rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Integer overflow in the license_read_scope_list function in libfreerdp/core/license.c in FreeRDP through 1.0.2 allows remote RDP servers to cause a denial of service (application crash) or possibly have unspecified other impact via a large ScopeCount value in a Scope List in a Server License Request packet.
Vulnerability ID: CVE-2014-0791
CWE: CWE-189
Severity score: 6.4
Project: https://github.com/sidhpurwala-huzaifa/FreeRDP
Published: 2014-01-03
File: libfreerdp/core/license.c
Commit message: Fix possible integer overflow in license_read_scope_list()
Commit author: Huzaifa Sidhpurwala

Vulnerable version (before fix):
 BOOL license_read_scope_list(wStream* s, SCOPE_LIST* scopeList)  	Stream_Read_UINT32(s, scopeCount); /* ScopeCount (4 bytes) */  	scopeList->count = scopeCount; 	scopeList->array = (LICENSE_BLOB*) malloc(sizeof(LICENSE_BLOB) * scopeCount); 

Fixed version (after fix):
 BOOL license_read_scope_list(wStream* s, SCOPE_LIST* scopeList)  	Stream_Read_UINT32(s, scopeCount); /* ScopeCount (4 bytes) */          if (Stream_GetRemainingLength(s) / sizeof(LICENSE_BLOB) < scopeCount)                 return FALSE;  /* Avoid overflow in malloc */  	scopeList->count = scopeCount; 	scopeList->array = (LICENSE_BLOB*) malloc(sizeof(LICENSE_BLOB) * scopeCount); 

Patch:
patch: @@ -670,6 +670,9 @@ BOOL license_read_scope_list(wStream* s, SCOPE_LIST* scopeList)
 
 	Stream_Read_UINT32(s, scopeCount); /* ScopeCount (4 bytes) */
 
+        if (Stream_GetRemainingLength(s) / sizeof(LICENSE_BLOB) < scopeCount)
+                return FALSE;  /* Avoid overflow in malloc */
+
 	scopeList->count = scopeCount;
 	scopeList->array = (LICENSE_BLOB*) malloc(sizeof(LICENSE_BLOB) * scopeCount);
path: libfreerdp/core/license.c
Vulnerability: The fst_get_iface function in drivers/net/wan/farsync.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCWANDEV ioctl call.
Vulnerability ID: CVE-2014-1444
CWE: CWE-399
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2014-01-18
File: drivers/net/wan/farsync.c
Commit message: farsync: fix info leak in ioctl

The fst_get_iface() code fails to initialize the two padding bytes of
struct sync_serial_settings after the ->loopback member. Add an explicit
memset(0) before filling the structure to avoid the info leak.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Salva Peiró

Vulnerable version (before fix):
 fst_get_iface(struct fst_card_info *card, struct fst_port_info *port, 	}  	i = port->index; 	sync.clock_rate = FST_RDL(card, portConfig[i].lineSpeed); 	/* Lucky card and linux use same encoding here */ 	sync.clock_type = FST_RDB(card, portConfig[i].internalClock) ==

Fixed version (after fix):
 fst_get_iface(struct fst_card_info *card, struct fst_port_info *port, 	}  	i = port->index; 	memset(&sync, 0, sizeof(sync)); 	sync.clock_rate = FST_RDL(card, portConfig[i].lineSpeed); 	/* Lucky card and linux use same encoding here */ 	sync.clock_type = FST_RDB(card, portConfig[i].internalClock) ==

Patch:
patch: @@ -1972,6 +1972,7 @@ fst_get_iface(struct fst_card_info *card, struct fst_port_info *port,
 	}
 
 	i = port->index;
+	memset(&sync, 0, sizeof(sync));
 	sync.clock_rate = FST_RDL(card, portConfig[i].lineSpeed);
 	/* Lucky card and linux use same encoding here */
 	sync.clock_type = FST_RDB(card, portConfig[i].internalClock) ==
path: drivers/net/wan/farsync.c
Vulnerability: The wanxl_ioctl function in drivers/net/wan/wanxl.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via an ioctl call.
Vulnerability ID: CVE-2014-1445
CWE: CWE-399
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2014-01-18
File: drivers/net/wan/wanxl.c
Commit message: wanxl: fix info leak in ioctl

The wanxl_ioctl() code fails to initialize the two padding bytes of
struct sync_serial_settings after the ->loopback member. Add an explicit
memset(0) before filling the structure to avoid the info leak.

Signed-off-by: Salva Peiró <speiro@ai2.upv.es>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Salva Peiró

Vulnerable version (before fix):
 static int wanxl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) 			ifr->ifr_settings.size = size; /* data size wanted */ 			return -ENOBUFS; 		} 		line.clock_type = get_status(port)->clocking; 		line.clock_rate = 0; 		line.loopback = 0;

Fixed version (after fix):
 static int wanxl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) 			ifr->ifr_settings.size = size; /* data size wanted */ 			return -ENOBUFS; 		} 		memset(&line, 0, sizeof(line)); 		line.clock_type = get_status(port)->clocking; 		line.clock_rate = 0; 		line.loopback = 0;

Patch:
patch: @@ -355,6 +355,7 @@ static int wanxl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 			ifr->ifr_settings.size = size; /* data size wanted */
 			return -ENOBUFS;
 		}
+		memset(&line, 0, sizeof(line));
 		line.clock_type = get_status(port)->clocking;
 		line.clock_rate = 0;
 		line.loopback = 0;
path: drivers/net/wan/wanxl.c
Vulnerability: The yam_ioctl function in drivers/net/hamradio/yam.c in the Linux kernel before 3.12.8 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCYAMGCFG ioctl call.
Vulnerability ID: CVE-2014-1446
CWE: CWE-399
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2014-01-18
File: drivers/net/hamradio/yam.c
Commit message: hamradio/yam: fix info leak in ioctl

The yam_ioctl() code fails to initialise the cmd field
of the struct yamdrv_ioctl_cfg. Add an explicit memset(0)
before filling the structure to avoid the 4-byte info leak.

Signed-off-by: Salva Peiró <speiro@ai2.upv.es>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Salva Peiró

Vulnerable version (before fix):
 static int yam_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) 		break;  	case SIOCYAMGCFG: 		yi.cfg.mask = 0xffffffff; 		yi.cfg.iobase = yp->iobase; 		yi.cfg.irq = yp->irq;

Fixed version (after fix):
 static int yam_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) 		break;  	case SIOCYAMGCFG: 		memset(&yi, 0, sizeof(yi)); 		yi.cfg.mask = 0xffffffff; 		yi.cfg.iobase = yp->iobase; 		yi.cfg.irq = yp->irq;

Patch:
patch: @@ -1057,6 +1057,7 @@ static int yam_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 		break;
 
 	case SIOCYAMGCFG:
+		memset(&yi, 0, sizeof(yi));
 		yi.cfg.mask = 0xffffffff;
 		yi.cfg.iobase = yp->iobase;
 		yi.cfg.irq = yp->irq;
path: drivers/net/hamradio/yam.c
Vulnerability: The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device.
Vulnerability ID: CVE-2014-1738
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2014-05-11
File: drivers/block/floppy.c
Commit message: floppy: don't write kernel-only members to FDRAWCMD ioctl output

Do not leak kernel-only floppy_raw_cmd structure members to userspace.
This includes the linked-list pointer and the pointer to the allocated
DMA space.

Signed-off-by: Matthew Daley <mattd@bugfuzz.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Matthew Daley

Vulnerable version (before fix):
 static int raw_cmd_copyout(int cmd, void __user *param, 	int ret;  	while (ptr) { 		ret = copy_to_user(param, ptr, sizeof(*ptr)); 		if (ret) 			return -EFAULT; 		param += sizeof(struct floppy_raw_cmd);

Fixed version (after fix):
 static int raw_cmd_copyout(int cmd, void __user *param, 	int ret;  	while (ptr) { 		struct floppy_raw_cmd cmd = *ptr; 		cmd.next = NULL; 		cmd.kernel_data = NULL; 		ret = copy_to_user(param, &cmd, sizeof(cmd)); 		if (ret) 			return -EFAULT; 		param += sizeof(struct floppy_raw_cmd);

Patch:
patch: @@ -3067,7 +3067,10 @@ static int raw_cmd_copyout(int cmd, void __user *param,
 	int ret;
 
 	while (ptr) {
-		ret = copy_to_user(param, ptr, sizeof(*ptr));
+		struct floppy_raw_cmd cmd = *ptr;
+		cmd.next = NULL;
+		cmd.kernel_data = NULL;
+		ret = copy_to_user(param, &cmd, sizeof(cmd));
 		if (ret)
 			return -EFAULT;
 		param += sizeof(struct floppy_raw_cmd);
path: drivers/block/floppy.c
Vulnerability: The media_device_enum_entities function in drivers/media/media-device.c in the Linux kernel before 3.14.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call.
Vulnerability ID: CVE-2014-1739
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2014-06-23
File: drivers/media/media-device.c
Commit message: [media] media-device: fix infoleak in ioctl media_enum_entities()

This fixes CVE-2014-1739.

Signed-off-by: Salva Peiró <speiro@ai2.upv.es>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Commit author: Salva Peiró

Vulnerable version (before fix):
 static long media_device_enum_entities(struct media_device *mdev, 	struct media_entity *ent; 	struct media_entity_desc u_ent;  	if (copy_from_user(&u_ent.id, &uent->id, sizeof(u_ent.id))) 		return -EFAULT; 

Fixed version (after fix):
 static long media_device_enum_entities(struct media_device *mdev, 	struct media_entity *ent; 	struct media_entity_desc u_ent;  	memset(&u_ent, 0, sizeof(u_ent)); 	if (copy_from_user(&u_ent.id, &uent->id, sizeof(u_ent.id))) 		return -EFAULT; 

Patch:
patch: @@ -93,6 +93,7 @@ static long media_device_enum_entities(struct media_device *mdev,
 	struct media_entity *ent;
 	struct media_entity_desc u_ent;
 
+	memset(&u_ent, 0, sizeof(u_ent));
 	if (copy_from_user(&u_ent.id, &uent->id, sizeof(u_ent.id)))
 		return -EFAULT;
path: drivers/media/media-device.c
Vulnerability: Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action.
Vulnerability ID: CVE-2014-1879
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/phpmyadmin/phpmyadmin
Published: 2014-02-20
File: import.php
Commit message: Sanitize filename in import message

Signed-off-by: Michal Čihař <michal@cihar.com>
Commit author: Michal Čihař

Vulnerable version (before fix):
             $message->addString($import_notice);         }         if (isset($local_import_file)) {             $message->addString('(' . $local_import_file . ')');         } else {             $message->addString('(' . $_FILES['import_file']['name'] . ')');         }     } }

Fixed version (after fix):
             $message->addString($import_notice);         }         if (isset($local_import_file)) {             $message->addString('(' . htmlspecialchars($local_import_file) . ')');         } else {             $message->addString('(' . htmlspecialchars($_FILES['import_file']['name']) . ')');         }     } }

Patch:
patch: @@ -568,9 +568,9 @@
             $message->addString($import_notice);
         }
         if (isset($local_import_file)) {
-            $message->addString('(' . $local_import_file . ')');
+            $message->addString('(' . htmlspecialchars($local_import_file) . ')');
         } else {
-            $message->addString('(' . $_FILES['import_file']['name'] . ')');
+            $message->addString('(' . htmlspecialchars($_FILES['import_file']['name']) . ')');
         }
     }
 }
path: import.php
Vulnerability: Directory traversal vulnerability in the CLI job creation (hudson/cli/CreateJobCommand.java) in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to overwrite arbitrary files via the job name.
Vulnerability ID: CVE-2014-2059
CWE: CWE-22
Severity score: 6.4
Project: https://github.com/jenkinsci/jenkins
Published: 2014-03-01
File: core/src/main/java/hudson/cli/CreateJobCommand.java
Commit message: [FIXED SECURITY-108] Check job name created via CLI
Commit author: Vojtech Juranek

Vulnerable version (before fix):
 protected int run() throws Exception {             name = name.substring(i + 1);         }          ig.createProjectFromXML(name, stdin);         return 0;     }

Fixed version (after fix):
 protected int run() throws Exception {             name = name.substring(i + 1);         }          Jenkins.checkGoodName(name);         ig.createProjectFromXML(name, stdin);         return 0;     }

Patch:
patch: @@ -72,6 +72,7 @@ protected int run() throws Exception {
             name = name.substring(i + 1);
         }
 
+        Jenkins.checkGoodName(name);
         ig.createProjectFromXML(name, stdin);
         return 0;
     }
path: core/src/main/java/hudson/cli/CreateJobCommand.java
Vulnerability: Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sessions via vectors involving the "override" of Jenkins cookies.
Vulnerability ID: CVE-2014-2066
CWE: CWE-287
Severity score: 6.4
Project: https://github.com/jenkinsci/jenkins
Published: 2014-10-17
File: core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java
Commit message: [FIXED SECURITY-75] Invalidate session after login to avoid session fixation
Commit author: Vojtech Juranek

Vulnerable version (before fix):
 protected void onSuccessfulAuthentication(HttpServletRequest request, HttpServle         // HttpSessionContextIntegrationFilter stores the updated SecurityContext object into this session later         // (either when a redirect is issued, via its HttpResponseWrapper, or when the execution returns to its         // doFilter method.         request.getSession();     } 

Fixed version (after fix):
 protected void onSuccessfulAuthentication(HttpServletRequest request, HttpServle         // HttpSessionContextIntegrationFilter stores the updated SecurityContext object into this session later         // (either when a redirect is issued, via its HttpResponseWrapper, or when the execution returns to its         // doFilter method.         request.getSession().invalidate();         request.getSession();     } 

Patch:
patch: @@ -85,6 +85,7 @@ protected void onSuccessfulAuthentication(HttpServletRequest request, HttpServle
         // HttpSessionContextIntegrationFilter stores the updated SecurityContext object into this session later
         // (either when a redirect is issued, via its HttpResponseWrapper, or when the execution returns to its
         // doFilter method.
+        request.getSession().invalidate();
         request.getSession();
     }
path: core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java
Vulnerability: Cross-site scripting (XSS) vulnerability in java/hudson/model/Cause.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to inject arbitrary web script or HTML via a "remote cause note."
Vulnerability ID: CVE-2014-2067
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/jenkinsci/jenkins
Published: 2014-03-01
File: core/src/main/java/hudson/model/Cause.java
Commit message: [FIXED SECURITY-74] Apply markup formatter to remote cause note.
Commit author: Jesse Glick

Vulnerable version (before fix):
 import org.kohsuke.stapler.export.Exported; import org.kohsuke.stapler.export.ExportedBean; import com.thoughtworks.xstream.converters.UnmarshallingContext; import java.util.HashSet; import java.util.Set; import javax.annotation.CheckForNull; public RemoteCause(String host, String note) {         @Override         public String getShortDescription() {             if(note != null) {                 return Messages.Cause_RemoteCause_ShortDescriptionWithNote(addr, note);             } else {                 return Messages.Cause_RemoteCause_ShortDescription(addr);             }         }          @Override

Fixed version (after fix):
 import org.kohsuke.stapler.export.Exported; import org.kohsuke.stapler.export.ExportedBean; import com.thoughtworks.xstream.converters.UnmarshallingContext; import java.io.IOException; import java.util.HashSet; import java.util.Set; import javax.annotation.CheckForNull; public RemoteCause(String host, String note) {         @Override         public String getShortDescription() {             if(note != null) {                 try {                     return Messages.Cause_RemoteCause_ShortDescriptionWithNote(addr, Jenkins.getInstance().getMarkupFormatter().translate(note));                 } catch (IOException x) {                     // ignore                 }             }             return Messages.Cause_RemoteCause_ShortDescription(addr);         }          @Override

Patch:
patch: @@ -34,6 +34,7 @@
 import org.kohsuke.stapler.export.Exported;
 import org.kohsuke.stapler.export.ExportedBean;
 import com.thoughtworks.xstream.converters.UnmarshallingContext;
+import java.io.IOException;
 import java.util.HashSet;
 import java.util.Set;
 import javax.annotation.CheckForNull;
@@ -371,10 +372,13 @@ public RemoteCause(String host, String note) {
         @Override
         public String getShortDescription() {
             if(note != null) {
-                return Messages.Cause_RemoteCause_ShortDescriptionWithNote(addr, note);
-            } else {
-                return Messages.Cause_RemoteCause_ShortDescription(addr);
+                try {
+                    return Messages.Cause_RemoteCause_ShortDescriptionWithNote(addr, Jenkins.getInstance().getMarkupFormatter().translate(note));
+                } catch (IOException x) {
+                    // ignore
+                }
             }
+            return Messages.Cause_RemoteCause_ShortDescription(addr);
         }
 
         @Override
path: core/src/main/java/hudson/model/Cause.java
Vulnerability: The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users with the ADMINISTER permission to obtain sensitive information via vectors related to heapDump.
Vulnerability ID: CVE-2014-2068
CWE: CWE-264
Severity score: 2.9
Project: https://github.com/jenkinsci/jenkins
Published: 2014-10-17
File: core/src/main/java/hudson/util/RemotingDiagnostics.java
Commit message: [FIXED SECURITY-73] Require RUN_SCRIPTS for /heapDump.
Commit author: Jesse Glick

Vulnerable version (before fix):
 public void doIndex(StaplerResponse rsp) throws IOException {          @WebMethod(name="heapdump.hprof")         public void doHeapDump(StaplerRequest req, StaplerResponse rsp) throws IOException, InterruptedException {             owner.checkPermission(Jenkins.ADMINISTER);             rsp.setContentType("application/octet-stream");              FilePath dump = obtain();

Fixed version (after fix):
 public void doIndex(StaplerResponse rsp) throws IOException {          @WebMethod(name="heapdump.hprof")         public void doHeapDump(StaplerRequest req, StaplerResponse rsp) throws IOException, InterruptedException {             owner.checkPermission(Jenkins.RUN_SCRIPTS);             rsp.setContentType("application/octet-stream");              FilePath dump = obtain();

Patch:
patch: @@ -202,7 +202,7 @@ public void doIndex(StaplerResponse rsp) throws IOException {
 
         @WebMethod(name="heapdump.hprof")
         public void doHeapDump(StaplerRequest req, StaplerResponse rsp) throws IOException, InterruptedException {
-            owner.checkPermission(Jenkins.ADMINISTER);
+            owner.checkPermission(Jenkins.RUN_SCRIPTS);
             rsp.setContentType("application/octet-stream");
 
             FilePath dump = obtain();
path: core/src/main/java/hudson/util/RemotingDiagnostics.java
Vulnerability: Brookins Consulting (BC) Collected Information Export extension for eZ Publish 1.1.0 does not properly restrict access, which allows remote attackers to gain access to sensitive data.
Vulnerability ID: CVE-2014-2552
CWE: CWE-264
Severity score: 6.4
Project: https://github.com/brookinsconsulting/bccie
Published: 2018-04-27
File: settings/site.ini.append.php
Commit message: Updated: Commented out role policy override settings for greater default security of cie information
Commit author: Brookins Consulting

Vulnerable version (before fix):
 [RegionalSettings] TranslationExtensions[]=bccie  [RoleSettings] PolicyOmitList[]=bccie/overview PolicyOmitList[]=bccie/export PolicyOmitList[]=bccie/doexport  */ ?>\ No newline at end of file

Fixed version (after fix):
 [RegionalSettings] TranslationExtensions[]=bccie  # # Uncomment the following to enable module views regardless of missing role policy configuration # # [RoleSettings] # PolicyOmitList[]=bccie/overview # PolicyOmitList[]=bccie/export # PolicyOmitList[]=bccie/doexport  */ ?>\ No newline at end of file

Patch:
patch: @@ -6,9 +6,12 @@
 [RegionalSettings]
 TranslationExtensions[]=bccie
 
-[RoleSettings]
-PolicyOmitList[]=bccie/overview
-PolicyOmitList[]=bccie/export
-PolicyOmitList[]=bccie/doexport
+#
+# Uncomment the following to enable module views regardless of missing role policy configuration
+#
+# [RoleSettings]
+# PolicyOmitList[]=bccie/overview
+# PolicyOmitList[]=bccie/export
+# PolicyOmitList[]=bccie/doexport
 
 */ ?>
\ No newline at end of file
path: settings/site.ini.append.php
Vulnerability: Cross-site scripting (XSS) vulnerability in www/make_subset.php in PHP Font Lib before 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter.
Vulnerability ID: CVE-2014-2570
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/PhenX/php-font-lib
Published: 2015-08-31
File: www/make_subset.php
Commit message: Fix a possible XSS
Commit author: Fabien Ménager

Vulnerable version (before fix):
   <link rel="stylesheet" href="css/style.css" /> </head> <body>   <h1><?php echo $name; ?></h1>   <form name="make-subset" method="post" action="?fontfile=<?php echo $fontfile; ?>">     <label>       Insert the text from which you want the glyphs in the subsetted font: <br />

Fixed version (after fix):
   <link rel="stylesheet" href="css/style.css" /> </head> <body>   <h1><?php echo htmlentities($name); ?></h1>   <form name="make-subset" method="post" action="?fontfile=<?php echo $fontfile; ?>">     <label>       Insert the text from which you want the glyphs in the subsetted font: <br />

Patch:
patch: @@ -61,7 +61,7 @@
   <link rel="stylesheet" href="css/style.css" />
 </head>
 <body>
-  <h1><?php echo $name; ?></h1>
+  <h1><?php echo htmlentities($name); ?></h1>
   <form name="make-subset" method="post" action="?fontfile=<?php echo $fontfile; ?>">
     <label>
       Insert the text from which you want the glyphs in the subsetted font: <br />
path: www/make_subset.php