rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupware 16.2 allows remote attackers to bypass the XSS filter via padded zero characters, as demonstrated by an attack on tiki-batch_send_newsletter.php.
Vulnerability ID: CVE-2017-9305
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/tikiorg/tiki
Published: 2017-05-31
File: lib/core/TikiFilter/PreventXss.php
Commit message: [SEC] XSS Bypass - prevents bypassing of the xss filter by padding zeros

git-svn-id: https://svn.code.sf.net/p/tikiwiki/code/branches/17.x@62084 b456876b-0849-0410-b77d-98878d47e9d5
Commit author: drsassafras

Vulnerable version (before fix):
 function RemoveXSSchars(&$val) 			$search .= '~`";:?+/={}[]-_|\'\\'; 			for ($i = 0, $istrlen_search = strlen($search); $i < $istrlen_search; $i++) { 				// ;? matches the ;, which is optional 				// 0{0,8} matches any padded zeros, 				// which are optional and go up to 8 chars 				// &#x0040 @ search for the hex values 				$patterns[] = '/(&#[xX]0{0,8}'.dechex(ord($search[$i])).';?)/i'; 				$replacements[] = $search[$i]; 				// &#00064 @ 0{0,8} matches '0' zero to eight times 				// with a ; 				$patterns[] = '/(&#0{0,8}'.ord($search[$i]).';?)/'; 				$replacements[] = $search[$i]; 			} 		}

Fixed version (after fix):
 function RemoveXSSchars(&$val) 			$search .= '~`";:?+/={}[]-_|\'\\'; 			for ($i = 0, $istrlen_search = strlen($search); $i < $istrlen_search; $i++) { 				// ;? matches the ;, which is optional 				// 0* matches any padded zeros, which are optional 				// &#x0040 @ search for the hex values 				$patterns[] = '/(&#x0*'.dechex(ord($search[$i])).';?)/i'; 				$replacements[] = $search[$i]; 				// &#00064 @ 0* matches padded zeros 				// with a ; 				$patterns[] = '/(&#0*'.ord($search[$i]).';?)/'; 				$replacements[] = $search[$i]; 			} 		}

Patch:
patch: @@ -183,14 +183,13 @@ function RemoveXSSchars(&$val)
 			$search .= '~`";:?+/={}[]-_|\'\\';
 			for ($i = 0, $istrlen_search = strlen($search); $i < $istrlen_search; $i++) {
 				// ;? matches the ;, which is optional
-				// 0{0,8} matches any padded zeros,
-				// which are optional and go up to 8 chars
+				// 0* matches any padded zeros, which are optional
 				// &#x0040 @ search for the hex values
-				$patterns[] = '/(&#[xX]0{0,8}'.dechex(ord($search[$i])).';?)/i';
+				$patterns[] = '/(&#x0*'.dechex(ord($search[$i])).';?)/i';
 				$replacements[] = $search[$i];
-				// &#00064 @ 0{0,8} matches '0' zero to eight times
+				// &#00064 @ 0* matches padded zeros
 				// with a ;
-				$patterns[] = '/(&#0{0,8}'.ord($search[$i]).';?)/';
+				$patterns[] = '/(&#0*'.ord($search[$i]).';?)/';
 				$replacements[] = $search[$i];
 			}
 		}
path: lib/core/TikiFilter/PreventXss.php
Vulnerability: Unrestricted File Upload exists in BigTree CMS through 4.2.18: if an attacker uploads an 'xxx.pht' or 'xxx.phtml' file, they could bypass a safety check and execute any code.
Vulnerability ID: CVE-2017-9364
CWE: CWE-434
Severity score: 6.4
Project: https://github.com/bigtreecms/BigTree-CMS
Published: 2017-06-02
File: core/inc/bigtree/apis/storage.php
Commit message: Disabling phtml/pht files from being uploaded.
https://github.com/bigtreecms/BigTree-CMS/issues/280
Commit author: Tim Buckingham

Vulnerable version (before fix):
 class BigTreeStorage {  		var $AutoJPEG = false; 		var $DisabledFileError = false; 		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx)/i'; 		var $Service = ""; 		var $Cloud = false; 		var $Settings;

Fixed version (after fix):
 class BigTreeStorage {  		var $AutoJPEG = false; 		var $DisabledFileError = false; 		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx|phtml|pht)/i'; 		var $Service = ""; 		var $Cloud = false; 		var $Settings;

Patch:
patch: @@ -8,7 +8,7 @@ class BigTreeStorage {
 
 		var $AutoJPEG = false;
 		var $DisabledFileError = false;
-		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx)/i';
+		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx|phtml|pht)/i';
 		var $Service = "";
 		var $Cloud = false;
 		var $Settings;
path: core/inc/bigtree/apis/storage.php
Vulnerability: Buffer overflow in the ares_parse_a_reply function in the embedded ares library in ReSIProcate before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds-read) via a crafted DNS response.
Vulnerability ID: CVE-2017-9454
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/resiprocate/resiprocate
Published: 2017-08-18
File: rutil/dns/ares/ares_parse_a_reply.c
Commit message: ares: Prevent buffer overlow in ares_parse_a_reply (CVE-2017-9454)

This buffer overflow is in the embedded copy of ares that will be
used unless the external alternative c-ares is used by specifying
the configure argument --with-c-ares.

It has been found with LibFuzzer from the LLVM project.
Commit author: Gregor Jasny

Vulnerable version (before fix):
 int ares_parse_a_reply(const unsigned char *abuf, int alen,       rr_class = DNS_RR_CLASS(aptr);       rr_len = DNS_RR_LEN(aptr);       aptr += RRFIXEDSZ;        if (rr_class == C_IN && rr_type == T_A 	  && rr_len == sizeof(struct in_addr)

Fixed version (after fix):
 int ares_parse_a_reply(const unsigned char *abuf, int alen,       rr_class = DNS_RR_CLASS(aptr);       rr_len = DNS_RR_LEN(aptr);       aptr += RRFIXEDSZ;       if (aptr + rr_len > abuf + alen) 	{ 	  free(rr_name); 	  status = ARES_EBADRESP; 	  break; 	}        if (rr_class == C_IN && rr_type == T_A 	  && rr_len == sizeof(struct in_addr)

Patch:
patch: @@ -103,6 +103,12 @@ int ares_parse_a_reply(const unsigned char *abuf, int alen,
       rr_class = DNS_RR_CLASS(aptr);
       rr_len = DNS_RR_LEN(aptr);
       aptr += RRFIXEDSZ;
+      if (aptr + rr_len > abuf + alen)
+	{
+	  free(rr_name);
+	  status = ARES_EBADRESP;
+	  break;
+	}
 
       if (rr_class == C_IN && rr_type == T_A
 	  && rr_len == sizeof(struct in_addr)
path: rutil/dns/ares/ares_parse_a_reply.c
Vulnerability: The application Piwigo is affected by a SQL injection vulnerability in version 2.9.0 and possibly prior. This vulnerability allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. The user_list_backend.php component is affected: values of the iDisplayStart & iDisplayLength parameters are not sanitized; these are used to construct a SQL query and retrieve a list of registered users into the application.
Vulnerability ID: CVE-2017-9463
CWE: CWE-89
Severity score: 2.9
Project: https://github.com/Piwigo/Piwigo
Published: 2017-06-14
File: admin/user_list_backend.php
Commit message: (cp 6ce14fc) fixes #705, check user_list_backend.php input params
Commit author: plegall

Vulnerable version (before fix):
 include_once(PHPWG_ROOT_PATH.'include/common.inc.php');  check_status(ACCESS_ADMINISTRATOR); 	 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *  * Easy set variables  */

Fixed version (after fix):
 include_once(PHPWG_ROOT_PATH.'include/common.inc.php');  check_status(ACCESS_ADMINISTRATOR);  check_input_parameter('iDisplayStart', $_REQUEST, false, PATTERN_ID); check_input_parameter('iDisplayLength', $_REQUEST, false, PATTERN_ID);  /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *  * Easy set variables  */

Patch:
patch: @@ -27,7 +27,10 @@
 include_once(PHPWG_ROOT_PATH.'include/common.inc.php');
 
 check_status(ACCESS_ADMINISTRATOR);
-	
+
+check_input_parameter('iDisplayStart', $_REQUEST, false, PATTERN_ID);
+check_input_parameter('iDisplayLength', $_REQUEST, false, PATTERN_ID);
+
 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
  * Easy set variables
  */
path: admin/user_list_backend.php
Vulnerability: The mark_context_stack function in gc.c in mruby through 1.2.0 allows attackers to cause a denial of service (heap-based use-after-free and application crash) or possibly have unspecified other impact via a crafted .rb file.
Vulnerability ID: CVE-2017-9527
CWE: CWE-416
Severity score: 6.4
Project: https://github.com/mruby/mruby
Published: 2017-06-11
File: src/gc.c
Commit message: Clear unused stack region that may refer freed objects; fix #3596
Commit author: Yukihiro "Matz" Matsumoto

Vulnerable version (before fix):
 mark_context_stack(mrb_state *mrb, struct mrb_context *c) {   size_t i;   size_t e;    if (c->stack == NULL) return;   e = c->stack - c->stbase; mark_context_stack(mrb_state *mrb, struct mrb_context *c)     mrb_value v = c->stbase[i];      if (!mrb_immediate_p(v)) {       if (mrb_basic_ptr(v)->tt == MRB_TT_FREE) {         c->stbase[i] = mrb_nil_value();       }       else {         mrb_gc_mark(mrb, mrb_basic_ptr(v));       }     }   } }  static void

Fixed version (after fix):
 mark_context_stack(mrb_state *mrb, struct mrb_context *c) {   size_t i;   size_t e;   mrb_value nil;    if (c->stack == NULL) return;   e = c->stack - c->stbase; mark_context_stack(mrb_state *mrb, struct mrb_context *c)     mrb_value v = c->stbase[i];      if (!mrb_immediate_p(v)) {       mrb_gc_mark(mrb, mrb_basic_ptr(v));     }   }   e = c->stend - c->stbase;   nil = mrb_nil_value();   for (; i<e; i++) {     c->stbase[i] = nil;   } }  static void

Patch:
patch: @@ -544,6 +544,7 @@ mark_context_stack(mrb_state *mrb, struct mrb_context *c)
 {
   size_t i;
   size_t e;
+  mrb_value nil;
 
   if (c->stack == NULL) return;
   e = c->stack - c->stbase;
@@ -553,14 +554,14 @@ mark_context_stack(mrb_state *mrb, struct mrb_context *c)
     mrb_value v = c->stbase[i];
 
     if (!mrb_immediate_p(v)) {
-      if (mrb_basic_ptr(v)->tt == MRB_TT_FREE) {
-        c->stbase[i] = mrb_nil_value();
-      }
-      else {
-        mrb_gc_mark(mrb, mrb_basic_ptr(v));
-      }
+      mrb_gc_mark(mrb, mrb_basic_ptr(v));
     }
   }
+  e = c->stend - c->stbase;
+  nil = mrb_nil_value();
+  for (; i<e; i++) {
+    c->stbase[i] = nil;
+  }
 }
 
 static void
path: src/gc.c
Vulnerability: Heap-based buffer overflow in the xwd_decode_frame function in libavcodec/xwddec.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.
Vulnerability ID: CVE-2017-9991
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/FFmpeg/FFmpeg
Published: 2017-06-28
File: libavcodec/xwddec.c
Commit message: avcodec/xwddec: Check bpp more completely

Fixes out of array access
Fixes: 1399/clusterfuzz-testcase-minimized-4866094172995584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static int xwd_decode_frame(AVCodecContext *avctx, void *data,     case XWD_GRAY_SCALE:         if (bpp != 1 && bpp != 8)             return AVERROR_INVALIDDATA;         if (pixdepth == 1) {             avctx->pix_fmt = AV_PIX_FMT_MONOWHITE;         } else if (pixdepth == 8) {             avctx->pix_fmt = AV_PIX_FMT_GRAY8;         }         break;

Fixed version (after fix):
 static int xwd_decode_frame(AVCodecContext *avctx, void *data,     case XWD_GRAY_SCALE:         if (bpp != 1 && bpp != 8)             return AVERROR_INVALIDDATA;         if (bpp == 1 && pixdepth == 1) {             avctx->pix_fmt = AV_PIX_FMT_MONOWHITE;         } else if (bpp == 8 && pixdepth == 8) {             avctx->pix_fmt = AV_PIX_FMT_GRAY8;         }         break;

Patch:
patch: @@ -157,9 +157,9 @@ static int xwd_decode_frame(AVCodecContext *avctx, void *data,
     case XWD_GRAY_SCALE:
         if (bpp != 1 && bpp != 8)
             return AVERROR_INVALIDDATA;
-        if (pixdepth == 1) {
+        if (bpp == 1 && pixdepth == 1) {
             avctx->pix_fmt = AV_PIX_FMT_MONOWHITE;
-        } else if (pixdepth == 8) {
+        } else if (bpp == 8 && pixdepth == 8) {
             avctx->pix_fmt = AV_PIX_FMT_GRAY8;
         }
         break;
path: libavcodec/xwddec.c
Vulnerability: Heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.
Vulnerability ID: CVE-2017-9992
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/FFmpeg/FFmpeg
Published: 2017-06-28
File: libavcodec/dfa.c
Commit message: avcodec/dfa: Fix off by 1 error

Fixes out of array access
Fixes: 1345/clusterfuzz-testcase-minimized-6062963045695488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static int decode_dds1(GetByteContext *gb, uint8_t *frame, int width, int height                 return AVERROR_INVALIDDATA;             frame += v;         } else {             if (frame_end - frame < width + 3)                 return AVERROR_INVALIDDATA;             frame[0] = frame[1] =             frame[width] = frame[width + 1] =  bytestream2_get_byte(gb);

Fixed version (after fix):
 static int decode_dds1(GetByteContext *gb, uint8_t *frame, int width, int height                 return AVERROR_INVALIDDATA;             frame += v;         } else {             if (frame_end - frame < width + 4)                 return AVERROR_INVALIDDATA;             frame[0] = frame[1] =             frame[width] = frame[width + 1] =  bytestream2_get_byte(gb);

Patch:
patch: @@ -175,7 +175,7 @@ static int decode_dds1(GetByteContext *gb, uint8_t *frame, int width, int height
                 return AVERROR_INVALIDDATA;
             frame += v;
         } else {
-            if (frame_end - frame < width + 3)
+            if (frame_end - frame < width + 4)
                 return AVERROR_INVALIDDATA;
             frame[0] = frame[1] =
             frame[width] = frame[width + 1] =  bytestream2_get_byte(gb);
path: libavcodec/dfa.c
Vulnerability: Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings (i.e., use of a nonstandard --limit-rate argument or CURLOPT_BUFFERSIZE value).
Vulnerability ID: CVE-2018-0500
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/curl/curl
Published: 2018-07-11
File: lib/smtp.c
Commit message: smtp: use the upload buffer size for scratch buffer malloc

... not the read buffer size, as that can be set smaller and thus cause
a buffer overflow! CVE-2018-0500

Reported-by: Peter Wu
Bug: https://curl.haxx.se/docs/adv_2018-70a2.html
Commit author: Daniel Stenberg

Vulnerable version (before fix):
 CURLcode Curl_smtp_escape_eob(struct connectdata *conn, const ssize_t nread)   if(!scratch || data->set.crlf) {     oldscratch = scratch;      scratch = newscratch = malloc(2 * data->set.buffer_size);     if(!newscratch) {       failf(data, "Failed to alloc scratch buffer!");        return CURLE_OUT_OF_MEMORY;     }   }    /* Have we already sent part of the EOB? */   eob_sent = smtp->eob;

Fixed version (after fix):
 CURLcode Curl_smtp_escape_eob(struct connectdata *conn, const ssize_t nread)   if(!scratch || data->set.crlf) {     oldscratch = scratch;      scratch = newscratch = malloc(2 * UPLOAD_BUFSIZE);     if(!newscratch) {       failf(data, "Failed to alloc scratch buffer!");        return CURLE_OUT_OF_MEMORY;     }   }   DEBUGASSERT(UPLOAD_BUFSIZE >= nread);    /* Have we already sent part of the EOB? */   eob_sent = smtp->eob;

Patch:
patch: @@ -1563,13 +1563,14 @@ CURLcode Curl_smtp_escape_eob(struct connectdata *conn, const ssize_t nread)
   if(!scratch || data->set.crlf) {
     oldscratch = scratch;
 
-    scratch = newscratch = malloc(2 * data->set.buffer_size);
+    scratch = newscratch = malloc(2 * UPLOAD_BUFSIZE);
     if(!newscratch) {
       failf(data, "Failed to alloc scratch buffer!");
 
       return CURLE_OUT_OF_MEMORY;
     }
   }
+  DEBUGASSERT(UPLOAD_BUFSIZE >= nread);
 
   /* Have we already sent part of the EOB? */
   eob_sent = smtp->eob;
path: lib/smtp.c
Vulnerability: Bitmessage PyBitmessage version v0.6.2 (and introduced in or after commit 8ce72d8d2d25973b7064b1cf76a6b0b3d62f0ba0) contains a Eval injection vulnerability in main program, file src/messagetypes/__init__.py function constructObject that can result in Code Execution. This attack appears to be exploitable via remote attacker using a malformed message which must be processed by the victim - e.g. arrive from any sender on bitmessage network. This vulnerability appears to have been fixed in v0.6.3.
Vulnerability ID: CVE-2018-1000070
CWE: CWE-94
Severity score: 6.4
Project: https://github.com/Bitmessage/PyBitmessage
Published: 2018-03-13
File: src/messagetypes/__init__.py
Commit message: Fix message encoding bug

- prevent loading invalid message types
Commit author: Peter Surda

Vulnerable version (before fix):
 def encode(self):  def constructObject(data):     try:         classBase = eval(data[""] + "." + data[""].title())     except NameError:         logger.error("Don't know how to handle message type: \"%s\"", data[""])         return None     try:         returnObj = classBase()

Fixed version (after fix):
 def encode(self):  def constructObject(data):     try:         m = import_module("messagetypes." + data[""])         classBase = getattr(m, data[""].title())     except (NameError, ImportError):         logger.error("Don't know how to handle message type: \"%s\"", data[""], exc_info=True)         return None     try:         returnObj = classBase()

Patch:
patch: @@ -12,9 +12,10 @@ def encode(self):
 
 def constructObject(data):
     try:
-        classBase = eval(data[""] + "." + data[""].title())
-    except NameError:
-        logger.error("Don't know how to handle message type: \"%s\"", data[""])
+        m = import_module("messagetypes." + data[""])
+        classBase = getattr(m, data[""].title())
+    except (NameError, ImportError):
+        logger.error("Don't know how to handle message type: \"%s\"", data[""], exc_info=True)
         return None
     try:
         returnObj = classBase()
path: src/messagetypes/__init__.py
Vulnerability: RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6.
Vulnerability ID: CVE-2018-1000078
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/rubygems/rubygems
Published: 2018-03-13
File: lib/rubygems/server.rb
Commit message: Fix 289313
Commit author: Jonathan Claudius

Vulnerable version (before fix):
 def root(req, res)         "only_one_executable" => (executables && executables.size == 1),         "full_name"           => spec.full_name,         "has_deps"            => !deps.empty?,         "homepage"            => spec.homepage,         "name"                => spec.name,         "rdoc_installed"      => Gem::RDoc.new(spec).rdoc_installed?,         "ri_installed"        => Gem::RDoc.new(spec).ri_installed?,

Fixed version (after fix):
 def root(req, res)         "only_one_executable" => (executables && executables.size == 1),         "full_name"           => spec.full_name,         "has_deps"            => !deps.empty?,         "homepage"            => (URI.parse(spec.homepage).is_a?(URI::HTTP) || URI.parse(spec.homepage).is_a?(URI::HTTPS)) ? spec.homepage : ".",         "name"                => spec.name,         "rdoc_installed"      => Gem::RDoc.new(spec).rdoc_installed?,         "ri_installed"        => Gem::RDoc.new(spec).ri_installed?,

Patch:
patch: @@ -632,7 +632,7 @@ def root(req, res)
         "only_one_executable" => (executables && executables.size == 1),
         "full_name"           => spec.full_name,
         "has_deps"            => !deps.empty?,
-        "homepage"            => spec.homepage,
+        "homepage"            => (URI.parse(spec.homepage).is_a?(URI::HTTP) || URI.parse(spec.homepage).is_a?(URI::HTTPS)) ? spec.homepage : ".",
         "name"                => spec.name,
         "rdoc_installed"      => Gem::RDoc.new(spec).rdoc_installed?,
         "ri_installed"        => Gem::RDoc.new(spec).ri_installed?,
path: lib/rubygems/server.rb
Vulnerability: miniSphere version 5.2.9 and earlier contains a Integer Overflow vulnerability in layer_resize() function in map_engine.c that can result in remote denial of service. This attack appear to be exploitable via the victim must load a specially-crafted map which calls SetLayerSize in its entry script. This vulnerability appears to have been fixed in 5.0.3, 5.1.5, 5.2.10 and later.
Vulnerability ID: CVE-2018-1000524
CWE: CWE-190
Severity score: 2.9
Project: https://github.com/fatcerberus/minisphere
Published: 2018-06-26
File: src/minisphere/map_engine.c
Commit message: Fix integer overflow in layer_resize in map_engine.c (#268)

* Fix integer overflow in layer_resize in map_engine.c

There's a buffer overflow bug in the function layer_resize. It allocates
a buffer `tilemap` with size `x_size * y_size * sizeof(struct map_tile)`.
But it didn't check for integer overflow, so if x_size and y_size are
very large, it's possible that the buffer size is smaller than needed,
causing a buffer overflow later.

PoC: `SetLayerSize(0, 0x7FFFFFFF, 0x7FFFFFFF);`

* move malloc to a separate line
Commit author: Xiaoyin Liu

Vulnerable version (before fix):
 layer_resize(int layer, int x_size, int y_size) 	struct map_tile*    tilemap; 	struct map_trigger* trigger; 	struct map_zone*    zone;  	int x, y, i;  layer_resize(int layer, int x_size, int y_size)  	// allocate a new tilemap and copy the old layer tiles into it.  we can't simply realloc 	// because the tilemap is a 2D array. 	if (!(tilemap = malloc(x_size * y_size * sizeof(struct map_tile)))) 		return false; 	for (x = 0; x < x_size; ++x) { 		for (y = 0; y < y_size; ++y) {

Fixed version (after fix):
 layer_resize(int layer, int x_size, int y_size) 	struct map_tile*    tilemap; 	struct map_trigger* trigger; 	struct map_zone*    zone; 	size_t              tilemap_size;  	int x, y, i;  layer_resize(int layer, int x_size, int y_size)  	// allocate a new tilemap and copy the old layer tiles into it.  we can't simply realloc 	// because the tilemap is a 2D array. 	tilemap_size = x_size * y_size * sizeof(struct map_tile); 	if (x_size == 0 || tilemap_size / x_size / sizeof(struct map_tile) != y_size 		|| !(tilemap = malloc(tilemap_size))) 		return false; 	for (x = 0; x < x_size; ++x) { 		for (y = 0; y < y_size; ++y) {

Patch:
patch: @@ -1036,6 +1036,7 @@ layer_resize(int layer, int x_size, int y_size)
 	struct map_tile*    tilemap;
 	struct map_trigger* trigger;
 	struct map_zone*    zone;
+	size_t              tilemap_size;
 
 	int x, y, i;
 
@@ -1044,7 +1045,9 @@ layer_resize(int layer, int x_size, int y_size)
 
 	// allocate a new tilemap and copy the old layer tiles into it.  we can't simply realloc
 	// because the tilemap is a 2D array.
-	if (!(tilemap = malloc(x_size * y_size * sizeof(struct map_tile))))
+	tilemap_size = x_size * y_size * sizeof(struct map_tile);
+	if (x_size == 0 || tilemap_size / x_size / sizeof(struct map_tile) != y_size
+		|| !(tilemap = malloc(tilemap_size)))
 		return false;
 	for (x = 0; x < x_size; ++x) {
 		for (y = 0; y < y_size; ++y) {
path: src/minisphere/map_engine.c