rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: An issue was discovered in Artifex MuJS 1.0.5. The Number#toFixed() and numtostr implementations in jsnumber.c have a stack-based buffer overflow.
Vulnerability ID: CVE-2019-11411
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/ccxvii/mujs
Published: 2019-04-22
File: jsnumber.c
Commit message: Bug 700938: Fix stack overflow in numtostr as used by Number#toFixed().

32 is not enough to fit sprintf("%.20f", 1e20).
We need at least 43 bytes to fit that format.
Bump the static buffer size.
Commit author: Tor Andersson

Vulnerable version (before fix):
 static void Np_valueOf(js_State *J)  static void Np_toString(js_State *J) { 	char buf[32]; 	js_Object *self = js_toobject(J, 0); 	int radix = js_isundefined(J, 1) ? 10 : js_tointeger(J, 1); 	if (self->type != JS_CNUMBER) static void Np_toString(js_State *J) 	/* lame number to string conversion for any radix from 2 to 36 */ 	{ 		static const char digits[] = "0123456789abcdefghijklmnopqrstuvwxyz"; 		char buf[100]; 		double number = self->u.number; 		int sign = self->u.number < 0; 		js_Buffer *sb = NULL; static void Np_toString(js_State *J) /* Customized ToString() on a number */ static void numtostr(js_State *J, const char *fmt, int w, double n) { 	char buf[32], *e; 	sprintf(buf, fmt, w, n); 	e = strchr(buf, 'e'); 	if (e) {

Fixed version (after fix):
 static void Np_valueOf(js_State *J)  static void Np_toString(js_State *J) { 	char buf[100]; 	js_Object *self = js_toobject(J, 0); 	int radix = js_isundefined(J, 1) ? 10 : js_tointeger(J, 1); 	if (self->type != JS_CNUMBER) static void Np_toString(js_State *J) 	/* lame number to string conversion for any radix from 2 to 36 */ 	{ 		static const char digits[] = "0123456789abcdefghijklmnopqrstuvwxyz"; 		double number = self->u.number; 		int sign = self->u.number < 0; 		js_Buffer *sb = NULL; static void Np_toString(js_State *J) /* Customized ToString() on a number */ static void numtostr(js_State *J, const char *fmt, int w, double n) { 	/* buf needs to fit printf("%.20f", 1e20) */ 	char buf[50], *e; 	sprintf(buf, fmt, w, n); 	e = strchr(buf, 'e'); 	if (e) {

Patch:
patch: @@ -27,7 +27,7 @@ static void Np_valueOf(js_State *J)
 
 static void Np_toString(js_State *J)
 {
-	char buf[32];
+	char buf[100];
 	js_Object *self = js_toobject(J, 0);
 	int radix = js_isundefined(J, 1) ? 10 : js_tointeger(J, 1);
 	if (self->type != JS_CNUMBER)
@@ -42,7 +42,6 @@ static void Np_toString(js_State *J)
 	/* lame number to string conversion for any radix from 2 to 36 */
 	{
 		static const char digits[] = "0123456789abcdefghijklmnopqrstuvwxyz";
-		char buf[100];
 		double number = self->u.number;
 		int sign = self->u.number < 0;
 		js_Buffer *sb = NULL;
@@ -115,7 +114,8 @@ static void Np_toString(js_State *J)
 /* Customized ToString() on a number */
 static void numtostr(js_State *J, const char *fmt, int w, double n)
 {
-	char buf[32], *e;
+	/* buf needs to fit printf("%.20f", 1e20) */
+	char buf[50], *e;
 	sprintf(buf, fmt, w, n);
 	e = strchr(buf, 'e');
 	if (e) {
path: jsnumber.c
Vulnerability: The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.
Vulnerability ID: CVE-2019-11470
CWE: CWE-400
Severity score: 6.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2019-04-23
File: coders/cin.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1472
Commit author: Cristy

Vulnerable version (before fix):
 static Image *ReadCINImage(const ImageInfo *image_info,ExceptionInfo *exception)       (void) CloseBlob(image);       return(image);     }   for ( ; offset < (MagickOffsetType) cin.file.image_offset; offset++)   {     int

Fixed version (after fix):
 static Image *ReadCINImage(const ImageInfo *image_info,ExceptionInfo *exception)       (void) CloseBlob(image);       return(image);     }   if (((MagickSizeType) image->columns*image->rows) > GetBlobSize(image))     ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");   for ( ; offset < (MagickOffsetType) cin.file.image_offset; offset++)   {     int

Patch:
patch: @@ -726,6 +726,8 @@ static Image *ReadCINImage(const ImageInfo *image_info,ExceptionInfo *exception)
       (void) CloseBlob(image);
       return(image);
     }
+  if (((MagickSizeType) image->columns*image->rows) > GetBlobSize(image))
+    ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
   for ( ; offset < (MagickOffsetType) cin.file.image_offset; offset++)
   {
     int
path: coders/cin.c
Vulnerability: ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the header indicates neither LSB first nor MSB first.
Vulnerability ID: CVE-2019-11472
CWE: CWE-369
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick6
Published: 2019-04-23
File: coders/xwd.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1546
Commit author: Cristy

Vulnerable version (before fix):
 static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)     ThrowReaderException(CorruptImageError,"ImproperImageHeader");   if ((header.bits_per_pixel == 0) || (header.bits_per_pixel > 32))     ThrowReaderException(CorruptImageError,"ImproperImageHeader");   if (((header.bitmap_pad % 8) != 0) || (header.bitmap_pad > 32))     ThrowReaderException(CorruptImageError,"ImproperImageHeader");   if (header.bitmap_unit > 32)

Fixed version (after fix):
 static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)     ThrowReaderException(CorruptImageError,"ImproperImageHeader");   if ((header.bits_per_pixel == 0) || (header.bits_per_pixel > 32))     ThrowReaderException(CorruptImageError,"ImproperImageHeader");   if ((header.bitmap_bit_order != MSBFirst) &&       (header.bitmap_bit_order != LSBFirst))     ThrowReaderException(CorruptImageError,"ImproperImageHeader");   if (((header.bitmap_pad % 8) != 0) || (header.bitmap_pad > 32))     ThrowReaderException(CorruptImageError,"ImproperImageHeader");   if (header.bitmap_unit > 32)

Patch:
patch: @@ -243,6 +243,9 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   if ((header.bits_per_pixel == 0) || (header.bits_per_pixel > 32))
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+  if ((header.bitmap_bit_order != MSBFirst) &&
+      (header.bitmap_bit_order != LSBFirst))
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   if (((header.bitmap_pad % 8) != 0) || (header.bitmap_pad > 32))
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   if (header.bitmap_unit > 32)
path: coders/xwd.c
Vulnerability: In memcached before 1.5.14, a NULL pointer dereference was found in the "lru mode" and "lru temp_ttl" commands. This causes a denial of service when parsing crafted lru command messages in process_lru_command in memcached.c.
Vulnerability ID: CVE-2019-11596
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/memcached/memcached
Published: 2019-04-29
File: memcached.c
Commit message: fix segfault in "lru" command

fixes #474 - off by one in token count.
Commit author: dormando

Vulnerable version (before fix):
 static void process_lru_command(conn *c, token_t *tokens, const size_t ntokens)                 out_string(c, "OK");             }         }     } else if (strcmp(tokens[1].value, "mode") == 0 && ntokens >= 3 &&                settings.lru_maintainer_thread) {         if (strcmp(tokens[2].value, "flat") == 0) {             settings.lru_segmented = false; static void process_lru_command(conn *c, token_t *tokens, const size_t ntokens)         } else {             out_string(c, "ERROR");         }     } else if (strcmp(tokens[1].value, "temp_ttl") == 0 && ntokens >= 3 &&                settings.lru_maintainer_thread) {         if (!safe_strtol(tokens[2].value, &ttl)) {             out_string(c, "ERROR");

Fixed version (after fix):
 static void process_lru_command(conn *c, token_t *tokens, const size_t ntokens)                 out_string(c, "OK");             }         }     } else if (strcmp(tokens[1].value, "mode") == 0 && ntokens >= 4 &&                settings.lru_maintainer_thread) {         if (strcmp(tokens[2].value, "flat") == 0) {             settings.lru_segmented = false; static void process_lru_command(conn *c, token_t *tokens, const size_t ntokens)         } else {             out_string(c, "ERROR");         }     } else if (strcmp(tokens[1].value, "temp_ttl") == 0 && ntokens >= 4 &&                settings.lru_maintainer_thread) {         if (!safe_strtol(tokens[2].value, &ttl)) {             out_string(c, "ERROR");

Patch:
patch: @@ -4632,7 +4632,7 @@ static void process_lru_command(conn *c, token_t *tokens, const size_t ntokens)
                 out_string(c, "OK");
             }
         }
-    } else if (strcmp(tokens[1].value, "mode") == 0 && ntokens >= 3 &&
+    } else if (strcmp(tokens[1].value, "mode") == 0 && ntokens >= 4 &&
                settings.lru_maintainer_thread) {
         if (strcmp(tokens[2].value, "flat") == 0) {
             settings.lru_segmented = false;
@@ -4643,7 +4643,7 @@ static void process_lru_command(conn *c, token_t *tokens, const size_t ntokens)
         } else {
             out_string(c, "ERROR");
         }
-    } else if (strcmp(tokens[1].value, "temp_ttl") == 0 && ntokens >= 3 &&
+    } else if (strcmp(tokens[1].value, "temp_ttl") == 0 && ntokens >= 4 &&
                settings.lru_maintainer_thread) {
         if (!safe_strtol(tokens[2].value, &ttl)) {
             out_string(c, "ERROR");
path: memcached.c
Vulnerability: An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107. There is persistent XSS via image names in titles, as demonstrated by a screenshot.
Vulnerability ID: CVE-2019-11814
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/MISP/MISP
Published: 2019-05-08
File: app/webroot/js/misp.js
Commit message: fix: [security] Fix persistent xss due to invalid sanitisation of image names in titles

- triggered by expanding a screenshot

- as reported by João Lucas Melo Brasio from Elytron Security S.A. (https://elytronsecurity.com)
Commit author: iglocska

Vulnerable version (before fix):
 function screenshotPopup(url, title) {     if (!url.startsWith('data:image/')) {         url = url.slice(0, -1);     }     popupHtml = '<it class="fa fa-spin fa-spinner" style="font-size: xx-large; color: white; position: fixed; left: 50%; top: 50%;"></it>'     popupHtml += '<img class="screenshot_box-content hidden" src="' + url + '" id="screenshot-image" title="' + title + '" alt="' + title + '" onload="$(this).show(); $(this).parent().find(\'.fa-spinner\').remove();"/>';     popupHtml += '<div class="close-icon useCursorPointer" onClick="closeScreenshot();"></div>';     if (!url.startsWith('data:image/')) {

Fixed version (after fix):
 function screenshotPopup(url, title) {     if (!url.startsWith('data:image/')) {         url = url.slice(0, -1);     }     popupHtml = '<it class="fa fa-spin fa-spinner" style="font-size: xx-large; color: white; position: fixed; left: 50%; top: 50%;"></it>';     url = $('<div>').text(url).html();     title = $('<div>').text(title).html();     popupHtml += '<img class="screenshot_box-content hidden" src="' + url + '" id="screenshot-image" title="' + title + '" alt="' + title + '" onload="$(this).show(); $(this).parent().find(\'.fa-spinner\').remove();"/>';     popupHtml += '<div class="close-icon useCursorPointer" onClick="closeScreenshot();"></div>';     if (!url.startsWith('data:image/')) {

Patch:
patch: @@ -97,7 +97,9 @@ function screenshotPopup(url, title) {
     if (!url.startsWith('data:image/')) {
         url = url.slice(0, -1);
     }
-    popupHtml = '<it class="fa fa-spin fa-spinner" style="font-size: xx-large; color: white; position: fixed; left: 50%; top: 50%;"></it>'
+    popupHtml = '<it class="fa fa-spin fa-spinner" style="font-size: xx-large; color: white; position: fixed; left: 50%; top: 50%;"></it>';
+    url = $('<div>').text(url).html();
+    title = $('<div>').text(title).html();
     popupHtml += '<img class="screenshot_box-content hidden" src="' + url + '" id="screenshot-image" title="' + title + '" alt="' + title + '" onload="$(this).show(); $(this).parent().find(\'.fa-spinner\').remove();"/>';
     popupHtml += '<div class="close-icon useCursorPointer" onClick="closeScreenshot();"></div>';
     if (!url.startsWith('data:image/')) {
path: app/webroot/js/misp.js
Vulnerability: The updateDevice function in minissdpd.c in MiniUPnP MiniSSDPd 1.4 and 1.5 allows a remote attacker to crash the process due to a Use After Free vulnerability.
Vulnerability ID: CVE-2019-12106
CWE: CWE-416
Severity score: 2.9
Project: https://github.com/miniupnp/miniupnp
Published: 2019-05-15
File: minissdpd/minissdpd.c
Commit message: updateDevice() remove element from the list when realloc fails
Commit author: Thomas Bernard

Vulnerable version (before fix):
 updateDevice(const struct header * headers, time_t t) 				if(!tmp)	/* allocation error */ 				{ 					syslog(LOG_ERR, "updateDevice() : memory allocation error"); 					free(p); 					return 0; 				}

Fixed version (after fix):
 updateDevice(const struct header * headers, time_t t) 				if(!tmp)	/* allocation error */ 				{ 					syslog(LOG_ERR, "updateDevice() : memory allocation error"); 					*pp = p->next;	/* remove "p" from the list */ 					free(p); 					return 0; 				}

Patch:
patch: @@ -318,6 +318,7 @@ updateDevice(const struct header * headers, time_t t)
 				if(!tmp)	/* allocation error */
 				{
 					syslog(LOG_ERR, "updateDevice() : memory allocation error");
+					*pp = p->next;	/* remove "p" from the list */
 					free(p);
 					return 0;
 				}
path: minissdpd/minissdpd.c
Vulnerability: An AddPortMapping Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in upnpredirect.c.
Vulnerability ID: CVE-2019-12110
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/miniupnp/miniupnp
Published: 2019-05-15
File: miniupnpd/upnpredirect.c
Commit message: upnp_redirect(): accept NULL desc argument
Commit author: Thomas Bernard

Vulnerable version (before fix):
 upnp_redirect(const char * rhost, unsigned short eport, 		                 "%hu->%s:%hu %s", eport, iaddr, iport, protocol); 		return -3; 	} 	/* IGDv1 (WANIPConnection:1 Service Template Version 1.01 / Nov 12, 2001) 	 * - 2.2.20.PortMappingDescription : 	 *  Overwriting Previous / Existing Port Mappings:

Fixed version (after fix):
 upnp_redirect(const char * rhost, unsigned short eport, 		                 "%hu->%s:%hu %s", eport, iaddr, iport, protocol); 		return -3; 	}  	if (desc == NULL) 		desc = "";	/* assume empty description */  	/* IGDv1 (WANIPConnection:1 Service Template Version 1.01 / Nov 12, 2001) 	 * - 2.2.20.PortMappingDescription : 	 *  Overwriting Previous / Existing Port Mappings:

Patch:
patch: @@ -356,6 +356,10 @@ upnp_redirect(const char * rhost, unsigned short eport,
 		                 "%hu->%s:%hu %s", eport, iaddr, iport, protocol);
 		return -3;
 	}
+
+	if (desc == NULL)
+		desc = "";	/* assume empty description */
+
 	/* IGDv1 (WANIPConnection:1 Service Template Version 1.01 / Nov 12, 2001)
 	 * - 2.2.20.PortMappingDescription :
 	 *  Overwriting Previous / Existing Port Mappings:
path: miniupnpd/upnpredirect.c
Vulnerability: A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in copyIPv6IfDifferent in pcpserver.c.
Vulnerability ID: CVE-2019-12111
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/miniupnp/miniupnp
Published: 2019-05-15
File: miniupnpd/pcpserver.c
Commit message: pcpserver.c: copyIPv6IfDifferent() check for NULL src argument
Commit author: Thomas Bernard

Vulnerable version (before fix):
 static const char * getPCPOpCodeStr(uint8_t opcode)  * buffers are same */ static void copyIPv6IfDifferent(void * dest, const void * src) { 	if(dest != src) { 		memcpy(dest, src, sizeof(struct in6_addr)); 	} }

Fixed version (after fix):
 static const char * getPCPOpCodeStr(uint8_t opcode)  * buffers are same */ static void copyIPv6IfDifferent(void * dest, const void * src) { 	if(dest != src && src != NULL) { 		memcpy(dest, src, sizeof(struct in6_addr)); 	} }

Patch:
patch: @@ -177,7 +177,7 @@ static const char * getPCPOpCodeStr(uint8_t opcode)
  * buffers are same */
 static void copyIPv6IfDifferent(void * dest, const void * src)
 {
-	if(dest != src) {
+	if(dest != src && src != NULL) {
 		memcpy(dest, src, sizeof(struct in6_addr));
 	}
 }
path: miniupnpd/pcpserver.c
Vulnerability: In Webbukkit Dynmap 3.0-beta-3 or below, due to a missing login check in servlet/MapStorageHandler.java, an attacker can see a map image without login even if victim enables login-required in setting.
Vulnerability ID: CVE-2019-12395
CWE: CWE-287
Severity score: 2.9
Project: https://github.com/webbukkit/dynmap
Published: 2019-05-28
File: DynmapCore/src/main/java/org/dynmap/servlet/MapStorageResourceHandler.java
Commit message: Merge pull request #2475 from Ry0taK/v3.0

Fix required login bypass vulnerability
Commit author: mikeprimm

Vulnerable version (before fix):
 public void handle(String target, Request baseRequest, HttpServletRequest reques         int soff = 0, eoff;         // We're handling this request         baseRequest.setHandled(true);          if (path.charAt(0) == '/') soff = 1;         eoff = path.indexOf('/', soff);         if (soff < 0) {

Fixed version (after fix):
 public void handle(String target, Request baseRequest, HttpServletRequest reques         int soff = 0, eoff;         // We're handling this request         baseRequest.setHandled(true);         if(core.getLoginRequired()             && request.getSession(true).getAttribute(LoginServlet.USERID_ATTRIB) == null){             response.sendError(HttpStatus.UNAUTHORIZED_401);             return;         }         if (path.charAt(0) == '/') soff = 1;         eoff = path.indexOf('/', soff);         if (soff < 0) {

Patch:
patch: @@ -46,7 +46,11 @@ public void handle(String target, Request baseRequest, HttpServletRequest reques
         int soff = 0, eoff;
         // We're handling this request
         baseRequest.setHandled(true);
-
+        if(core.getLoginRequired()
+            && request.getSession(true).getAttribute(LoginServlet.USERID_ATTRIB) == null){
+            response.sendError(HttpStatus.UNAUTHORIZED_401);
+            return;
+        }
         if (path.charAt(0) == '/') soff = 1;
         eoff = path.indexOf('/', soff);
         if (soff < 0) {
path: DynmapCore/src/main/java/org/dynmap/servlet/MapStorageResourceHandler.java
Vulnerability: An XSS vulnerability exists in PHPRelativePath (aka Relative Path) through 1.0.2 via the RelativePath.Example1.php path parameter.
Vulnerability ID: CVE-2019-12507
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/Grandt/PHPRelativePath
Published: 2019-05-31
File: RelativePath.Example1.php
Commit message: Sanitizing user input
Commit author: Taylor Finley

Vulnerable version (before fix):
 function execTime($function, $title="", $iterations = 100000) { <form method="post"> <p>Path:<br /> <input type="text" size="120" name="path" 	value="<?php echo stripslashes($_POST['path']); ?>" /></p> <p><input type="submit" /></p> </form> <dl> <?php foreach ($paths as $path) { 	echo "<dt><pre>Path '$path' becomes:</pre></dt>\n"; 	echo "<dd><pre>"; 	echo "'" . RelativePath::getRelativePath($path) . "'\n";

Fixed version (after fix):
 function execTime($function, $title="", $iterations = 100000) { <form method="post"> <p>Path:<br /> <input type="text" size="120" name="path" 	value="<?php echo htmlspecialchars(stripslashes($_POST['path']), ENT_QUOTES); ?>" /></p> <p><input type="submit" /></p> </form> <dl> <?php foreach ($paths as $path) {     $path = htmlspecialchars($path, ENT_QUOTES); 	echo "<dt><pre>Path '$path' becomes:</pre></dt>\n"; 	echo "<dd><pre>"; 	echo "'" . RelativePath::getRelativePath($path) . "'\n";

Patch:
patch: @@ -82,12 +82,13 @@ function execTime($function, $title="", $iterations = 100000) {
 <form method="post">
 <p>Path:<br />
 <input type="text" size="120" name="path"
-	value="<?php echo stripslashes($_POST['path']); ?>" /></p>
+	value="<?php echo htmlspecialchars(stripslashes($_POST['path']), ENT_QUOTES); ?>" /></p>
 <p><input type="submit" /></p>
 </form>
 <dl>
 <?php
 foreach ($paths as $path) {
+    $path = htmlspecialchars($path, ENT_QUOTES);
 	echo "<dt><pre>Path '$path' becomes:</pre></dt>\n";
 	echo "<dd><pre>";
 	echo "'" . RelativePath::getRelativePath($path) . "'\n";
path: RelativePath.Example1.php
Vulnerability: In Ming (aka libming) 0.4.8, there is an integer overflow (caused by an out-of-range left shift) in the SWFInput_readSBits function in blocks/input.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted swf file.
Vulnerability ID: CVE-2019-12980
CWE: CWE-190
Severity score: 2.9
Project: https://github.com/libming/libming
Published: 2019-06-26
File: src/blocks/input.c
Commit message: Fix left shift of a negative value in SWFInput_readSBits. Check for number before before left-shifting by (number-1).
Commit author: Young Xiao

Vulnerable version (before fix):
 SWFInput_readSBits(SWFInput input, int number) { 	int num = SWFInput_readBits(input, number);  	if ( num & (1<<(number-1)) ) 		return num - (1<<number); 	else 		return num;

Fixed version (after fix):
 SWFInput_readSBits(SWFInput input, int number) { 	int num = SWFInput_readBits(input, number);  	if(number && num & (1<<(number-1))) 		return num - (1<<number); 	else 		return num;

Patch:
patch: @@ -113,7 +113,7 @@ SWFInput_readSBits(SWFInput input, int number)
 {
 	int num = SWFInput_readBits(input, number);
 
-	if ( num & (1<<(number-1)) )
+	if(number && num & (1<<(number-1)))
 		return num - (1<<number);
 	else
 		return num;
path: src/blocks/input.c
Vulnerability: Ming (aka libming) 0.4.8 has an "fill overflow" vulnerability in the function SWFShape_setLeftFillStyle in blocks/shape.c.
Vulnerability ID: CVE-2019-12981
CWE: CWE-20
Severity score: 6.4
Project: https://github.com/libming/libming
Published: 2019-06-26
File: src/blocks/shape.c
Commit message: SWFShape_setLeftFillStyle: prevent fill overflow
Commit author: Young Xiao

Vulnerable version (before fix):
 SWFShape_setLeftFillStyle(SWFShape shape, SWFFillStyle fill) 			return;		 		idx = getFillIdx(shape, fill); 	} 				 	record = addStyleRecord(shape); 	record.record.stateChange->leftFill = idx;

Fixed version (after fix):
 SWFShape_setLeftFillStyle(SWFShape shape, SWFFillStyle fill) 			return;		 		idx = getFillIdx(shape, fill); 	} 	else if (idx >= 255 && shape->useVersion == SWF_SHAPE1) 	{ 		SWF_error("Too many fills for SWFShape V1.\n"  			  "Use a higher SWFShape version\n"); 	} 				 	record = addStyleRecord(shape); 	record.record.stateChange->leftFill = idx;

Patch:
patch: @@ -1169,6 +1169,11 @@ SWFShape_setLeftFillStyle(SWFShape shape, SWFFillStyle fill)
 			return;		
 		idx = getFillIdx(shape, fill);
 	}
+	else if (idx >= 255 && shape->useVersion == SWF_SHAPE1)
+	{
+		SWF_error("Too many fills for SWFShape V1.\n" 
+			  "Use a higher SWFShape version\n");
+	}
 				
 	record = addStyleRecord(shape);
 	record.record.stateChange->leftFill = idx;
path: src/blocks/shape.c