdy[i]    = bytestream2_get_byteu(&s->g);
-        if (!s->cdx[i] || !s->cdy[i]) {
+        if (   !s->cdx[i] || s->cdx[i] == 3 || s->cdx[i] > 4
+            || !s->cdy[i] || s->cdy[i] == 3 || s->cdy[i] > 4) {
             av_log(s->avctx, AV_LOG_ERROR, "Invalid sample seperation\n");
             return AVERROR_INVALIDDATA;
         }
path: libavcodec/jpeg2000dec.c
Vulnerability: The filter_frame function in libavfilter/vf_fps.c in FFmpeg before 2.1 does not properly ensure the availability of FIFO content, which allows remote attackers to cause a denial of service (double free) or possibly have unspecified other impact via crafted data.
Vulnerability ID: CVE-2013-7021
CWE: CWE-399
Severity score: 6.4
Project: https://github.com/FFmpeg/FFmpeg
Published: 2013-12-09
File: libavfilter/vf_fps.c
Commit message: avfilter/vf_fps: make sure the fifo is not empty before using it

Fixes Ticket2905

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static int filter_frame(AVFilterLink *inlink, AVFrame *buf)     }      /* now wait for the next timestamp */     if (buf->pts == AV_NOPTS_VALUE) {         return write_to_fifo(s->fifo, buf);     } 

Fixed version (after fix):
 static int filter_frame(AVFilterLink *inlink, AVFrame *buf)     }      /* now wait for the next timestamp */     if (buf->pts == AV_NOPTS_VALUE || av_fifo_size(s->fifo) <= 0) {         return write_to_fifo(s->fifo, buf);     } 

Patch:
patch: @@ -205,7 +205,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *buf)
     }
 
     /* now wait for the next timestamp */
-    if (buf->pts == AV_NOPTS_VALUE) {
+    if (buf->pts == AV_NOPTS_VALUE || av_fifo_size(s->fifo) <= 0) {
         return write_to_fifo(s->fifo, buf);
     }
path: libavfilter/vf_fps.c