rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: An issue was discovered in GNU LibreDWG through 0.9.3. There is a NULL pointer dereference in the function dwg_encode_LWPOLYLINE in dwg.spec.
Vulnerability ID: CVE-2019-20909
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/LibreDWG/libredwg
Published: 2020-07-16
File: src/encode.c
Commit message: encode: fix empty FIELD_2DD_VECTOR

Fixes GH #178 null_pointer1 case
Commit author: Reini Urban

Vulnerable version (before fix):
 static bool env_var_checked_p;  #define FIELD_2DD_VECTOR(nam, size, dxf)                                      \   OVERFLOW_CHECK (nam, _obj->size)                                            \   FIELD_2RD (nam[0], dxf);                                                    \   for (vcount = 1; vcount < (BITCODE_BL)_obj->size; vcount++)                 \     {                                                                         \       FIELD_2DD (nam[vcount], FIELD_VALUE (nam[vcount - 1].x),                \

Fixed version (after fix):
 static bool env_var_checked_p;  #define FIELD_2DD_VECTOR(nam, size, dxf)                                      \   OVERFLOW_CHECK (nam, _obj->size)                                            \   if (_obj->size)                                                             \     FIELD_2RD (nam[0], dxf);                                                  \   for (vcount = 1; vcount < (BITCODE_BL)_obj->size; vcount++)                 \     {                                                                         \       FIELD_2DD (nam[vcount], FIELD_VALUE (nam[vcount - 1].x),                \

Patch:
patch: @@ -281,7 +281,8 @@ static bool env_var_checked_p;
 
 #define FIELD_2DD_VECTOR(nam, size, dxf)                                      \
   OVERFLOW_CHECK (nam, _obj->size)                                            \
-  FIELD_2RD (nam[0], dxf);                                                    \
+  if (_obj->size)                                                             \
+    FIELD_2RD (nam[0], dxf);                                                  \
   for (vcount = 1; vcount < (BITCODE_BL)_obj->size; vcount++)                 \
     {                                                                         \
       FIELD_2DD (nam[vcount], FIELD_VALUE (nam[vcount - 1].x),                \
path: src/encode.c
Vulnerability: An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to a stack overflow in bits.c, possibly related to bit_read_TF.
Vulnerability ID: CVE-2019-20912
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/LibreDWG/libredwg
Published: 2020-07-16
File: src/bits.c
Commit message: encode: protect from stack under-flow

From GH #178 fuzzing
Commit author: Reini Urban

Vulnerable version (before fix):
 bit_write_UMC (Bit_Chain *dat, BITCODE_UMC val)     if (byte[i] & 0x7f)       break;    if (byte[i] & 0x40)     i--;   byte[i] &= 0x7f;   for (j = 4; j >= i; j--)

Fixed version (after fix):
 bit_write_UMC (Bit_Chain *dat, BITCODE_UMC val)     if (byte[i] & 0x7f)       break;    if (byte[i] & 0x40 && i > 0)     i--;   byte[i] &= 0x7f;   for (j = 4; j >= i; j--)

Patch:
patch: @@ -953,7 +953,7 @@ bit_write_UMC (Bit_Chain *dat, BITCODE_UMC val)
     if (byte[i] & 0x7f)
       break;
 
-  if (byte[i] & 0x40)
+  if (byte[i] & 0x40 && i > 0)
     i--;
   byte[i] &= 0x7f;
   for (j = 4; j >= i; j--)
path: src/bits.c
Vulnerability: An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to a heap-based buffer over-read in bit_write_TF in bits.c.
Vulnerability ID: CVE-2019-20915
CWE: CWE-125
Severity score: 4.9
Project: https://github.com/LibreDWG/libredwg
Published: 2020-07-16
File: src/bits.c
Commit message: encode: protect from stack under-flow

From GH #178 fuzzing
Commit author: Reini Urban

Vulnerable version (before fix):
 bit_write_MC (Bit_Chain *dat, BITCODE_MC val)     if (byte[i] & 0x7f)       break;    if (byte[i] & 0x40)     i--;   byte[i] &= 0x7f;   if (negative) bit_write_UMC (Bit_Chain *dat, BITCODE_UMC val)     if (byte[i] & 0x7f)       break;    if (byte[i] & 0x40)     i--;   byte[i] &= 0x7f;   for (j = 4; j >= i; j--)

Fixed version (after fix):
 bit_write_MC (Bit_Chain *dat, BITCODE_MC val)     if (byte[i] & 0x7f)       break;    if (byte[i] & 0x40 && i > 0)     i--;   byte[i] &= 0x7f;   if (negative) bit_write_UMC (Bit_Chain *dat, BITCODE_UMC val)     if (byte[i] & 0x7f)       break;    if (byte[i] & 0x40 && i > 0)     i--;   byte[i] &= 0x7f;   for (j = 4; j >= i; j--)

Patch:
patch: @@ -883,7 +883,7 @@ bit_write_MC (Bit_Chain *dat, BITCODE_MC val)
     if (byte[i] & 0x7f)
       break;
 
-  if (byte[i] & 0x40)
+  if (byte[i] & 0x40 && i > 0)
     i--;
   byte[i] &= 0x7f;
   if (negative)
@@ -953,7 +953,7 @@ bit_write_UMC (Bit_Chain *dat, BITCODE_UMC val)
     if (byte[i] & 0x7f)
       break;
 
-  if (byte[i] & 0x40)
+  if (byte[i] & 0x40 && i > 0)
     i--;
   byte[i] &= 0x7f;
   for (j = 4; j >= i; j--)
path: src/bits.c
Vulnerability: A vulnerability has been found in ajenti 2.1.31 and classified as critical. This vulnerability affects unknown code of the component API. The manipulation leads to privilege escalation. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.1.32 is able to address this issue. The name of the patch is 7aa146b724e0e20cfee2c71ca78fafbf53a8767c. It is recommended to upgrade the affected component.
Vulnerability ID: CVE-2019-25066
CWE: CWE-78
Severity score: 6.4
Project: https://github.com/ajenti/ajenti
Published: 2022-06-09
File: ajenti-core/aj/auth.py
Commit message: fixed shell injection in os auth provider
Commit author: Eugene Pankov

Vulnerable version (before fix):
 import subprocess import syslog from jadi import component, service, interface  import aj from aj.api.http import BaseHttpHandler class OSAuthenticationProvider(AuthenticationProvider):      def authenticate(self, username, password):         child = None         try:             child = pexpect.spawn('/bin/sh', ['-c', '/bin/su -c "/bin/echo SUCCESS" - %s' % username], timeout=5)             child.expect('.*:')             child.sendline(password)             result = child.expect(['su: .*', 'SUCCESS'])

Fixed version (after fix):
 import subprocess import syslog from jadi import component, service, interface from six import PY3  import aj from aj.api.http import BaseHttpHandler class OSAuthenticationProvider(AuthenticationProvider):      def authenticate(self, username, password):         child = None          if PY3:             from shlex import quote         else:             from pipes import quote          try:             child = pexpect.spawn('/bin/sh', ['-c', '/bin/su -c "/bin/echo SUCCESS" - %s' % quote(username)], timeout=5)             child.expect('.*:')             child.sendline(password)             result = child.expect(['su: .*', 'SUCCESS'])

Patch:
patch: @@ -5,6 +5,7 @@
 import subprocess
 import syslog
 from jadi import component, service, interface
+from six import PY3
 
 import aj
 from aj.api.http import BaseHttpHandler
@@ -99,8 +100,14 @@ class OSAuthenticationProvider(AuthenticationProvider):
 
     def authenticate(self, username, password):
         child = None
+
+        if PY3:
+            from shlex import quote
+        else:
+            from pipes import quote
+
         try:
-            child = pexpect.spawn('/bin/sh', ['-c', '/bin/su -c "/bin/echo SUCCESS" - %s' % username], timeout=5)
+            child = pexpect.spawn('/bin/sh', ['-c', '/bin/su -c "/bin/echo SUCCESS" - %s' % quote(username)], timeout=5)
             child.expect('.*:')
             child.sendline(password)
             result = child.expect(['su: .*', 'SUCCESS'])
path: ajenti-core/aj/auth.py
Vulnerability: In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free.
Vulnerability ID: CVE-2019-6974
CWE: CWE-416
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2019-02-15
File: virt/kvm/kvm_main.c
Commit message: kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)

kvm_ioctl_create_device() does the following:

1. creates a device that holds a reference to the VM object (with a borrowed
   reference, the VM's refcount has not been bumped yet)
2. initializes the device
3. transfers the reference to the device to the caller's file descriptor table
4. calls kvm_get_kvm() to turn the borrowed reference to the VM into a real
   reference

The ownership transfer in step 3 must not happen before the reference to the VM
becomes a proper, non-borrowed reference, which only happens in step 4.
After step 3, an attacker can close the file descriptor and drop the borrowed
reference, which can cause the refcount of the kvm object to drop to zero.

This means that we need to grab a reference for the device before
anon_inode_getfd(), otherwise the VM can disappear from under us.

Fixes: 852b6d57dc7f ("kvm: add device control API")
Cc: stable@kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Commit author: Jann Horn

Vulnerable version (before fix):
 static int kvm_ioctl_create_device(struct kvm *kvm, 	if (ops->init) 		ops->init(dev);  	ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC); 	if (ret < 0) { 		mutex_lock(&kvm->lock); 		list_del(&dev->vm_node); 		mutex_unlock(&kvm->lock); 		ops->destroy(dev); 		return ret; 	}  	kvm_get_kvm(kvm); 	cd->fd = ret; 	return 0; }

Fixed version (after fix):
 static int kvm_ioctl_create_device(struct kvm *kvm, 	if (ops->init) 		ops->init(dev);  	kvm_get_kvm(kvm); 	ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC); 	if (ret < 0) { 		kvm_put_kvm(kvm); 		mutex_lock(&kvm->lock); 		list_del(&dev->vm_node); 		mutex_unlock(&kvm->lock); 		ops->destroy(dev); 		return ret; 	}  	cd->fd = ret; 	return 0; }

Patch:
patch: @@ -3000,16 +3000,17 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
 	if (ops->init)
 		ops->init(dev);
 
+	kvm_get_kvm(kvm);
 	ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC);
 	if (ret < 0) {
+		kvm_put_kvm(kvm);
 		mutex_lock(&kvm->lock);
 		list_del(&dev->vm_node);
 		mutex_unlock(&kvm->lock);
 		ops->destroy(dev);
 		return ret;
 	}
 
-	kvm_get_kvm(kvm);
 	cd->fd = ret;
 	return 0;
 }
path: virt/kvm/kvm_main.c
Vulnerability: In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free.
Vulnerability ID: CVE-2019-6974
CWE: CWE-362
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2019-02-15
File: virt/kvm/kvm_main.c
Commit message: kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)

kvm_ioctl_create_device() does the following:

1. creates a device that holds a reference to the VM object (with a borrowed
   reference, the VM's refcount has not been bumped yet)
2. initializes the device
3. transfers the reference to the device to the caller's file descriptor table
4. calls kvm_get_kvm() to turn the borrowed reference to the VM into a real
   reference

The ownership transfer in step 3 must not happen before the reference to the VM
becomes a proper, non-borrowed reference, which only happens in step 4.
After step 3, an attacker can close the file descriptor and drop the borrowed
reference, which can cause the refcount of the kvm object to drop to zero.

This means that we need to grab a reference for the device before
anon_inode_getfd(), otherwise the VM can disappear from under us.

Fixes: 852b6d57dc7f ("kvm: add device control API")
Cc: stable@kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Commit author: Jann Horn

Vulnerable version (before fix):
 static int kvm_ioctl_create_device(struct kvm *kvm, 	if (ops->init) 		ops->init(dev);  	ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC); 	if (ret < 0) { 		mutex_lock(&kvm->lock); 		list_del(&dev->vm_node); 		mutex_unlock(&kvm->lock); 		ops->destroy(dev); 		return ret; 	}  	kvm_get_kvm(kvm); 	cd->fd = ret; 	return 0; }

Fixed version (after fix):
 static int kvm_ioctl_create_device(struct kvm *kvm, 	if (ops->init) 		ops->init(dev);  	kvm_get_kvm(kvm); 	ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC); 	if (ret < 0) { 		kvm_put_kvm(kvm); 		mutex_lock(&kvm->lock); 		list_del(&dev->vm_node); 		mutex_unlock(&kvm->lock); 		ops->destroy(dev); 		return ret; 	}  	cd->fd = ret; 	return 0; }

Patch:
patch: @@ -3000,16 +3000,17 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
 	if (ops->init)
 		ops->init(dev);
 
+	kvm_get_kvm(kvm);
 	ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC);
 	if (ret < 0) {
+		kvm_put_kvm(kvm);
 		mutex_lock(&kvm->lock);
 		list_del(&dev->vm_node);
 		mutex_unlock(&kvm->lock);
 		ops->destroy(dev);
 		return ret;
 	}
 
-	kvm_get_kvm(kvm);
 	cd->fd = ret;
 	return 0;
 }
path: virt/kvm/kvm_main.c
Vulnerability: In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c.
Vulnerability ID: CVE-2019-7175
CWE: CWE-401
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2019-03-07
File: coders/pcd.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1450
Commit author: Cristy

Vulnerable version (before fix):
 static MagickBooleanType DecodeImage(Image *image,unsigned char *luma,     if (pcd_table[i] == (PCDTable *) NULL)       {         buffer=(unsigned char *) RelinquishMagickMemory(buffer);         ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",           image->filename);       } static MagickBooleanType DecodeImage(Image *image,unsigned char *luma,       if (r->length > 16)         {           buffer=(unsigned char *) RelinquishMagickMemory(buffer);           return(MagickFalse);         }       PCDGetBits(16);

Fixed version (after fix):
 static MagickBooleanType DecodeImage(Image *image,unsigned char *luma,     if (pcd_table[i] == (PCDTable *) NULL)       {         buffer=(unsigned char *) RelinquishMagickMemory(buffer);         for (j=0; j < i; j++)           pcd_table[j]=(PCDTable *) RelinquishMagickMemory(pcd_table[j]);         ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",           image->filename);       } static MagickBooleanType DecodeImage(Image *image,unsigned char *luma,       if (r->length > 16)         {           buffer=(unsigned char *) RelinquishMagickMemory(buffer);           for (j=0; j <= i; j++)             pcd_table[j]=(PCDTable *) RelinquishMagickMemory(pcd_table[j]);           return(MagickFalse);         }       PCDGetBits(16);

Patch:
patch: @@ -204,6 +204,8 @@ static MagickBooleanType DecodeImage(Image *image,unsigned char *luma,
     if (pcd_table[i] == (PCDTable *) NULL)
       {
         buffer=(unsigned char *) RelinquishMagickMemory(buffer);
+        for (j=0; j < i; j++)
+          pcd_table[j]=(PCDTable *) RelinquishMagickMemory(pcd_table[j]);
         ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
           image->filename);
       }
@@ -215,6 +217,8 @@ static MagickBooleanType DecodeImage(Image *image,unsigned char *luma,
       if (r->length > 16)
         {
           buffer=(unsigned char *) RelinquishMagickMemory(buffer);
+          for (j=0; j <= i; j++)
+            pcd_table[j]=(PCDTable *) RelinquishMagickMemory(pcd_table[j]);
           return(MagickFalse);
         }
       PCDGetBits(16);
path: coders/pcd.c
Vulnerability: app/Core/Paginator.php in Kanboard before 1.2.8 has XSS in pagination sorting.
Vulnerability ID: CVE-2019-7324
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/kanboard/kanboard
Published: 2019-02-04
File: app/Core/Paginator.php
Commit message: Avoid XSS in pagination ordering
Commit author: Frédéric Guillot

Vulnerable version (before fix):
 public function setFormatter(FormatterInterface $formatter)     public function executeQuery()     {         if ($this->query !== null) {             $this->query                 ->offset($this->offset)                 ->limit($this->limit)                 ->orderBy($this->order, $this->direction);              if ($this->formatter !== null) {                 return $this->formatter->withQuery($this->query)->format();

Fixed version (after fix):
 public function setFormatter(FormatterInterface $formatter)     public function executeQuery()     {         if ($this->query !== null) {              $this->query                 ->offset($this->offset)                 ->limit($this->limit);              if (preg_match('/^[a-zA-Z0-9._]+$/', $this->order)) {                 $this->query->orderBy($this->order, $this->direction);             } else {                 $this->order = '';             }              if ($this->formatter !== null) {                 return $this->formatter->withQuery($this->query)->format();

Patch:
patch: @@ -169,10 +169,16 @@ public function setFormatter(FormatterInterface $formatter)
     public function executeQuery()
     {
         if ($this->query !== null) {
+
             $this->query
                 ->offset($this->offset)
-                ->limit($this->limit)
-                ->orderBy($this->order, $this->direction);
+                ->limit($this->limit);
+
+            if (preg_match('/^[a-zA-Z0-9._]+$/', $this->order)) {
+                $this->query->orderBy($this->order, $this->direction);
+            } else {
+                $this->order = '';
+            }
 
             if ($this->formatter !== null) {
                 return $this->formatter->withQuery($this->query)->format();
path: app/Core/Paginator.php
Vulnerability: In ImageMagick before 7.0.8-25, a memory leak exists in WritePSDChannel in coders/psd.c.
Vulnerability ID: CVE-2019-7395
CWE: CWE-401
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2019-02-05
File: coders/psd.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1451
Commit author: Cristy

Vulnerable version (before fix):
 static size_t WritePSDChannel(const PSDInfo *psd_info,       if (deflateInit(&stream,level) != Z_OK)         {           quantum_info=DestroyQuantumInfo(quantum_info);           return(0);         }     }

Fixed version (after fix):
 static size_t WritePSDChannel(const PSDInfo *psd_info,       if (deflateInit(&stream,level) != Z_OK)         {           quantum_info=DestroyQuantumInfo(quantum_info);           compressed_pixels=(unsigned char *) RelinquishMagickMemory(             compressed_pixels);           return(0);         }     }

Patch:
patch: @@ -2782,6 +2782,8 @@ static size_t WritePSDChannel(const PSDInfo *psd_info,
       if (deflateInit(&stream,level) != Z_OK)
         {
           quantum_info=DestroyQuantumInfo(quantum_info);
+          compressed_pixels=(unsigned char *) RelinquishMagickMemory(
+            compressed_pixels);
           return(0);
         }
     }
path: coders/psd.c
Vulnerability: In ImageMagick before 7.0.8-25, a memory leak exists in ReadSIXELImage in coders/sixel.c.
Vulnerability ID: CVE-2019-7396
CWE: CWE-401
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2019-02-05
File: coders/sixel.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1452
Commit author: Cristy

Vulnerable version (before fix):
 static Image *ReadSIXELImage(const ImageInfo *image_info,ExceptionInfo *exceptio   if (sixel_decode(image,(unsigned char *) sixel_buffer,&sixel_pixels,&image->columns,&image->rows,&sixel_palette,&image->colors,exception) == MagickFalse)     {       sixel_buffer=(char *) RelinquishMagickMemory(sixel_buffer);       ThrowReaderException(CorruptImageError,"CorruptImage");     }   sixel_buffer=(char *) RelinquishMagickMemory(sixel_buffer);

Fixed version (after fix):
 static Image *ReadSIXELImage(const ImageInfo *image_info,ExceptionInfo *exceptio   if (sixel_decode(image,(unsigned char *) sixel_buffer,&sixel_pixels,&image->columns,&image->rows,&sixel_palette,&image->colors,exception) == MagickFalse)     {       sixel_buffer=(char *) RelinquishMagickMemory(sixel_buffer);       sixel_pixels=(unsigned char *) RelinquishMagickMemory(sixel_pixels);       ThrowReaderException(CorruptImageError,"CorruptImage");     }   sixel_buffer=(char *) RelinquishMagickMemory(sixel_buffer);

Patch:
patch: @@ -1057,6 +1057,7 @@ static Image *ReadSIXELImage(const ImageInfo *image_info,ExceptionInfo *exceptio
   if (sixel_decode(image,(unsigned char *) sixel_buffer,&sixel_pixels,&image->columns,&image->rows,&sixel_palette,&image->colors,exception) == MagickFalse)
     {
       sixel_buffer=(char *) RelinquishMagickMemory(sixel_buffer);
+      sixel_pixels=(unsigned char *) RelinquishMagickMemory(sixel_pixels);
       ThrowReaderException(CorruptImageError,"CorruptImage");
     }
   sixel_buffer=(char *) RelinquishMagickMemory(sixel_buffer);
path: coders/sixel.c
Vulnerability: Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution.
Vulnerability ID: CVE-2019-8293
CWE: CWE-434
Severity score: 6.4
Project: https://github.com/abcprintf/upload-image-with-ajax
Published: 2019-12-23
File: upload.php
Commit message: update #Arbitrary file upload vulnerability
Commit author: Mix Abcprintf

Vulnerable version (before fix):
             $ready = true;         }else{             echo "was not an image<br>";         }          if($_FILES["fileUpload"]["size"] < 1000000){             $ready = true;             echo "file size is ".$_FILES['fileUpload']["size"]."<br>";         }else{             echo "file was TOO BIG!";         }          if($_FILES["fileUpload"]["error"]){             echo "looks like there was an error".$_FILES['fileUpload']["error"]."<br>";             $ready = false;         }          $targetPath = "images/".$imageFile;         $sourcePath = $_FILES["fileUpload"]["tmp_name"];         if(file_exists("images/".$imageFile)){             echo "File already there <br>";             $ready = false;         }          if($ready == true){

Fixed version (after fix):
             $ready = true;         }else{             echo "was not an image<br>";             exit();         }          if($_FILES["fileUpload"]["size"] < 1000000){             $ready = true;             echo "file size is ".$_FILES['fileUpload']["size"]."<br>";         }else{             echo "file was TOO BIG!";             exit();         }          if($_FILES["fileUpload"]["error"]){             echo "looks like there was an error".$_FILES['fileUpload']["error"]."<br>";             $ready = false;             exit();         }          $targetPath = "images/".$imageFile;         $sourcePath = $_FILES["fileUpload"]["tmp_name"];         if(file_exists("images/".$imageFile)){             echo "File already there <br>";             $ready = false;             exit();         }          if($ready == true){

Patch:
patch: @@ -9,25 +9,29 @@
             $ready = true;
         }else{
             echo "was not an image<br>";
+            exit();
         }
 
         if($_FILES["fileUpload"]["size"] < 1000000){
             $ready = true;
             echo "file size is ".$_FILES['fileUpload']["size"]."<br>";
         }else{
             echo "file was TOO BIG!";
+            exit();
         }
 
         if($_FILES["fileUpload"]["error"]){
             echo "looks like there was an error".$_FILES['fileUpload']["error"]."<br>";
             $ready = false;
+            exit();
         }
 
         $targetPath = "images/".$imageFile;
         $sourcePath = $_FILES["fileUpload"]["tmp_name"];
         if(file_exists("images/".$imageFile)){
             echo "File already there <br>";
             $ready = false;
+            exit();
         }
 
         if($ready == true){
path: upload.php