rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: repodata_schema2id in repodata.c in libsolv before 0.7.6 has a heap-based buffer over-read via a last schema whose length is less than the length of the input schema.
Vulnerability ID: CVE-2019-20387
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/openSUSE/libsolv
Published: 2020-01-21
File: src/repodata.c
Commit message: repodata_schema2id: fix heap-buffer-overflow in memcmp

When the length of last schema in data->schemadata is
less than length of input schema, we got a read overflow
in asan test.

Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com>
Commit author: Zhipeng Xie

Vulnerable version (before fix):
 repodata_schema2id(Repodata *data, Id *schema, int create)   cid = schematahash[h];   if (cid)     {       if (!memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))         return cid;       /* cache conflict, do a slow search */       for (cid = 1; cid < data->nschemata; cid++)         if (!memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))           return cid;     }   /* a new one */

Fixed version (after fix):
 repodata_schema2id(Repodata *data, Id *schema, int create)   cid = schematahash[h];   if (cid)     {       if ((data->schemata[cid] + len <= data->schemadatalen) && 			  !memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))         return cid;       /* cache conflict, do a slow search */       for (cid = 1; cid < data->nschemata; cid++)         if ((data->schemata[cid] + len <= data->schemadatalen) && 				!memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))           return cid;     }   /* a new one */

Patch:
patch: @@ -211,11 +211,13 @@ repodata_schema2id(Repodata *data, Id *schema, int create)
   cid = schematahash[h];
   if (cid)
     {
-      if (!memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))
+      if ((data->schemata[cid] + len <= data->schemadatalen) &&
+			  !memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))
         return cid;
       /* cache conflict, do a slow search */
       for (cid = 1; cid < data->nschemata; cid++)
-        if (!memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))
+        if ((data->schemata[cid] + len <= data->schemadatalen) &&
+				!memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))
           return cid;
     }
   /* a new one */
path: src/repodata.c
Vulnerability: An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash.
Vulnerability ID: CVE-2019-20391
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/CESNET/libyang
Published: 2020-01-22
File: src/resolve.c
Commit message: resolve BUGFIX handle yet unresolved if-features

Fixes #772
Commit author: Michal Vasko

Vulnerable version (before fix):
 resolve_iffeature(struct lys_iffeature *expr) {     int index_e = 0, index_f = 0;      if (expr->expr) {         return resolve_iffeature_recursive(expr, &index_e, &index_f);     }     return 0;

Fixed version (after fix):
 resolve_iffeature(struct lys_iffeature *expr) {     int index_e = 0, index_f = 0;      if (expr->expr && expr->features[0]) {         return resolve_iffeature_recursive(expr, &index_e, &index_f);     }     return 0;

Patch:
patch: @@ -1402,7 +1402,7 @@ resolve_iffeature(struct lys_iffeature *expr)
 {
     int index_e = 0, index_f = 0;
 
-    if (expr->expr) {
+    if (expr->expr && expr->features[0]) {
         return resolve_iffeature_recursive(expr, &index_e, &index_f);
     }
     return 0;
path: src/resolve.c
Vulnerability: A NULL pointer dereference is present in libyang before v1.0-r3 in the function lys_extension_instances_free() due to a copy of unresolved extensions in lys_restr_dup(). Applications that use libyang to parse untrusted input yang files may crash.
Vulnerability ID: CVE-2019-20398
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/CESNET/libyang
Published: 2020-01-22
File: src/tree_schema.c
Commit message: schema tree BUGFIX do not copy unresolved exts in groupings restrictions

Fixes #773
Commit author: Michal Vasko

Vulnerable version (before fix):
 lys_restr_dup(struct lys_module *mod, struct lys_restr *old, int size, int shall     LY_CHECK_ERR_RETURN(!result, LOGMEM(mod->ctx), NULL);      for (i = 0; i < size; i++) {         result[i].ext_size = old[i].ext_size;         lys_ext_dup(mod->ctx, mod, old[i].ext, old[i].ext_size, &result[i], LYEXT_PAR_RESTR, &result[i].ext, shallow, unres);         result[i].expr = lydict_insert(mod->ctx, old[i].expr, 0);         result[i].dsc = lydict_insert(mod->ctx, old[i].dsc, 0);         result[i].ref = lydict_insert(mod->ctx, old[i].ref, 0);

Fixed version (after fix):
 lys_restr_dup(struct lys_module *mod, struct lys_restr *old, int size, int shall     LY_CHECK_ERR_RETURN(!result, LOGMEM(mod->ctx), NULL);      for (i = 0; i < size; i++) {         /* copying unresolved extensions is not supported */         if (unres_schema_find(unres, -1, (void *)&old[i].ext, UNRES_EXT) == -1) {             result[i].ext_size = old[i].ext_size;             lys_ext_dup(mod->ctx, mod, old[i].ext, old[i].ext_size, &result[i], LYEXT_PAR_RESTR, &result[i].ext, shallow, unres);         }         result[i].expr = lydict_insert(mod->ctx, old[i].expr, 0);         result[i].dsc = lydict_insert(mod->ctx, old[i].dsc, 0);         result[i].ref = lydict_insert(mod->ctx, old[i].ref, 0);

Patch:
patch: @@ -1601,8 +1601,11 @@ lys_restr_dup(struct lys_module *mod, struct lys_restr *old, int size, int shall
     LY_CHECK_ERR_RETURN(!result, LOGMEM(mod->ctx), NULL);
 
     for (i = 0; i < size; i++) {
-        result[i].ext_size = old[i].ext_size;
-        lys_ext_dup(mod->ctx, mod, old[i].ext, old[i].ext_size, &result[i], LYEXT_PAR_RESTR, &result[i].ext, shallow, unres);
+        /* copying unresolved extensions is not supported */
+        if (unres_schema_find(unres, -1, (void *)&old[i].ext, UNRES_EXT) == -1) {
+            result[i].ext_size = old[i].ext_size;
+            lys_ext_dup(mod->ctx, mod, old[i].ext, old[i].ext_size, &result[i], LYEXT_PAR_RESTR, &result[i].ext, shallow, unres);
+        }
         result[i].expr = lydict_insert(mod->ctx, old[i].expr, 0);
         result[i].dsc = lydict_insert(mod->ctx, old[i].dsc, 0);
         result[i].ref = lydict_insert(mod->ctx, old[i].ref, 0);
path: src/tree_schema.c
Vulnerability: An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer over-read in gf_m2ts_process_pmt in media_tools/mpegts.c that can cause a denial of service via a crafted MP4 file.
Vulnerability ID: CVE-2019-20629
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2020-03-24
File: src/media_tools/mpegts.c
Commit message: fixed potential crash in TS - cf #1264
Commit author: jeanlf

Vulnerable version (before fix):
 static void gf_m2ts_process_pmt(GF_M2TS_Demuxer *ts, GF_M2TS_SECTION_ES *pmt, GF 			if (!(es->flags & GF_M2TS_ES_IS_SECTION) ) gf_m2ts_set_pes_framing(pes, GF_M2TS_PES_FRAMING_SKIP);  			nb_es++; 		}  		if (es->stream_type == GF_M2TS_VIDEO_HEVC) nb_hevc++; 		else if (es->stream_type == GF_M2TS_VIDEO_HEVC_TEMPORAL) nb_hevc_temp++; 		else if (es->stream_type == GF_M2TS_VIDEO_SHVC) nb_shvc++; 		else if (es->stream_type == GF_M2TS_VIDEO_SHVC_TEMPORAL) nb_shvc_temp++; 		else if (es->stream_type == GF_M2TS_VIDEO_MHVC) nb_mhvc++; 		else if (es->stream_type == GF_M2TS_VIDEO_MHVC_TEMPORAL) nb_mhvc_temp++; 	}  	//Table 2-139, implied hierarchy indexes

Fixed version (after fix):
 static void gf_m2ts_process_pmt(GF_M2TS_Demuxer *ts, GF_M2TS_SECTION_ES *pmt, GF 			if (!(es->flags & GF_M2TS_ES_IS_SECTION) ) gf_m2ts_set_pes_framing(pes, GF_M2TS_PES_FRAMING_SKIP);  			nb_es++;  			if (es->stream_type == GF_M2TS_VIDEO_HEVC) nb_hevc++; 			else if (es->stream_type == GF_M2TS_VIDEO_HEVC_TEMPORAL) nb_hevc_temp++; 			else if (es->stream_type == GF_M2TS_VIDEO_SHVC) nb_shvc++; 			else if (es->stream_type == GF_M2TS_VIDEO_SHVC_TEMPORAL) nb_shvc_temp++; 			else if (es->stream_type == GF_M2TS_VIDEO_MHVC) nb_mhvc++; 			else if (es->stream_type == GF_M2TS_VIDEO_MHVC_TEMPORAL) nb_mhvc_temp++; 		} 	}  	//Table 2-139, implied hierarchy indexes

Patch:
patch: @@ -1525,14 +1525,14 @@ static void gf_m2ts_process_pmt(GF_M2TS_Demuxer *ts, GF_M2TS_SECTION_ES *pmt, GF
 			if (!(es->flags & GF_M2TS_ES_IS_SECTION) ) gf_m2ts_set_pes_framing(pes, GF_M2TS_PES_FRAMING_SKIP);
 
 			nb_es++;
-		}
 
-		if (es->stream_type == GF_M2TS_VIDEO_HEVC) nb_hevc++;
-		else if (es->stream_type == GF_M2TS_VIDEO_HEVC_TEMPORAL) nb_hevc_temp++;
-		else if (es->stream_type == GF_M2TS_VIDEO_SHVC) nb_shvc++;
-		else if (es->stream_type == GF_M2TS_VIDEO_SHVC_TEMPORAL) nb_shvc_temp++;
-		else if (es->stream_type == GF_M2TS_VIDEO_MHVC) nb_mhvc++;
-		else if (es->stream_type == GF_M2TS_VIDEO_MHVC_TEMPORAL) nb_mhvc_temp++;
+			if (es->stream_type == GF_M2TS_VIDEO_HEVC) nb_hevc++;
+			else if (es->stream_type == GF_M2TS_VIDEO_HEVC_TEMPORAL) nb_hevc_temp++;
+			else if (es->stream_type == GF_M2TS_VIDEO_SHVC) nb_shvc++;
+			else if (es->stream_type == GF_M2TS_VIDEO_SHVC_TEMPORAL) nb_shvc_temp++;
+			else if (es->stream_type == GF_M2TS_VIDEO_MHVC) nb_mhvc++;
+			else if (es->stream_type == GF_M2TS_VIDEO_MHVC_TEMPORAL) nb_mhvc_temp++;
+		}
 	}
 
 	//Table 2-139, implied hierarchy indexes
path: src/media_tools/mpegts.c
Vulnerability: libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.
Vulnerability ID: CVE-2019-20788
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/LibVNC/libvncserver
Published: 2020-04-23
File: libvncclient/cursor.c
Commit message: libvncclient/cursor: limit width/height input values

Avoids a possible heap overflow reported by Pavel Cheremushkin
<Pavel.Cheremushkin@kaspersky.com>.

re #275
Commit author: Christian Beier

Vulnerable version (before fix):
 #define OPER_SAVE     0 #define OPER_RESTORE  1  #define RGB24_TO_PIXEL(bpp,r,g,b)                                       \    ((((uint##bpp##_t)(r) & 0xFF) * client->format.redMax + 127) / 255             \     << client->format.redShift |                                              \ rfbBool HandleCursorShape(rfbClient* client,int xhot, int yhot, int width, int h   if (width * height == 0)     return TRUE;    /* Allocate memory for pixel data and temporary mask data. */   if(client->rcSource)     free(client->rcSource);

Fixed version (after fix):
 #define OPER_SAVE     0 #define OPER_RESTORE  1  #define MAX_CURSOR_SIZE 1024  #define RGB24_TO_PIXEL(bpp,r,g,b)                                       \    ((((uint##bpp##_t)(r) & 0xFF) * client->format.redMax + 127) / 255             \     << client->format.redShift |                                              \ rfbBool HandleCursorShape(rfbClient* client,int xhot, int yhot, int width, int h   if (width * height == 0)     return TRUE;    if (width >= MAX_CURSOR_SIZE || height >= MAX_CURSOR_SIZE)     return FALSE;    /* Allocate memory for pixel data and temporary mask data. */   if(client->rcSource)     free(client->rcSource);

Patch:
patch: @@ -28,6 +28,8 @@
 #define OPER_SAVE     0
 #define OPER_RESTORE  1
 
+#define MAX_CURSOR_SIZE 1024
+
 #define RGB24_TO_PIXEL(bpp,r,g,b)                                       \
    ((((uint##bpp##_t)(r) & 0xFF) * client->format.redMax + 127) / 255             \
     << client->format.redShift |                                              \
@@ -54,6 +56,9 @@ rfbBool HandleCursorShape(rfbClient* client,int xhot, int yhot, int width, int h
   if (width * height == 0)
     return TRUE;
 
+  if (width >= MAX_CURSOR_SIZE || height >= MAX_CURSOR_SIZE)
+    return FALSE;
+
   /* Allocate memory for pixel data and temporary mask data. */
   if(client->rcSource)
     free(client->rcSource);
path: libvncclient/cursor.c
Vulnerability: libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.
Vulnerability ID: CVE-2019-20788
CWE: CWE-190
Severity score: 6.4
Project: https://github.com/LibVNC/libvncserver
Published: 2020-04-23
File: libvncclient/cursor.c
Commit message: libvncclient/cursor: limit width/height input values

Avoids a possible heap overflow reported by Pavel Cheremushkin
<Pavel.Cheremushkin@kaspersky.com>.

re #275
Commit author: Christian Beier

Vulnerable version (before fix):
 #define OPER_SAVE     0 #define OPER_RESTORE  1  #define RGB24_TO_PIXEL(bpp,r,g,b)                                       \    ((((uint##bpp##_t)(r) & 0xFF) * client->format.redMax + 127) / 255             \     << client->format.redShift |                                              \ rfbBool HandleCursorShape(rfbClient* client,int xhot, int yhot, int width, int h   if (width * height == 0)     return TRUE;    /* Allocate memory for pixel data and temporary mask data. */   if(client->rcSource)     free(client->rcSource);

Fixed version (after fix):
 #define OPER_SAVE     0 #define OPER_RESTORE  1  #define MAX_CURSOR_SIZE 1024  #define RGB24_TO_PIXEL(bpp,r,g,b)                                       \    ((((uint##bpp##_t)(r) & 0xFF) * client->format.redMax + 127) / 255             \     << client->format.redShift |                                              \ rfbBool HandleCursorShape(rfbClient* client,int xhot, int yhot, int width, int h   if (width * height == 0)     return TRUE;    if (width >= MAX_CURSOR_SIZE || height >= MAX_CURSOR_SIZE)     return FALSE;    /* Allocate memory for pixel data and temporary mask data. */   if(client->rcSource)     free(client->rcSource);

Patch:
patch: @@ -28,6 +28,8 @@
 #define OPER_SAVE     0
 #define OPER_RESTORE  1
 
+#define MAX_CURSOR_SIZE 1024
+
 #define RGB24_TO_PIXEL(bpp,r,g,b)                                       \
    ((((uint##bpp##_t)(r) & 0xFF) * client->format.redMax + 127) / 255             \
     << client->format.redShift |                                              \
@@ -54,6 +56,9 @@ rfbBool HandleCursorShape(rfbClient* client,int xhot, int yhot, int width, int h
   if (width * height == 0)
     return TRUE;
 
+  if (width >= MAX_CURSOR_SIZE || height >= MAX_CURSOR_SIZE)
+    return FALSE;
+
   /* Allocate memory for pixel data and temporary mask data. */
   if(client->rcSource)
     free(client->rcSource);
path: libvncclient/cursor.c
Vulnerability: OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in libopensc/card-coolkey.c lacks a uniqueness check.
Vulnerability ID: CVE-2019-20792
CWE: CWE-415
Severity score: 6.4
Project: https://github.com/OpenSC/OpenSC
Published: 2020-04-29
File: src/libopensc/card-coolkey.c
Commit message: coolkey: Make sure the object ID is unique when filling list

Thanks to oss-fuzz

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19208
Commit author: Jakub Jelen

Vulnerable version (before fix):
 coolkey_add_object(coolkey_private_data_t *priv, unsigned long object_id, const 	new_object.id = object_id; 	new_object.length = object_length;  	if (object_data) { 		new_object.data = malloc(object_length + add_v1_record); 		if (new_object.data == NULL) {

Fixed version (after fix):
 coolkey_add_object(coolkey_private_data_t *priv, unsigned long object_id, const 	new_object.id = object_id; 	new_object.length = object_length;  	/* The object ID needs to be unique */ 	if (coolkey_find_object_by_id(&priv->objects_list, object_id) != NULL) { 		return SC_ERROR_INTERNAL; 	}  	if (object_data) { 		new_object.data = malloc(object_length + add_v1_record); 		if (new_object.data == NULL) {

Patch:
patch: @@ -1945,6 +1945,11 @@ coolkey_add_object(coolkey_private_data_t *priv, unsigned long object_id, const
 	new_object.id = object_id;
 	new_object.length = object_length;
 
+	/* The object ID needs to be unique */
+	if (coolkey_find_object_by_id(&priv->objects_list, object_id) != NULL) {
+		return SC_ERROR_INTERNAL;
+	}
+
 	if (object_data) {
 		new_object.data = malloc(object_length + add_v1_record);
 		if (new_object.data == NULL) {
path: src/libopensc/card-coolkey.c
Vulnerability: An issue was discovered in the Linux kernel before 5.2. There is a NULL pointer dereference in tw5864_handle_frame() in drivers/media/pci/tw5864/tw5864-video.c, which may cause denial of service, aka CID-2e7682ebfc75.
Vulnerability ID: CVE-2019-20806
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2020-05-27
File: drivers/media/pci/tw5864/tw5864-video.c
Commit message: media: tw5864: Fix possible NULL pointer dereference in tw5864_handle_frame

'vb' null check should be done before dereferencing it in
tw5864_handle_frame, otherwise a NULL pointer dereference
may occur.

Fixes: 34d1324edd31 ("[media] pci: Add tw5864 driver")

Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Commit author: YueHaibing

Vulnerable version (before fix):
 static void tw5864_handle_frame(struct tw5864_h264_frame *frame) 	input->vb = NULL; 	spin_unlock_irqrestore(&input->slock, flags);  	v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf);  	if (!vb) { /* Gone because of disabling */ 		dev_dbg(&dev->pci->dev, "vb is empty, dropping frame\n"); 		return; 	}  	/* 	 * Check for space. 	 * Mind the overhead of startcode emulation prevention.

Fixed version (after fix):
 static void tw5864_handle_frame(struct tw5864_h264_frame *frame) 	input->vb = NULL; 	spin_unlock_irqrestore(&input->slock, flags);  	if (!vb) { /* Gone because of disabling */ 		dev_dbg(&dev->pci->dev, "vb is empty, dropping frame\n"); 		return; 	}  	v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf);  	/* 	 * Check for space. 	 * Mind the overhead of startcode emulation prevention.

Patch:
patch: @@ -1395,13 +1395,13 @@ static void tw5864_handle_frame(struct tw5864_h264_frame *frame)
 	input->vb = NULL;
 	spin_unlock_irqrestore(&input->slock, flags);
 
-	v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf);
-
 	if (!vb) { /* Gone because of disabling */
 		dev_dbg(&dev->pci->dev, "vb is empty, dropping frame\n");
 		return;
 	}
 
+	v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf);
+
 	/*
 	 * Check for space.
 	 * Mind the overhead of startcode emulation prevention.
path: drivers/media/pci/tw5864/tw5864-video.c
Vulnerability: libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.
Vulnerability ID: CVE-2019-20839
CWE: CWE-120
Severity score: 2.9
Project: https://github.com/LibVNC/libvncserver
Published: 2020-06-17
File: libvncclient/sockets.c
Commit message: libvncclient: bail out if unix socket name would overflow

Closes #291
Commit author: Christian Beier

Vulnerable version (before fix):
 ConnectClientToUnixSock(const char *sockFile)   int sock;   struct sockaddr_un addr;   addr.sun_family = AF_UNIX;   strcpy(addr.sun_path, sockFile);    sock = socket(AF_UNIX, SOCK_STREAM, 0);

Fixed version (after fix):
 ConnectClientToUnixSock(const char *sockFile)   int sock;   struct sockaddr_un addr;   addr.sun_family = AF_UNIX;   if(strlen(sockFile) + 1 > sizeof(addr.sun_path)) {       rfbClientErr("ConnectToUnixSock: socket file name too long\n");       return -1;   }   strcpy(addr.sun_path, sockFile);    sock = socket(AF_UNIX, SOCK_STREAM, 0);

Patch:
patch: @@ -461,6 +461,10 @@ ConnectClientToUnixSock(const char *sockFile)
   int sock;
   struct sockaddr_un addr;
   addr.sun_family = AF_UNIX;
+  if(strlen(sockFile) + 1 > sizeof(addr.sun_path)) {
+      rfbClientErr("ConnectToUnixSock: socket file name too long\n");
+      return -1;
+  }
   strcpy(addr.sun_path, sockFile);
 
   sock = socket(AF_UNIX, SOCK_STREAM, 0);
path: libvncclient/sockets.c
Vulnerability: An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.
Vulnerability ID: CVE-2019-20840
CWE: CWE-787
Severity score: 2.9
Project: https://github.com/LibVNC/libvncserver
Published: 2020-06-17
File: libvncserver/ws_decode.c
Commit message: fix crash because of unaligned accesses in hybiReadAndDecode()
Commit author: Rolf Eike Beer

Vulnerable version (before fix):
 hybiReadAndDecode(ws_ctx_t *wsctx, char *dst, int len, int *sockRet, int nInBuf)   int bufsize;   int nextRead;   unsigned char *data;   uint32_t *data32;    /* if data was carried over, copy to start of buffer */   memcpy(wsctx->writePos, wsctx->carryBuf, wsctx->carrylen); hybiReadAndDecode(ws_ctx_t *wsctx, char *dst, int len, int *sockRet, int nInBuf)   /* for a possible base64 decoding, we decode multiples of 4 bytes until    * the whole frame is received and carry over any remaining bytes in the carry buf*/   data = (unsigned char *)(wsctx->writePos - toDecode);   data32= (uint32_t *)data;    for (i = 0; i < (toDecode >> 2); i++) {     data32[i] ^= wsctx->header.mask.u;   }   ws_dbg("mask decoding; i=%d toDecode=%d\n", i, toDecode); 

Fixed version (after fix):
 hybiReadAndDecode(ws_ctx_t *wsctx, char *dst, int len, int *sockRet, int nInBuf)   int bufsize;   int nextRead;   unsigned char *data;    /* if data was carried over, copy to start of buffer */   memcpy(wsctx->writePos, wsctx->carryBuf, wsctx->carrylen); hybiReadAndDecode(ws_ctx_t *wsctx, char *dst, int len, int *sockRet, int nInBuf)   /* for a possible base64 decoding, we decode multiples of 4 bytes until    * the whole frame is received and carry over any remaining bytes in the carry buf*/   data = (unsigned char *)(wsctx->writePos - toDecode);    for (i = 0; i < (toDecode >> 2); i++) {     uint32_t tmp;     memcpy(&tmp, data + i * sizeof(tmp), sizeof(tmp));     tmp ^= wsctx->header.mask.u;     memcpy(data + i * sizeof(tmp), &tmp, sizeof(tmp));   }   ws_dbg("mask decoding; i=%d toDecode=%d\n", i, toDecode); 

Patch:
patch: @@ -327,7 +327,6 @@ hybiReadAndDecode(ws_ctx_t *wsctx, char *dst, int len, int *sockRet, int nInBuf)
   int bufsize;
   int nextRead;
   unsigned char *data;
-  uint32_t *data32;
 
   /* if data was carried over, copy to start of buffer */
   memcpy(wsctx->writePos, wsctx->carryBuf, wsctx->carrylen);
@@ -383,10 +382,12 @@ hybiReadAndDecode(ws_ctx_t *wsctx, char *dst, int len, int *sockRet, int nInBuf)
   /* for a possible base64 decoding, we decode multiples of 4 bytes until
    * the whole frame is received and carry over any remaining bytes in the carry buf*/
   data = (unsigned char *)(wsctx->writePos - toDecode);
-  data32= (uint32_t *)data;
 
   for (i = 0; i < (toDecode >> 2); i++) {
-    data32[i] ^= wsctx->header.mask.u;
+    uint32_t tmp;
+    memcpy(&tmp, data + i * sizeof(tmp), sizeof(tmp));
+    tmp ^= wsctx->header.mask.u;
+    memcpy(data + i * sizeof(tmp), &tmp, sizeof(tmp));
   }
   ws_dbg("mask decoding; i=%d toDecode=%d\n", i, toDecode);
path: libvncserver/ws_decode.c