rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The kill_something_info function in kernel/signal.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might allow local users to cause a denial of service via an INT_MIN argument.
Vulnerability ID: CVE-2018-10124
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2018-04-16
File: kernel/signal.c
Commit message: kernel/signal.c: avoid undefined behaviour in kill_something_info

When running kill(72057458746458112, 0) in userspace I hit the following
issue.

  UBSAN: Undefined behaviour in kernel/signal.c:1462:11
  negation of -2147483648 cannot be represented in type 'int':
  CPU: 226 PID: 9849 Comm: test Tainted: G    B          ---- -------   3.10.0-327.53.58.70.x86_64_ubsan+ #116
  Hardware name: Huawei Technologies Co., Ltd. RH8100 V3/BC61PBIA, BIOS BLHSV028 11/11/2014
  Call Trace:
    dump_stack+0x19/0x1b
    ubsan_epilogue+0xd/0x50
    __ubsan_handle_negate_overflow+0x109/0x14e
    SYSC_kill+0x43e/0x4d0
    SyS_kill+0xe/0x10
    system_call_fastpath+0x16/0x1b

Add code to avoid the UBSAN detection.

[akpm@linux-foundation.org: tweak comment]
Link: http://lkml.kernel.org/r/1496670008-59084-1-git-send-email-zhongjiang@huawei.com
Signed-off-by: zhongjiang <zhongjiang@huawei.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Xishi Qiu <qiuxishi@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: zhongjiang

Vulnerable version (before fix):
 static int kill_something_info(int sig, struct siginfo *info, pid_t pid) 		return ret; 	}  	read_lock(&tasklist_lock); 	if (pid != -1) { 		ret = __kill_pgrp_info(sig, info,

Fixed version (after fix):
 static int kill_something_info(int sig, struct siginfo *info, pid_t pid) 		return ret; 	}  	/* -INT_MIN is undefined.  Exclude this case to avoid a UBSAN warning */ 	if (pid == INT_MIN) 		return -ESRCH;  	read_lock(&tasklist_lock); 	if (pid != -1) { 		ret = __kill_pgrp_info(sig, info,

Patch:
patch: @@ -1402,6 +1402,10 @@ static int kill_something_info(int sig, struct siginfo *info, pid_t pid)
 		return ret;
 	}
 
+	/* -INT_MIN is undefined.  Exclude this case to avoid a UBSAN warning */
+	if (pid == INT_MIN)
+		return -ESRCH;
+
 	read_lock(&tasklist_lock);
 	if (pid != -1) {
 		ret = __kill_pgrp_info(sig, info,
path: kernel/signal.c
Vulnerability: In versions of mruby up to and including 1.4.0, an integer overflow exists in src/vm.c::mrb_vm_exec() when handling OP_GETUPVAR in the presence of deep scope nesting, resulting in a use-after-free. An attacker that can cause Ruby code to be run can use this to possibly execute arbitrary code.
Vulnerability ID: CVE-2018-10191
CWE: CWE-190
Severity score: 6.4
Project: https://github.com/mruby/mruby
Published: 2018-04-17
File: src/vm.c
Commit message: Check length of env stack before accessing upvar; fix #3995
Commit author: Yukihiro "Matz" Matsumoto

Vulnerable version (before fix):
 mrb_vm_exec(mrb_state *mrb, struct RProc *proc, mrb_code *pc)       mrb_value *regs_a = regs + a;       struct REnv *e = uvenv(mrb, c);        if (!e) {         *regs_a = mrb_nil_value();       }       else {         *regs_a = e->stack[b];       }       NEXT;     }

Fixed version (after fix):
 mrb_vm_exec(mrb_state *mrb, struct RProc *proc, mrb_code *pc)       mrb_value *regs_a = regs + a;       struct REnv *e = uvenv(mrb, c);        if (e && b < MRB_ENV_STACK_LEN(e)) {         *regs_a = e->stack[b];       }       else {         *regs_a = mrb_nil_value();       }       NEXT;     }

Patch:
patch: @@ -1201,11 +1201,11 @@ mrb_vm_exec(mrb_state *mrb, struct RProc *proc, mrb_code *pc)
       mrb_value *regs_a = regs + a;
       struct REnv *e = uvenv(mrb, c);
 
-      if (!e) {
-        *regs_a = mrb_nil_value();
+      if (e && b < MRB_ENV_STACK_LEN(e)) {
+        *regs_a = e->stack[b];
       }
       else {
-        *regs_a = e->stack[b];
+        *regs_a = mrb_nil_value();
       }
       NEXT;
     }
path: src/vm.c
Vulnerability: In versions of mruby up to and including 1.4.0, a use-after-free vulnerability exists in src/io.c::File#initilialize_copy(). An attacker that can cause Ruby code to be run can possibly use this to execute arbitrary code.
Vulnerability ID: CVE-2018-10199
CWE: CWE-416
Severity score: 6.4
Project: https://github.com/mruby/mruby
Published: 2018-04-18
File: mrbgems/mruby-io/src/io.c
Commit message: Fix `use after free in File#initilialize_copy`; fix #4001

The bug and the fix were reported by https://hackerone.com/pnoltof
Commit author: Yukihiro "Matz" Matsumoto

Vulnerable version (before fix):
 mrb_io_initialize_copy(mrb_state *mrb, mrb_value copy)   mrb_bool failed = TRUE;    mrb_get_args(mrb, "o", &orig);   fptr_copy = (struct mrb_io *)DATA_PTR(copy);   if (fptr_copy != NULL) {     fptr_finalize(mrb, fptr_copy, FALSE);     mrb_free(mrb, fptr_copy);   }   fptr_copy = (struct mrb_io *)mrb_io_alloc(mrb);   fptr_orig = io_get_open_fptr(mrb, orig);    DATA_TYPE(copy) = &mrb_io_type;   DATA_PTR(copy) = fptr_copy;

Fixed version (after fix):
 mrb_io_initialize_copy(mrb_state *mrb, mrb_value copy)   mrb_bool failed = TRUE;    mrb_get_args(mrb, "o", &orig);   fptr_orig = io_get_open_fptr(mrb, orig);   fptr_copy = (struct mrb_io *)DATA_PTR(copy);   if (fptr_copy != NULL) {     fptr_finalize(mrb, fptr_copy, FALSE);     mrb_free(mrb, fptr_copy);   }   fptr_copy = (struct mrb_io *)mrb_io_alloc(mrb);    DATA_TYPE(copy) = &mrb_io_type;   DATA_PTR(copy) = fptr_copy;

Patch:
patch: @@ -561,13 +561,13 @@ mrb_io_initialize_copy(mrb_state *mrb, mrb_value copy)
   mrb_bool failed = TRUE;
 
   mrb_get_args(mrb, "o", &orig);
+  fptr_orig = io_get_open_fptr(mrb, orig);
   fptr_copy = (struct mrb_io *)DATA_PTR(copy);
   if (fptr_copy != NULL) {
     fptr_finalize(mrb, fptr_copy, FALSE);
     mrb_free(mrb, fptr_copy);
   }
   fptr_copy = (struct mrb_io *)mrb_io_alloc(mrb);
-  fptr_orig = io_get_open_fptr(mrb, orig);
 
   DATA_TYPE(copy) = &mrb_io_type;
   DATA_PTR(copy) = fptr_copy;
path: mrbgems/mruby-io/src/io.c
Vulnerability: error.php in ILIAS 5.2.x through 5.3.x before 5.3.4 allows XSS via the text of a PDO exception.
Vulnerability ID: CVE-2018-10307
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/ILIAS-eLearning/ILIAS
Published: 2018-05-18
File: error.php
Commit message: Error Handling: PDO exception handling

(cherry picked from commit 65da344)
Commit author: mjansen

Vulnerable version (before fix):
 		throw $e; 	}  	die($e->getMessage()); }\ No newline at end of file

Fixed version (after fix):
 		throw $e; 	}  	if (!($e instanceof \PDOException)) { 		die($e->getMessage()); 	} }\ No newline at end of file

Patch:
patch: @@ -32,5 +32,7 @@
 		throw $e;
 	}
 
-	die($e->getMessage());
+	if (!($e instanceof \PDOException)) {
+		die($e->getMessage());
+	}
 }
\ No newline at end of file
path: error.php
Vulnerability: The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.
Vulnerability ID: CVE-2018-10360
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/file/file
Published: 2018-06-11
File: src/readelf.c
Commit message: Avoid reading past the end of buffer (Rui Reis)
Commit author: Christos Zoulas

Vulnerable version (before fix):
 #include "file.h"  #ifndef lint FILE_RCSID("@(#)$File: readelf.c,v 1.142 2018/05/24 18:08:01 christos Exp $") #endif  #ifdef BUILTIN_ELF do_core_note(struct magic_set *ms, unsigned char *nbuf, uint32_t type,  				cname = (unsigned char *) 				    &nbuf[doff + prpsoffsets(i)]; 				for (cp = cname; *cp && isprint(*cp); cp++) 					continue; 				/* 				 * Linux apparently appends a space at the end

Fixed version (after fix):
 #include "file.h"  #ifndef lint FILE_RCSID("@(#)$File: readelf.c,v 1.143 2018/06/09 16:00:06 christos Exp $") #endif  #ifdef BUILTIN_ELF do_core_note(struct magic_set *ms, unsigned char *nbuf, uint32_t type,  				cname = (unsigned char *) 				    &nbuf[doff + prpsoffsets(i)]; 				for (cp = cname; cp < nbuf + size && *cp 				    && isprint(*cp); cp++) 					continue; 				/* 				 * Linux apparently appends a space at the end

Patch:
patch: @@ -27,7 +27,7 @@
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: readelf.c,v 1.142 2018/05/24 18:08:01 christos Exp $")
+FILE_RCSID("@(#)$File: readelf.c,v 1.143 2018/06/09 16:00:06 christos Exp $")
 #endif
 
 #ifdef BUILTIN_ELF
@@ -842,7 +842,8 @@ do_core_note(struct magic_set *ms, unsigned char *nbuf, uint32_t type,
 
 				cname = (unsigned char *)
 				    &nbuf[doff + prpsoffsets(i)];
-				for (cp = cname; *cp && isprint(*cp); cp++)
+				for (cp = cname; cp < nbuf + size && *cp
+				    && isprint(*cp); cp++)
 					continue;
 				/*
 				 * Linux apparently appends a space at the end
path: src/readelf.c
Vulnerability: BigTree before 4.2.22 has XSS in the Users management page via the name or company field.
Vulnerability ID: CVE-2018-10364
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/bigtreecms/BigTree-CMS
Published: 2018-04-30
File: core/inc/bigtree/admin.php
Commit message: Fixing XSS injection via user profile editing -- thanks zhzzhz:
https://github.com/bigtreecms/BigTree-CMS/issues/332
Commit author: Tim Buckingham

Vulnerable version (before fix):
 function updatePendingChange($id,$changes,$mtm_changes = array(),$tags_changes = 		function updateProfile($data) { 			global $bigtree;  			foreach ($data as $key => $val) { 				if (substr($key,0,1) != "_" && !is_array($val)) { 					$$key = sqlescape($val); 				} 			}  			$id = sqlescape($this->ID);  			if ($data["password"]) {

Fixed version (after fix):
 function updatePendingChange($id,$changes,$mtm_changes = array(),$tags_changes = 		function updateProfile($data) { 			global $bigtree;  			$name = sqlescape(htmlspecialchars($data["name"])); 			$company = sqlescape(htmlspecialchars($data["company"])); 			$daily_digest = $data["daily_digest"] ? "on" : ""; 			$id = sqlescape($this->ID);  			if ($data["password"]) {

Patch:
patch: @@ -8419,12 +8419,9 @@ function updatePendingChange($id,$changes,$mtm_changes = array(),$tags_changes =
 		function updateProfile($data) {
 			global $bigtree;
 
-			foreach ($data as $key => $val) {
-				if (substr($key,0,1) != "_" && !is_array($val)) {
-					$$key = sqlescape($val);
-				}
-			}
-
+			$name = sqlescape(htmlspecialchars($data["name"]));
+			$company = sqlescape(htmlspecialchars($data["company"]));
+			$daily_digest = $data["daily_digest"] ? "on" : "";
 			$id = sqlescape($this->ID);
 
 			if ($data["password"]) {
path: core/inc/bigtree/admin.php
Vulnerability: An issue was discovered in LibRaw 0.18.9. There is a stack-based buffer overflow in the utf2char function in libraw_cxx.cpp.
Vulnerability ID: CVE-2018-10528
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/LibRaw/LibRaw
Published: 2018-04-29
File: src/libraw_cxx.cpp
Commit message: X3F parser possible buffer overrun
Commit author: Alex Tutubalin

Vulnerable version (before fix):
 void x3f_clear(void *p)   x3f_delete((x3f_t*)p); }  static char *utf2char(utf16_t *str, char *buffer) {   char *b = buffer;    while (*str != 0x00) {     char *chr = (char *)str;     *b++ = *chr;     str++;   }   *b = 0;   return buffer; }  static void *lr_memmem(const void *l, size_t l_len, const void *s, size_t s_len) void LibRaw::parse_x3f() 		  x3f_property_t *P = PL->property_table.element; 		  for (i=0; i<PL->num_properties; i++) { 			  char name[100], value[100]; 			  utf2char(P[i].name,name); 			  utf2char(P[i].value,value); 			  if (!strcmp (name, "ISO")) 				  imgdata.other.iso_speed = atoi(value); 			  if (!strcmp (name, "CAMMANUF"))

Fixed version (after fix):
 void x3f_clear(void *p)   x3f_delete((x3f_t*)p); }  void utf2char(utf16_t *str, char *buffer, unsigned bufsz) {  if(bufsz<1) return;  buffer[bufsz-1] = 0;   char *b = buffer;    while (*str != 0x00 && --bufsz>0)   {     char *chr = (char *)str;     *b++ = *chr;     str++;   }   *b = 0; }  static void *lr_memmem(const void *l, size_t l_len, const void *s, size_t s_len) void LibRaw::parse_x3f() 		  x3f_property_t *P = PL->property_table.element; 		  for (i=0; i<PL->num_properties; i++) { 			  char name[100], value[100]; 			  utf2char(P[i].name,name,sizeof(name)); 			  utf2char(P[i].value,value,sizeof(value)); 			  if (!strcmp (name, "ISO")) 				  imgdata.other.iso_speed = atoi(value); 			  if (!strcmp (name, "CAMMANUF"))

Patch:
patch: @@ -5484,17 +5484,19 @@ void x3f_clear(void *p)
   x3f_delete((x3f_t*)p);
 }
 
-static char *utf2char(utf16_t *str, char *buffer)
+void utf2char(utf16_t *str, char *buffer, unsigned bufsz)
 {
+ if(bufsz<1) return;
+ buffer[bufsz-1] = 0;
   char *b = buffer;
 
-  while (*str != 0x00) {
+  while (*str != 0x00 && --bufsz>0)
+  {
     char *chr = (char *)str;
     *b++ = *chr;
     str++;
   }
   *b = 0;
-  return buffer;
 }
 
 static void *lr_memmem(const void *l, size_t l_len, const void *s, size_t s_len)
@@ -5555,8 +5557,8 @@ void LibRaw::parse_x3f()
 		  x3f_property_t *P = PL->property_table.element;
 		  for (i=0; i<PL->num_properties; i++) {
 			  char name[100], value[100];
-			  utf2char(P[i].name,name);
-			  utf2char(P[i].value,value);
+			  utf2char(P[i].name,name,sizeof(name));
+			  utf2char(P[i].value,value,sizeof(value));
 			  if (!strcmp (name, "ISO"))
 				  imgdata.other.iso_speed = atoi(value);
 			  if (!strcmp (name, "CAMMANUF"))
path: src/libraw_cxx.cpp
Vulnerability: site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlier allows remote attackers to upload and execute arbitrary PHP code because the BigTreeStorage class in core/inc/bigtree/apis/storage.php does not prevent uploads of .htaccess files.
Vulnerability ID: CVE-2018-10574
CWE: CWE-94
Severity score: 6.4
Project: https://github.com/bigtreecms/BigTree-CMS
Published: 2018-04-30
File: core/inc/bigtree/apis/storage.php
Commit message: Rejecting htaccess files:
https://github.com/bigtreecms/BigTree-CMS/issues/335
Commit author: Tim Buckingham

Vulnerable version (before fix):
 class BigTreeStorage {  		var $AutoJPEG = false; 		var $DisabledFileError = false; 		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx|phtml|pht)/i'; 		var $Service = ""; 		var $Cloud = false; 		var $Settings;

Fixed version (after fix):
 class BigTreeStorage {  		var $AutoJPEG = false; 		var $DisabledFileError = false; 		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx|phtml|pht|htaccess)/i'; 		var $Service = ""; 		var $Cloud = false; 		var $Settings;

Patch:
patch: @@ -8,7 +8,7 @@ class BigTreeStorage {
 
 		var $AutoJPEG = false;
 		var $DisabledFileError = false;
-		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx|phtml|pht)/i';
+		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx|phtml|pht|htaccess)/i';
 		var $Service = "";
 		var $Cloud = false;
 		var $Settings;
path: core/inc/bigtree/apis/storage.php
Vulnerability: The DecodeGifImg function in ngiflib.c in MiniUPnP ngiflib 0.4 lacks certain checks against width and height, which allows remote attackers to cause a denial of service (WritePixels heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted GIF file.
Vulnerability ID: CVE-2018-10677
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/miniupnp/ngiflib
Published: 2018-05-02
File: ngiflib.c
Commit message: check GIF image position and dimensions

fixes #1
Commit author: Thomas Bernard

Vulnerable version (before fix):
 static int DecodeGifImg(struct ngiflib_img * i) { 	i->width = GetWord(i->parent);	/* SizeX   */ 	i->height = GetWord(i->parent);	/* SizeY   */  	context.Xtogo = i->width; 	context.curY = i->posY; #ifdef NGIFLIB_INDEXED_ONLY

Fixed version (after fix):
 static int DecodeGifImg(struct ngiflib_img * i) { 	i->width = GetWord(i->parent);	/* SizeX   */ 	i->height = GetWord(i->parent);	/* SizeY   */  	if((i->width > i->parent->width) || (i->height > i->parent->height)) { #if !defined(NGIFLIB_NO_FILE) 		if(i->parent->log) fprintf(i->parent->log, "*** ERROR *** Image bigger than global GIF canvas !\n"); #endif 		return -1; 	} 	if((i->posX + i->width) > i->parent->width) { #if !defined(NGIFLIB_NO_FILE) 		if(i->parent->log) fprintf(i->parent->log, "*** WARNING *** Adjusting X position\n"); #endif 		i->posX = i->parent->width - i->width; 	} 	if((i->posY + i->height) > i->parent->height) { #if !defined(NGIFLIB_NO_FILE) 		if(i->parent->log) fprintf(i->parent->log, "*** WARNING *** Adjusting Y position\n"); #endif 		i->posY = i->parent->height - i->height; 	} 	context.Xtogo = i->width; 	context.curY = i->posY; #ifdef NGIFLIB_INDEXED_ONLY

Patch:
patch: @@ -408,6 +408,24 @@ static int DecodeGifImg(struct ngiflib_img * i) {
 	i->width = GetWord(i->parent);	/* SizeX   */
 	i->height = GetWord(i->parent);	/* SizeY   */
 
+	if((i->width > i->parent->width) || (i->height > i->parent->height)) {
+#if !defined(NGIFLIB_NO_FILE)
+		if(i->parent->log) fprintf(i->parent->log, "*** ERROR *** Image bigger than global GIF canvas !\n");
+#endif
+		return -1;
+	}
+	if((i->posX + i->width) > i->parent->width) {
+#if !defined(NGIFLIB_NO_FILE)
+		if(i->parent->log) fprintf(i->parent->log, "*** WARNING *** Adjusting X position\n");
+#endif
+		i->posX = i->parent->width - i->width;
+	}
+	if((i->posY + i->height) > i->parent->height) {
+#if !defined(NGIFLIB_NO_FILE)
+		if(i->parent->log) fprintf(i->parent->log, "*** WARNING *** Adjusting Y position\n");
+#endif
+		i->posY = i->parent->height - i->height;
+	}
 	context.Xtogo = i->width;
 	context.curY = i->posY;
 #ifdef NGIFLIB_INDEXED_ONLY
path: ngiflib.c
Vulnerability: A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory.
Vulnerability ID: CVE-2018-1068
CWE: CWE-787
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2018-03-16
File: net/bridge/netfilter/ebtables.c
Commit message: netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets

We need to make sure the offsets are not out of range of the
total size.
Also check that they are in ascending order.

The WARN_ON triggered by syzkaller (it sets panic_on_warn) is
changed to also bail out, no point in continuing parsing.

Briefly tested with simple ruleset of
-A INPUT --limit 1/s' --log
plus jump to custom chains using 32bit ebtables binary.

Reported-by: <syzbot+845a53d13171abf8bf29@syzkaller.appspotmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Commit author: Florian Westphal

Vulnerable version (before fix):
 static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32, 		if (match_kern) 			match_kern->match_size = ret;  		WARN_ON(type == EBT_COMPAT_TARGET && size_left); 		match32 = (struct compat_ebt_entry_mwt *) buf; 	}  static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base, 	 * 	 * offsets are relative to beginning of struct ebt_entry (i.e., 0). 	 */ 	for (i = 0, j = 1 ; j < 4 ; j++, i++) { 		struct compat_ebt_entry_mwt *match32; 		unsigned int size;

Fixed version (after fix):
 static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32, 		if (match_kern) 			match_kern->match_size = ret;  		if (WARN_ON(type == EBT_COMPAT_TARGET && size_left)) 			return -EINVAL;  		match32 = (struct compat_ebt_entry_mwt *) buf; 	}  static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base, 	 * 	 * offsets are relative to beginning of struct ebt_entry (i.e., 0). 	 */ 	for (i = 0; i < 4 ; ++i) { 		if (offsets[i] >= *total) 			return -EINVAL; 		if (i == 0) 			continue; 		if (offsets[i-1] > offsets[i]) 			return -EINVAL; 	}  	for (i = 0, j = 1 ; j < 4 ; j++, i++) { 		struct compat_ebt_entry_mwt *match32; 		unsigned int size;

Patch:
patch: @@ -2060,7 +2060,9 @@ static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32,
 		if (match_kern)
 			match_kern->match_size = ret;
 
-		WARN_ON(type == EBT_COMPAT_TARGET && size_left);
+		if (WARN_ON(type == EBT_COMPAT_TARGET && size_left))
+			return -EINVAL;
+
 		match32 = (struct compat_ebt_entry_mwt *) buf;
 	}
 
@@ -2116,6 +2118,15 @@ static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
 	 *
 	 * offsets are relative to beginning of struct ebt_entry (i.e., 0).
 	 */
+	for (i = 0; i < 4 ; ++i) {
+		if (offsets[i] >= *total)
+			return -EINVAL;
+		if (i == 0)
+			continue;
+		if (offsets[i-1] > offsets[i])
+			return -EINVAL;
+	}
+
 	for (i = 0, j = 1 ; j < 4 ; j++, i++) {
 		struct compat_ebt_entry_mwt *match32;
 		unsigned int size;
path: net/bridge/netfilter/ebtables.c
Vulnerability: The DecodeGifImg function in ngiflib.c in MiniUPnP ngiflib 0.4 does not consider the bounds of the pixels data structure, which allows remote attackers to cause a denial of service (WritePixels heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted GIF file, a different vulnerability than CVE-2018-10677.
Vulnerability ID: CVE-2018-10717
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/miniupnp/ngiflib
Published: 2018-05-03
File: ngiflib.c
Commit message: fix "pixel overrun"

fixes #3
Commit author: Thomas Bernard

Vulnerable version (before fix):
 static int DecodeGifImg(struct ngiflib_img * i) { 			act_code = GetGifWord(i, &context); 			casspecial = (u8)act_code; 			old_code = act_code; 			WritePixel(i, &context, casspecial); npix--; 		} else { 			read_byt = act_code; 			if(act_code >= free) {	/* code pas encore dans alphabet */ static int DecodeGifImg(struct ngiflib_img * i) { 			/* act_code est concret */ 			casspecial = (u8)act_code;	/* dernier debut de chaine ! */ 			*(--stackp) = casspecial;	/* push on stack */ 			WritePixels(i, &context, stackp, stack_top - stackp);	/* unstack all pixels at once */ 			npix -= (stack_top - stackp); 			stackp = stack_top; /*			putchar('\n'); */

Fixed version (after fix):
 static int DecodeGifImg(struct ngiflib_img * i) { 			act_code = GetGifWord(i, &context); 			casspecial = (u8)act_code; 			old_code = act_code; 			if(npix > 0) WritePixel(i, &context, casspecial); 			npix--; 		} else { 			read_byt = act_code; 			if(act_code >= free) {	/* code pas encore dans alphabet */ static int DecodeGifImg(struct ngiflib_img * i) { 			/* act_code est concret */ 			casspecial = (u8)act_code;	/* dernier debut de chaine ! */ 			*(--stackp) = casspecial;	/* push on stack */ 			if(npix >= (stack_top - stackp)) { 				WritePixels(i, &context, stackp, stack_top - stackp);	/* unstack all pixels at once */ 			} else if(npix > 0) {	/* "pixel overflow" */ 				WritePixels(i, &context, stackp, npix); 			} 			npix -= (stack_top - stackp); 			stackp = stack_top; /*			putchar('\n'); */

Patch:
patch: @@ -528,7 +528,8 @@ static int DecodeGifImg(struct ngiflib_img * i) {
 			act_code = GetGifWord(i, &context);
 			casspecial = (u8)act_code;
 			old_code = act_code;
-			WritePixel(i, &context, casspecial); npix--;
+			if(npix > 0) WritePixel(i, &context, casspecial);
+			npix--;
 		} else {
 			read_byt = act_code;
 			if(act_code >= free) {	/* code pas encore dans alphabet */
@@ -545,7 +546,11 @@ static int DecodeGifImg(struct ngiflib_img * i) {
 			/* act_code est concret */
 			casspecial = (u8)act_code;	/* dernier debut de chaine ! */
 			*(--stackp) = casspecial;	/* push on stack */
-			WritePixels(i, &context, stackp, stack_top - stackp);	/* unstack all pixels at once */
+			if(npix >= (stack_top - stackp)) {
+				WritePixels(i, &context, stackp, stack_top - stackp);	/* unstack all pixels at once */
+			} else if(npix > 0) {	/* "pixel overflow" */
+				WritePixels(i, &context, stackp, npix);
+			}
 			npix -= (stack_top - stackp);
 			stackp = stack_top;
 /*			putchar('\n'); */
path: ngiflib.c