rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: A missing authorization check in the fscrypt_process_policy function in fs/crypto/policy.c in the ext4 and f2fs filesystem encryption support in the Linux kernel before 4.7.4 allows a user to assign an encryption policy to a directory owned by a different user, potentially creating a denial of service.
Vulnerability ID: CVE-2016-10318
CWE: CWE-264
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2017-04-04
File: fs/crypto/policy.c
Commit message: fscrypto: add authorization check for setting encryption policy

On an ext4 or f2fs filesystem with file encryption supported, a user
could set an encryption policy on any empty directory(*) to which they
had readonly access.  This is obviously problematic, since such a
directory might be owned by another user and the new encryption policy
would prevent that other user from creating files in their own directory
(for example).

Fix this by requiring inode_owner_or_capable() permission to set an
encryption policy.  This means that either the caller must own the file,
or the caller must have the capability CAP_FOWNER.

(*) Or also on any regular file, for f2fs v4.6 and later and ext4
    v4.8-rc1 and later; a separate bug fix is coming for that.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Cc: stable@vger.kernel.org # 4.1+; check fs/{ext4,f2fs}
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Commit author: Eric Biggers

Vulnerable version (before fix):
 static int create_encryption_context_from_policy(struct inode *inode, int fscrypt_process_policy(struct inode *inode, 				const struct fscrypt_policy *policy) { 	if (policy->version != 0) 		return -EINVAL; 

Fixed version (after fix):
 static int create_encryption_context_from_policy(struct inode *inode, int fscrypt_process_policy(struct inode *inode, 				const struct fscrypt_policy *policy) { 	if (!inode_owner_or_capable(inode)) 		return -EACCES;  	if (policy->version != 0) 		return -EINVAL; 

Patch:
patch: @@ -95,6 +95,9 @@ static int create_encryption_context_from_policy(struct inode *inode,
 int fscrypt_process_policy(struct inode *inode,
 				const struct fscrypt_policy *policy)
 {
+	if (!inode_owner_or_capable(inode))
+		return -EACCES;
+
 	if (policy->version != 0)
 		return -EINVAL;
path: fs/crypto/policy.c
Vulnerability: Heap-based buffer overflow vulnerability in the opj_mqc_byteout function in mqc.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service (application crash) via a crafted bmp file.
Vulnerability ID: CVE-2016-10504
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/uclouvain/openjpeg
Published: 2017-08-30
File: src/lib/openjp2/tcd.c
Commit message: Fix write heap buffer overflow in opj_mqc_byteout(). Discovered by Ke Liu of Tencent's Xuanwu LAB (#835)
Commit author: Even Rouault

Vulnerable version (before fix):
 static OPJ_BOOL opj_tcd_code_block_enc_allocate_data(opj_tcd_cblk_enc_t * {     OPJ_UINT32 l_data_size;      l_data_size = (OPJ_UINT32)((p_code_block->x1 - p_code_block->x0) *                                (p_code_block->y1 - p_code_block->y0) * (OPJ_INT32)sizeof(OPJ_UINT32));      if (l_data_size > p_code_block->data_size) {         if (p_code_block->data) {

Fixed version (after fix):
 static OPJ_BOOL opj_tcd_code_block_enc_allocate_data(opj_tcd_cblk_enc_t * {     OPJ_UINT32 l_data_size;      /* The +1 is needed for https://github.com/uclouvain/openjpeg/issues/835 */     l_data_size = 1 + (OPJ_UINT32)((p_code_block->x1 - p_code_block->x0) *                                    (p_code_block->y1 - p_code_block->y0) * (OPJ_INT32)sizeof(OPJ_UINT32));      if (l_data_size > p_code_block->data_size) {         if (p_code_block->data) {

Patch:
patch: @@ -1182,8 +1182,9 @@ static OPJ_BOOL opj_tcd_code_block_enc_allocate_data(opj_tcd_cblk_enc_t *
 {
     OPJ_UINT32 l_data_size;
 
-    l_data_size = (OPJ_UINT32)((p_code_block->x1 - p_code_block->x0) *
-                               (p_code_block->y1 - p_code_block->y0) * (OPJ_INT32)sizeof(OPJ_UINT32));
+    /* The +1 is needed for https://github.com/uclouvain/openjpeg/issues/835 */
+    l_data_size = 1 + (OPJ_UINT32)((p_code_block->x1 - p_code_block->x0) *
+                                   (p_code_block->y1 - p_code_block->y0) * (OPJ_INT32)sizeof(OPJ_UINT32));
 
     if (l_data_size > p_code_block->data_size) {
         if (p_code_block->data) {
path: src/lib/openjp2/tcd.c
Vulnerability: Integer overflow vulnerability in the bmp24toimage function in convertbmp.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted bmp file.
Vulnerability ID: CVE-2016-10507
CWE: CWE-190
Severity score: 2.9
Project: https://github.com/uclouvain/openjpeg
Published: 2017-08-30
File: src/bin/jp2/convertbmp.c
Commit message: Merge pull request #834 from trylab/issue833

Fix issue 833.
Commit author: Antonin Descampe

Vulnerable version (before fix):
 opj_image_t* bmptoimage(const char *filename, opj_cparameters_t *parameters) 		} 	} 	 	stride = ((Info_h.biWidth * Info_h.biBitCount + 31U) / 32U) * 4U; /* rows are aligned on 32bits */ 	if (Info_h.biBitCount == 4 && Info_h.biCompression == 2) { /* RLE 4 gets decoded as 8 bits data for now... */ 		stride = ((Info_h.biWidth * 8U + 31U) / 32U) * 4U; 	} 	pData = (OPJ_UINT8 *) calloc(1, stride * Info_h.biHeight * sizeof(OPJ_UINT8)); 	if (pData == NULL) { 		fclose(IN);

Fixed version (after fix):
 opj_image_t* bmptoimage(const char *filename, opj_cparameters_t *parameters) 		} 	} 	 	if (Info_h.biWidth == 0 || Info_h.biHeight == 0) { 		fclose(IN); 		return NULL; 	} 	 	if (Info_h.biBitCount > (((OPJ_UINT32)-1) - 31) / Info_h.biWidth) { 		fclose(IN); 		return NULL; 	} 	stride = ((Info_h.biWidth * Info_h.biBitCount + 31U) / 32U) * 4U; /* rows are aligned on 32bits */ 	if (Info_h.biBitCount == 4 && Info_h.biCompression == 2) { /* RLE 4 gets decoded as 8 bits data for now... */ 		if (8 > (((OPJ_UINT32)-1) - 31) / Info_h.biWidth) { 			fclose(IN); 			return NULL; 		} 		stride = ((Info_h.biWidth * 8U + 31U) / 32U) * 4U; 	} 	 	if (stride > ((OPJ_UINT32)-1) / sizeof(OPJ_UINT8) / Info_h.biHeight) { 		fclose(IN); 		return NULL; 	} 	pData = (OPJ_UINT8 *) calloc(1, stride * Info_h.biHeight * sizeof(OPJ_UINT8)); 	if (pData == NULL) { 		fclose(IN);

Patch:
patch: @@ -675,10 +675,28 @@ opj_image_t* bmptoimage(const char *filename, opj_cparameters_t *parameters)
 		}
 	}
 	
+	if (Info_h.biWidth == 0 || Info_h.biHeight == 0) {
+		fclose(IN);
+		return NULL;
+	}
+	
+	if (Info_h.biBitCount > (((OPJ_UINT32)-1) - 31) / Info_h.biWidth) {
+		fclose(IN);
+		return NULL;
+	}
 	stride = ((Info_h.biWidth * Info_h.biBitCount + 31U) / 32U) * 4U; /* rows are aligned on 32bits */
 	if (Info_h.biBitCount == 4 && Info_h.biCompression == 2) { /* RLE 4 gets decoded as 8 bits data for now... */
+		if (8 > (((OPJ_UINT32)-1) - 31) / Info_h.biWidth) {
+			fclose(IN);
+			return NULL;
+		}
 		stride = ((Info_h.biWidth * 8U + 31U) / 32U) * 4U;
 	}
+	
+	if (stride > ((OPJ_UINT32)-1) / sizeof(OPJ_UINT8) / Info_h.biHeight) {
+		fclose(IN);
+		return NULL;
+	}
 	pData = (OPJ_UINT8 *) calloc(1, stride * Info_h.biHeight * sizeof(OPJ_UINT8));
 	if (pData == NULL) {
 		fclose(IN);
path: src/bin/jp2/convertbmp.c
Vulnerability: SQL injection vulnerability in the updateAmazonOrderTracking function in upload/admin/model/openbay/amazon.php in OpenCart before version 2.3.0.0 allows remote authenticated administrators to execute arbitrary SQL commands via a carrier (aka courier_id) parameter to openbay.php.
Vulnerability ID: CVE-2016-10509
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/opencart/opencart
Published: 2017-08-31
File: upload/admin/model/openbay/amazon.php
Commit message: https://github.com/opencart/opencart/issues/4114
Commit author: Daniel Kerr

Vulnerable version (before fix):
 public function getOrderStatusString($order_id) { 	public function updateAmazonOrderTracking($order_id, $courier_id, $courier_from_list, $tracking_no) { 		$this->db->query(" 			UPDATE `" . DB_PREFIX . "amazon_order` 			SET `courier_id` = '" . $courier_id . "', 				`courier_other` = " . (int)!$courier_from_list . ", 				`tracking_no` = '" . $tracking_no . "' 			WHERE `order_id` = " . (int)$order_id . ""); 	} 

Fixed version (after fix):
 public function getOrderStatusString($order_id) { 	public function updateAmazonOrderTracking($order_id, $courier_id, $courier_from_list, $tracking_no) { 		$this->db->query(" 			UPDATE `" . DB_PREFIX . "amazon_order` 			SET `courier_id` = '" . $this->db->escape($courier_id) . "', 				`courier_other` = " . (int)!$courier_from_list . ", 				`tracking_no` = '" . $this->db->escape($tracking_no) . "' 			WHERE `order_id` = " . (int)$order_id . ""); 	} 

Patch:
patch: @@ -493,9 +493,9 @@ public function getOrderStatusString($order_id) {
 	public function updateAmazonOrderTracking($order_id, $courier_id, $courier_from_list, $tracking_no) {
 		$this->db->query("
 			UPDATE `" . DB_PREFIX . "amazon_order`
-			SET `courier_id` = '" . $courier_id . "',
+			SET `courier_id` = '" . $this->db->escape($courier_id) . "',
 				`courier_other` = " . (int)!$courier_from_list . ",
-				`tracking_no` = '" . $tracking_no . "'
+				`tracking_no` = '" . $this->db->escape($tracking_no) . "'
 			WHERE `order_id` = " . (int)$order_id . "");
 	}
path: upload/admin/model/openbay/amazon.php
Vulnerability: auth_login.php in Cacti before 1.0.0 allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti database, because the guest user is not considered. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-2313.
Vulnerability ID: CVE-2016-10700
CWE: CWE-264
Severity score: 6.4
Project: https://github.com/Cacti/cacti
Published: 2017-11-24
File: auth_login.php
Commit message: fixing bug #2697

web basic for guest accounts
Commit author: cigamit

Vulnerable version (before fix):
 		/* Locate user in database */ 		$user = db_fetch_row_prepared('SELECT * FROM user_auth WHERE username = ? AND realm = 2', array($username));  		if (!$user && read_config_option('user_template') == '0') { 			cacti_log("ERROR: User '" . $username . "' authenticated by Web Server, but a Template User is not defined in Cacti.  Exiting.", false, 'AUTH'); 			$username = htmlspecialchars($username); 			auth_display_custom_error_message( __('%s authenticated by Web Server, but a Template User is not defined in Cacti.', $username) ); 			exit;			 		} 

Fixed version (after fix):
 		/* Locate user in database */ 		$user = db_fetch_row_prepared('SELECT * FROM user_auth WHERE username = ? AND realm = 2', array($username));  		if (!$user && read_config_option('user_template') == '0' && read_config_option('guest_user') == '0') { 			cacti_log("ERROR: User '" . $username . "' authenticated by Web Server, but both Template and Guest Users are not defined in Cacti.  Exiting.", false, 'AUTH'); 			$username = htmlspecialchars($username); 			auth_display_custom_error_message( __('%s authenticated by Web Server, but both Template and Guest Users are not defined in Cacti.', $username) ); 			exit;			 		} 

Patch:
patch: @@ -91,10 +91,10 @@
 		/* Locate user in database */
 		$user = db_fetch_row_prepared('SELECT * FROM user_auth WHERE username = ? AND realm = 2', array($username));
 
-		if (!$user && read_config_option('user_template') == '0') {
-			cacti_log("ERROR: User '" . $username . "' authenticated by Web Server, but a Template User is not defined in Cacti.  Exiting.", false, 'AUTH');
+		if (!$user && read_config_option('user_template') == '0' && read_config_option('guest_user') == '0') {
+			cacti_log("ERROR: User '" . $username . "' authenticated by Web Server, but both Template and Guest Users are not defined in Cacti.  Exiting.", false, 'AUTH');
 			$username = htmlspecialchars($username);
-			auth_display_custom_error_message( __('%s authenticated by Web Server, but a Template User is not defined in Cacti.', $username) );
+			auth_display_custom_error_message( __('%s authenticated by Web Server, but both Template and Guest Users are not defined in Cacti.', $username) );
 			exit;			
 		}
path: auth_login.php
Vulnerability: parse_string in cJSON.c in cJSON before 2016-10-02 has a buffer over-read, as demonstrated by a string that begins with a " character and ends with a \ character.
Vulnerability ID: CVE-2016-10749
CWE: CWE-125
Severity score: 6.4
Project: https://github.com/DaveGamble/cJSON
Published: 2019-04-29
File: cJSON.c
Commit message: fix buffer overflow (#30)
Commit author: Max Bruckner

Vulnerable version (before fix):
 static const char *parse_string(cJSON *item,const char *str,const char **ep) { 	const char *ptr=str+1,*end_ptr=str+1;char *ptr2;char *out;int len=0;unsigned uc,uc2; 	if (*str!='\"') {*ep=str;return 0;}	/* not a string! */ 	 	while (*end_ptr!='\"' && *end_ptr && ++len) if (*end_ptr++ == '\\') end_ptr++;	/* Skip escaped quotes. */ 	 	out=(char*)cJSON_malloc(len+1);	/* This is how long we need for the string, roughly. */ 	if (!out) return 0; 	item->valuestring=out; /* assign here so out will be deleted during cJSON_Delete() later */

Fixed version (after fix):
 static const char *parse_string(cJSON *item,const char *str,const char **ep) { 	const char *ptr=str+1,*end_ptr=str+1;char *ptr2;char *out;int len=0;unsigned uc,uc2; 	if (*str!='\"') {*ep=str;return 0;}	/* not a string! */  	while (*end_ptr!='\"' && *end_ptr && ++len) 	{ 	    if (*end_ptr++ == '\\') 	    { 		if (*end_ptr == '\0') 		{ 		    /* prevent buffer overflow when last input character is a backslash */ 		    return 0; 		} 		end_ptr++;	/* Skip escaped quotes. */ 	    } 	}  	out=(char*)cJSON_malloc(len+1);	/* This is how long we need for the string, roughly. */ 	if (!out) return 0; 	item->valuestring=out; /* assign here so out will be deleted during cJSON_Delete() later */

Patch:
patch: @@ -194,9 +194,20 @@ static const char *parse_string(cJSON *item,const char *str,const char **ep)
 {
 	const char *ptr=str+1,*end_ptr=str+1;char *ptr2;char *out;int len=0;unsigned uc,uc2;
 	if (*str!='\"') {*ep=str;return 0;}	/* not a string! */
-	
-	while (*end_ptr!='\"' && *end_ptr && ++len) if (*end_ptr++ == '\\') end_ptr++;	/* Skip escaped quotes. */
-	
+
+	while (*end_ptr!='\"' && *end_ptr && ++len)
+	{
+	    if (*end_ptr++ == '\\')
+	    {
+		if (*end_ptr == '\0')
+		{
+		    /* prevent buffer overflow when last input character is a backslash */
+		    return 0;
+		}
+		end_ptr++;	/* Skip escaped quotes. */
+	    }
+	}
+
 	out=(char*)cJSON_malloc(len+1);	/* This is how long we need for the string, roughly. */
 	if (!out) return 0;
 	item->valuestring=out; /* assign here so out will be deleted during cJSON_Delete() later */
path: cJSON.c
Vulnerability: In the Linux kernel before 4.9.6, there is an off by one in the drivers/mtd/spi-nor/cadence-quadspi.c cqspi_setup_flash() function. There are CQSPI_MAX_CHIPSELECT elements in the ->f_pdata array so the ">" should be ">=" instead.
Vulnerability ID: CVE-2016-10764
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2019-07-27
File: drivers/mtd/spi-nor/cadence-quadspi.c
Commit message: mtd: spi-nor: Off by one in cqspi_setup_flash()

There are CQSPI_MAX_CHIPSELECT elements in the ->f_pdata array so the >
should be >=.

Fixes: 140623410536 ('mtd: spi-nor: Add driver for Cadence Quad SPI Flash Controller')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Marek Vasut <marex@denx.de>
Signed-off-by: Cyrille Pitchen <cyrille.pitchen@atmel.com>
Commit author: Dan Carpenter

Vulnerable version (before fix):
 static int cqspi_setup_flash(struct cqspi_st *cqspi, struct device_node *np) 			goto err; 		}  		if (cs > CQSPI_MAX_CHIPSELECT) { 			dev_err(dev, "Chip select %d out of range.\n", cs); 			goto err; 		}

Fixed version (after fix):
 static int cqspi_setup_flash(struct cqspi_st *cqspi, struct device_node *np) 			goto err; 		}  		if (cs >= CQSPI_MAX_CHIPSELECT) { 			dev_err(dev, "Chip select %d out of range.\n", cs); 			goto err; 		}

Patch:
patch: @@ -1082,7 +1082,7 @@ static int cqspi_setup_flash(struct cqspi_st *cqspi, struct device_node *np)
 			goto err;
 		}
 
-		if (cs > CQSPI_MAX_CHIPSELECT) {
+		if (cs >= CQSPI_MAX_CHIPSELECT) {
 			dev_err(dev, "Chip select %d out of range.\n", cs);
 			goto err;
 		}
path: drivers/mtd/spi-nor/cadence-quadspi.c
Vulnerability: The supportflow plugin before 0.7 for WordPress has XSS via a ticket excerpt.
Vulnerability ID: CVE-2016-10970
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/SupportFlow/supportflow
Published: 2019-09-16
File: classes/class-supportflow-admin.php
Commit message: Admin: Escape ticket excerpt on Tickets screen to avoid XSS.

An attacker could submit the following payload via `[supportflow_submissionform]` to perform cross-site-scripting:

`<script>alert('XSS');</script>`

That attack has a CVSS score of 6.1 - https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Props https://hackerone.com/whitehatter for discovering and disclosing responsibly.

Fixes https://hackerone.com/reports/145091
Commit author: Ian Dunn

Vulnerable version (before fix):
 function action_manage_posts_custom_column( $column_name, $ticket_id ) { 				if ( strlen( $first_reply ) > 50 ) { 					$first_reply = substr( $first_reply, 0, 50 ); 				} 				echo $first_reply; 				break; 			case 'customers': 				$customers = SupportFlow()->get_ticket_customers( $ticket_id, array( 'fields' => 'emails' ) );

Fixed version (after fix):
 function action_manage_posts_custom_column( $column_name, $ticket_id ) { 				if ( strlen( $first_reply ) > 50 ) { 					$first_reply = substr( $first_reply, 0, 50 ); 				} 				echo esc_html( $first_reply ); 				break; 			case 'customers': 				$customers = SupportFlow()->get_ticket_customers( $ticket_id, array( 'fields' => 'emails' ) );

Patch:
patch: @@ -1185,7 +1185,7 @@ function action_manage_posts_custom_column( $column_name, $ticket_id ) {
 				if ( strlen( $first_reply ) > 50 ) {
 					$first_reply = substr( $first_reply, 0, 50 );
 				}
-				echo $first_reply;
+				echo esc_html( $first_reply );
 				break;
 			case 'customers':
 				$customers = SupportFlow()->get_ticket_customers( $ticket_id, array( 'fields' => 'emails' ) );
path: classes/class-supportflow-admin.php
Vulnerability: It was discovered that the zebra daemon in Quagga before 1.0.20161017 suffered from a stack-based buffer overflow when processing IPv6 Neighbor Discovery messages. The root cause was relying on BUFSIZ to be compatible with a message size; however, BUFSIZ is system-dependent.
Vulnerability ID: CVE-2016-1245
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/Quagga/quagga
Published: 2017-02-22
File: zebra/rtadv.c
Commit message: zebra: stack overrun in IPv6 RA receive code (CVE-2016-1245)

The IPv6 RA code also receives ICMPv6 RS and RA messages.
Unfortunately, by bad coding practice, the buffer size specified on
receiving such messages mixed up 2 constants that in fact have
different values.

The code itself has:
 #define RTADV_MSG_SIZE 4096
While BUFSIZ is system-dependent, in my case (x86_64 glibc):
 /usr/include/_G_config.h:#define _G_BUFSIZ 8192
 /usr/include/libio.h:#define _IO_BUFSIZ _G_BUFSIZ
 /usr/include/stdio.h:# define BUFSIZ _IO_BUFSIZ

FreeBSD, OpenBSD, NetBSD and Illumos are not affected, since all of them
have BUFSIZ == 1024.

As the latter is passed to the kernel on recvmsg(), it's possible to
overwrite 4kB of stack -- with ICMPv6 packets that can be globally sent
to any of the system's addresses (using fragmentation to get to 8k).

(The socket has filters installed limiting this to RS and RA packets,
but does not have a filter for source address or TTL.)

Issue discovered by trying to test other stuff, which randomly caused
the stack to be smaller than 8kB in that code location, which then
causes the kernel to report EFAULT (Bad address).

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
Reviewed-by: Donald Sharp <sharpd@cumulusnetworks.com>
Commit author: David Lamparter

Vulnerable version (before fix):
 rtadv_read (struct thread *thread)   /* Register myself. */   rtadv_event (zvrf, RTADV_READ, sock);    len = rtadv_recv_packet (sock, buf, BUFSIZ, &from, &ifindex, &hoplimit);    if (len < 0)      {

Fixed version (after fix):
 rtadv_read (struct thread *thread)   /* Register myself. */   rtadv_event (zvrf, RTADV_READ, sock);    len = rtadv_recv_packet (sock, buf, sizeof (buf), &from, &ifindex, &hoplimit);    if (len < 0)      {

Patch:
patch: @@ -482,7 +482,7 @@ rtadv_read (struct thread *thread)
   /* Register myself. */
   rtadv_event (zvrf, RTADV_READ, sock);
 
-  len = rtadv_recv_packet (sock, buf, BUFSIZ, &from, &ifindex, &hoplimit);
+  len = rtadv_recv_packet (sock, buf, sizeof (buf), &from, &ifindex, &hoplimit);
 
   if (len < 0) 
     {
path: zebra/rtadv.c
Vulnerability: Buffer overflow in the DBD::mysql module before 4.037 for Perl allows context-dependent attackers to cause a denial of service (crash) via vectors related to an error message.
Vulnerability ID: CVE-2016-1246
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/perl5-dbi/DBD-mysql
Published: 2016-10-05
File: dbdimp.c
Commit message: Do not use unsafe sprintf w/variable length input

This can cause a  buffer overflow to occur when reporting error
message about validation of (untrusted) user input parameters.
Commit author: Pali

Vulnerable version (before fix):
 int dbd_bind_ph(SV *sth, imp_sth_t *imp_sth, SV *param, SV *value,   int rc;   int param_num= SvIV(param);   int idx= param_num - 1;   char err_msg[64];   D_imp_xxh(sth);  #if MYSQL_VERSION_ID >= SERVER_PREPARE_VERSION int dbd_bind_ph(SV *sth, imp_sth_t *imp_sth, SV *param, SV *value,   {     if (! looks_like_number(value))     {       sprintf(err_msg,               "Binding non-numeric field %d, value %s as a numeric!",               param_num, neatsvpv(value,0));       do_error(sth, JW_ERR_ILLEGAL_PARAM_NUM, err_msg, NULL);     }   }

Fixed version (after fix):
 int dbd_bind_ph(SV *sth, imp_sth_t *imp_sth, SV *param, SV *value,   int rc;   int param_num= SvIV(param);   int idx= param_num - 1;   char *err_msg;   D_imp_xxh(sth);  #if MYSQL_VERSION_ID >= SERVER_PREPARE_VERSION int dbd_bind_ph(SV *sth, imp_sth_t *imp_sth, SV *param, SV *value,   {     if (! looks_like_number(value))     {       err_msg = SvPVX(sv_2mortal(newSVpvf(               "Binding non-numeric field %d, value %s as a numeric!",               param_num, neatsvpv(value,0))));       do_error(sth, JW_ERR_ILLEGAL_PARAM_NUM, err_msg, NULL);     }   }

Patch:
patch: @@ -4783,7 +4783,7 @@ int dbd_bind_ph(SV *sth, imp_sth_t *imp_sth, SV *param, SV *value,
   int rc;
   int param_num= SvIV(param);
   int idx= param_num - 1;
-  char err_msg[64];
+  char *err_msg;
   D_imp_xxh(sth);
 
 #if MYSQL_VERSION_ID >= SERVER_PREPARE_VERSION
@@ -4826,9 +4826,9 @@ int dbd_bind_ph(SV *sth, imp_sth_t *imp_sth, SV *param, SV *value,
   {
     if (! looks_like_number(value))
     {
-      sprintf(err_msg,
+      err_msg = SvPVX(sv_2mortal(newSVpvf(
               "Binding non-numeric field %d, value %s as a numeric!",
-              param_num, neatsvpv(value,0));
+              param_num, neatsvpv(value,0))));
       do_error(sth, JW_ERR_ILLEGAL_PARAM_NUM, err_msg, NULL);
     }
   }
path: dbdimp.c