rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: There is a Cross Site Scripting (XSS) vulnerability in SpotPage_login.php of Spotweb 1.5.1 and below, which allows remote attackers to inject arbitrary web script or HTML via the data[performredirect] parameter.
Vulnerability ID: CVE-2021-43725
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/spotweb/spotweb
Published: 2022-03-28
File: lib/page/SpotPage_login.php
Commit message: Update SpotPage_login.php

For for issue: https://github.com/spotweb/spotweb/issues/718
Commit author: Sweepr

Vulnerable version (before fix):
 public function render()          // bring the form action into the local scope         $formAction = $this->_loginForm['action'];          // Are we already submitting the form login?         if (!empty($formAction)) {             // make sure we can simply assume all fields are there

Fixed version (after fix):
 public function render()          // bring the form action into the local scope         $formAction = $this->_loginForm['action'];                  // Check redirect for chevrons, deny if found.         if (preg_match('/[<>]/i', $this->_params['data']['performredirect'])) {			 		$result->addError(_('Script is not allowed')); 		}                  // Are we already submitting the form login?         if (!empty($formAction)) {             // make sure we can simply assume all fields are there

Patch:
patch: @@ -37,7 +37,12 @@ public function render()
 
         // bring the form action into the local scope
         $formAction = $this->_loginForm['action'];
-
+        
+        // Check redirect for chevrons, deny if found.
+        if (preg_match('/[<>]/i', $this->_params['data']['performredirect'])) {			
+		$result->addError(_('Script is not allowed'));
+		}
+        
         // Are we already submitting the form login?
         if (!empty($formAction)) {
             // make sure we can simply assume all fields are there
path: lib/page/SpotPage_login.php
Vulnerability: Barcode is a GLPI plugin for printing barcodes and QR codes. GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin installed are vulnerable to a path traversal vulnerability. This issue was patched in version 2.6.1. As a workaround, delete the `front/send.php` file.
Vulnerability ID: CVE-2021-43778
CWE: CWE-22
Severity score: 2.9
Project: https://github.com/pluginsGLPI/barcode
Published: 2021-11-24
File: front/send.php
Commit message: die on insecure file request, fix #85
Commit author: Alexandre Delaunay

Vulnerable version (before fix):
       echo "Security attack !!!";       Toolbox::logDebug("[Plugin barcode][security][sendfile] ".                $_SESSION["glpiname"]." try to get a non standard file : ".$filename);    }     $file = $docDir.'/'.$filename;

Fixed version (after fix):
       echo "Security attack !!!";       Toolbox::logDebug("[Plugin barcode][security][sendfile] ".                $_SESSION["glpiname"]." try to get a non standard file : ".$filename);       exit;    }     $file = $docDir.'/'.$filename;

Patch:
patch: @@ -54,6 +54,7 @@
       echo "Security attack !!!";
       Toolbox::logDebug("[Plugin barcode][security][sendfile] ".
                $_SESSION["glpiname"]." try to get a non standard file : ".$filename);
+      exit;
    }
 
    $file = $docDir.'/'.$filename;
path: front/send.php
Vulnerability: Wiki.js is a wiki app built on Node.js. Prior to version 2.5.254, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled on a Windows host. A malicious user can potentially read any file on the file system by crafting a special URL that allows for directory traversal. This is only possible on a Wiki.js server running on Windows, when a storage module implementing local asset cache (e.g Local File System or Git) is enabled and that no web application firewall solution (e.g. cloudflare) strips potentially malicious URLs. Commit number 414033de9dff66a327e3f3243234852f468a9d85 fixes this vulnerability by sanitizing the path before it is passed on to the storage module. The sanitization step removes any windows directory traversal sequences from the path. As a workaround, disable any storage module with local asset caching capabilities (Local File System, Git).
Vulnerability ID: CVE-2021-43800
CWE: CWE-22
Severity score: 2.9
Project: https://github.com/Requarks/wiki
Published: 2021-12-06
File: server/helpers/page.js
Commit message: fix: asset path traversal on windows
Commit author: NGPixel

Vulnerable version (before fix):
 module.exports = {     rawPath = rawPath.replace(unsafeCharsRegex, '')     if (rawPath === '') { rawPath = 'home' }      // Extract Info     let pathParts = _.filter(_.split(rawPath, '/'), p => {       p = _.trim(p)

Fixed version (after fix):
 module.exports = {     rawPath = rawPath.replace(unsafeCharsRegex, '')     if (rawPath === '') { rawPath = 'home' }      rawPath = rawPath.replaceAll('\\', '').replaceAll('//', '').replaceAll(/\.\.+/ig, '')      // Extract Info     let pathParts = _.filter(_.split(rawPath, '/'), p => {       p = _.trim(p)

Patch:
patch: @@ -35,6 +35,8 @@ module.exports = {
     rawPath = rawPath.replace(unsafeCharsRegex, '')
     if (rawPath === '') { rawPath = 'home' }
 
+    rawPath = rawPath.replaceAll('\\', '').replaceAll('//', '').replaceAll(/\.\.+/ig, '')
+
     // Extract Info
     let pathParts = _.filter(_.split(rawPath, '/'), p => {
       p = _.trim(p)
path: server/helpers/page.js
Vulnerability: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming RTCP BYE message contains a reason's length, this declared length is not checked against the actual received packet size, potentially resulting in an out-of-bound read access. This issue affects all users that use PJMEDIA and RTCP. A malicious actor can send a RTCP BYE message with an invalid reason length. Users are advised to upgrade as soon as possible. There are no known workarounds.
Vulnerability ID: CVE-2021-43804
CWE: CWE-125
Severity score: 6.4
Project: https://github.com/pjsip/pjproject
Published: 2021-12-22
File: pjmedia/src/pjmedia/rtcp.c
Commit message: Merge pull request from GHSA-3qx3-cg72-wrh9
Commit author: sauwming

Vulnerable version (before fix):
 static void parse_rtcp_bye(pjmedia_rtcp_session *sess,      /* Check and get BYE reason */     if (size > 8) { 	reason.slen = PJ_MIN(sizeof(sess->stat.peer_sdes_buf_),                              *((pj_uint8_t*)pkt+8)); 	pj_memcpy(sess->stat.peer_sdes_buf_, ((pj_uint8_t*)pkt+9), 		  reason.slen); 	reason.ptr = sess->stat.peer_sdes_buf_;

Fixed version (after fix):
 static void parse_rtcp_bye(pjmedia_rtcp_session *sess,      /* Check and get BYE reason */     if (size > 8) {     	/* Make sure the BYE reason does not exceed:     	 * - the size of the available buffer     	 * - the declared reason's length     	 * - the actual packet size     	 */ 	reason.slen = PJ_MIN(sizeof(sess->stat.peer_sdes_buf_),                              *((pj_uint8_t*)pkt+8));         reason.slen = PJ_MIN(reason.slen, size-9);  	pj_memcpy(sess->stat.peer_sdes_buf_, ((pj_uint8_t*)pkt+9), 		  reason.slen); 	reason.ptr = sess->stat.peer_sdes_buf_;

Patch:
patch: @@ -757,8 +757,15 @@ static void parse_rtcp_bye(pjmedia_rtcp_session *sess,
 
     /* Check and get BYE reason */
     if (size > 8) {
+    	/* Make sure the BYE reason does not exceed:
+    	 * - the size of the available buffer
+    	 * - the declared reason's length
+    	 * - the actual packet size
+    	 */
 	reason.slen = PJ_MIN(sizeof(sess->stat.peer_sdes_buf_),
                              *((pj_uint8_t*)pkt+8));
+        reason.slen = PJ_MIN(reason.slen, size-9);
+
 	pj_memcpy(sess->stat.peer_sdes_buf_, ((pj_uint8_t*)pkt+9),
 		  reason.slen);
 	reason.ptr = sess->stat.peer_sdes_buf_;
path: pjmedia/src/pjmedia/rtcp.c
Vulnerability: PJSIP is a free and open source multimedia communication library. In version 2.11.1 and prior, if incoming RTCP XR message contain block, the data field is not checked against the received packet size, potentially resulting in an out-of-bound read access. This affects all users that use PJMEDIA and RTCP XR. A malicious actor can send a RTCP XR message with an invalid packet size.
Vulnerability ID: CVE-2021-43845
CWE: CWE-125
Severity score: 4.9
Project: https://github.com/pjsip/pjproject
Published: 2021-12-27
File: pjmedia/src/pjmedia/rtcp_xr.c
Commit message: Merge pull request from GHSA-r374-qrwv-86hh
Commit author: Riza Sulistyo

Vulnerable version (before fix):
 void pjmedia_rtcp_xr_rx_rtcp_xr( pjmedia_rtcp_xr_session *sess, 	if (rb_len) { 	    switch (rb_hdr->bt) { 		case BT_RR_TIME: 		    rb_rr_time = (pjmedia_rtcp_xr_rb_rr_time*) rb_hdr; 		    break; 		case BT_DLRR: 		    rb_dlrr = (pjmedia_rtcp_xr_rb_dlrr*) rb_hdr; 		    break; 		case BT_STATS: 		    rb_stats = (pjmedia_rtcp_xr_rb_stats*) rb_hdr; 		    break; 		case BT_VOIP_METRICS: 		    rb_voip_mtc = (pjmedia_rtcp_xr_rb_voip_mtc*) rb_hdr; 		    break; 		default: 		    break;

Fixed version (after fix):
 void pjmedia_rtcp_xr_rx_rtcp_xr( pjmedia_rtcp_xr_session *sess, 	if (rb_len) { 	    switch (rb_hdr->bt) { 		case BT_RR_TIME: 		    if ((char*)rb_hdr + sizeof(*rb_rr_time) <= 			(char*)pkt + size)  		    { 			rb_rr_time = (pjmedia_rtcp_xr_rb_rr_time*)rb_hdr; 		    } 		    break; 		case BT_DLRR: 		    if ((char*)rb_hdr + sizeof(*rb_dlrr) <= 			(char*)pkt + size) 		    { 			rb_dlrr = (pjmedia_rtcp_xr_rb_dlrr*)rb_hdr; 		    } 		    break; 		case BT_STATS: 		    if ((char*)rb_hdr + sizeof(*rb_stats) <= 			(char*)pkt + size) 		    { 			rb_stats = (pjmedia_rtcp_xr_rb_stats*)rb_hdr; 		    } 		    break; 		case BT_VOIP_METRICS: 		    if ((char*)rb_hdr + sizeof(*rb_voip_mtc) <= 			(char*)pkt + size) 		    { 			rb_voip_mtc = (pjmedia_rtcp_xr_rb_voip_mtc*)rb_hdr; 		    } 		    break; 		default: 		    break;

Patch:
patch: @@ -436,16 +436,32 @@ void pjmedia_rtcp_xr_rx_rtcp_xr( pjmedia_rtcp_xr_session *sess,
 	if (rb_len) {
 	    switch (rb_hdr->bt) {
 		case BT_RR_TIME:
-		    rb_rr_time = (pjmedia_rtcp_xr_rb_rr_time*) rb_hdr;
+		    if ((char*)rb_hdr + sizeof(*rb_rr_time) <=
+			(char*)pkt + size) 
+		    {
+			rb_rr_time = (pjmedia_rtcp_xr_rb_rr_time*)rb_hdr;
+		    }
 		    break;
 		case BT_DLRR:
-		    rb_dlrr = (pjmedia_rtcp_xr_rb_dlrr*) rb_hdr;
+		    if ((char*)rb_hdr + sizeof(*rb_dlrr) <=
+			(char*)pkt + size)
+		    {
+			rb_dlrr = (pjmedia_rtcp_xr_rb_dlrr*)rb_hdr;
+		    }
 		    break;
 		case BT_STATS:
-		    rb_stats = (pjmedia_rtcp_xr_rb_stats*) rb_hdr;
+		    if ((char*)rb_hdr + sizeof(*rb_stats) <=
+			(char*)pkt + size)
+		    {
+			rb_stats = (pjmedia_rtcp_xr_rb_stats*)rb_hdr;
+		    }
 		    break;
 		case BT_VOIP_METRICS:
-		    rb_voip_mtc = (pjmedia_rtcp_xr_rb_voip_mtc*) rb_hdr;
+		    if ((char*)rb_hdr + sizeof(*rb_voip_mtc) <=
+			(char*)pkt + size)
+		    {
+			rb_voip_mtc = (pjmedia_rtcp_xr_rb_voip_mtc*)rb_hdr;
+		    }
 		    break;
 		default:
 		    break;
path: pjmedia/src/pjmedia/rtcp_xr.c
Vulnerability: Wiki.js is a wiki app built on node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through a SVG file upload made via a custom request with a fake MIME type. By creating a crafted SVG file, a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the SVG is viewed directly by other users. Scripts do not execute when loaded inside a page via normal `<img>` tags. The malicious SVG can only be uploaded by crafting a custom request to the server with a fake MIME type. A patch in version 2.5.264 fixes this vulnerability by adding an additional file extension verification check to the optional (enabled by default) SVG sanitization step to all file uploads that match the SVG mime type. As a workaround, disable file upload for all non-trusted users.
Vulnerability ID: CVE-2021-43855
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/Requarks/wiki
Published: 2021-12-27
File: server/models/assets.js
Commit message: fix: validate svg file extension in addition to client mime type
Commit author: NGPixel

Vulnerable version (before fix):
 module.exports = class Asset extends Model {     }      // Sanitize SVG contents     if (WIKI.config.uploads.scanSVG && opts.mimetype === 'image/svg+xml') {       const svgSanitizeJob = await WIKI.scheduler.registerJob({         name: 'sanitize-svg',         immediate: true,

Fixed version (after fix):
 module.exports = class Asset extends Model {     }      // Sanitize SVG contents     if (       WIKI.config.uploads.scanSVG &&       (         opts.mimetype.toLowerCase().startsWith('image/svg') ||         opts.ext.toLowerCase() === 'svg'       )     ) {       const svgSanitizeJob = await WIKI.scheduler.registerJob({         name: 'sanitize-svg',         immediate: true,

Patch:
patch: @@ -100,7 +100,13 @@ module.exports = class Asset extends Model {
     }
 
     // Sanitize SVG contents
-    if (WIKI.config.uploads.scanSVG && opts.mimetype === 'image/svg+xml') {
+    if (
+      WIKI.config.uploads.scanSVG &&
+      (
+        opts.mimetype.toLowerCase().startsWith('image/svg') ||
+        opts.ext.toLowerCase() === 'svg'
+      )
+    ) {
       const svgSanitizeJob = await WIKI.scheduler.registerJob({
         name: 'sanitize-svg',
         immediate: true,
path: server/models/assets.js
Vulnerability: Cross-site scripting (XSS) vulnerability in index.php in emlog version <= pro-1.0.7 allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Vulnerability ID: CVE-2021-44584
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/emlog/emlog
Published: 2022-01-06
File: admin/globals.php
Commit message: fix:fix xss #113

Signed-off-by: snow <>
Commit author: snow

Vulnerable version (before fix):
 $sta_cache = $CACHE->readCache('sta'); $user_cache = $CACHE->readCache('user'); $action = isset($_GET['action']) ? addslashes($_GET['action']) : ''; $admin_path_code = isset($_GET['s']) ? addslashes($_GET['s']) : '';  if ($action == 'login') { 	if (defined('ADMIN_PATH_CODE') && $admin_path_code !== ADMIN_PATH_CODE) {

Fixed version (after fix):
 $sta_cache = $CACHE->readCache('sta'); $user_cache = $CACHE->readCache('user'); $action = isset($_GET['action']) ? addslashes($_GET['action']) : ''; $admin_path_code = isset($_GET['s']) ? addslashes(htmlClean($_GET['s'])) : '';  if ($action == 'login') { 	if (defined('ADMIN_PATH_CODE') && $admin_path_code !== ADMIN_PATH_CODE) {

Patch:
patch: @@ -20,7 +20,7 @@
 $sta_cache = $CACHE->readCache('sta');
 $user_cache = $CACHE->readCache('user');
 $action = isset($_GET['action']) ? addslashes($_GET['action']) : '';
-$admin_path_code = isset($_GET['s']) ? addslashes($_GET['s']) : '';
+$admin_path_code = isset($_GET['s']) ? addslashes(htmlClean($_GET['s'])) : '';
 
 if ($action == 'login') {
 	if (defined('ADMIN_PATH_CODE') && $admin_path_code !== ADMIN_PATH_CODE) {
path: admin/globals.php
Vulnerability: Opmantek Open-AudIT Community 4.2.0 (Fixed in 4.3.0) is affected by a Cross Site Scripting (XSS) vulnerability. If a bad value is passed to the routine via a URL, malicious JavaScript code can be executed in the victim's browser.
Vulnerability ID: CVE-2021-44916
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/Opmantek/open-audit
Published: 2021-12-20
File: code_igniter/application/helpers/output_helper.php
Commit message: Bug - Fix link creation for html template function to negate JS issue.
Commit author: Mark Unwin

Vulnerable version (before fix):
 function output_convert($data)      function create_url($query_parameters = null)     {         $CI = & get_instance();         $proto = 'http://';         if ($CI->config->config['is_ssl'] === true) {             $proto = 'https://';         }         $link = $proto . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] . '?';         if (!empty($query_parameters)) {             for ($i=0; $i < count($query_parameters); $i++) {                 if (!empty($query_parameters[$i]->name)) {

Fixed version (after fix):
 function output_convert($data)      function create_url($query_parameters = null)     {         $link = '?';         if (!empty($query_parameters)) {             for ($i=0; $i < count($query_parameters); $i++) {                 if (!empty($query_parameters[$i]->name)) {

Patch:
patch: @@ -1076,12 +1076,7 @@ function output_convert($data)
 
     function create_url($query_parameters = null)
     {
-        $CI = & get_instance();
-        $proto = 'http://';
-        if ($CI->config->config['is_ssl'] === true) {
-            $proto = 'https://';
-        }
-        $link = $proto . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] . '?';
+        $link = '?';
         if (!empty($query_parameters)) {
             for ($i=0; $i < count($query_parameters); $i++) {
                 if (!empty($query_parameters[$i]->name)) {
path: code_igniter/application/helpers/output_helper.php
Vulnerability: A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to upload malicious PHP files to the webroot, leading to code execution.
Vulnerability ID: CVE-2021-45010
CWE: CWE-22
Severity score: 6.4
Project: https://github.com/prasathmani/tinyfilemanager
Published: 2022-03-15
File: tinyfilemanager.php
Commit message: Patched the RCE (#636)

I have patched the file upload directory traversal to Authenticated Remote Code Execution Vulnerability.
Commit author: febinrev

Vulnerable version (before fix):
 function get_file_path () {      $targetPath = $path . $ds;     if ( is_writable($targetPath) ) {         $fullPath = $path . '/' . $_REQUEST['fullpath'];         $folder = substr($fullPath, 0, strrpos($fullPath, "/"));          if(file_exists ($fullPath) && !$override_file_name) {

Fixed version (after fix):
 function get_file_path () {      $targetPath = $path . $ds;     if ( is_writable($targetPath) ) {         $fullPath = $path . '/' . str_replace("./","_",$_REQUEST['fullpath']);         $folder = substr($fullPath, 0, strrpos($fullPath, "/"));          if(file_exists ($fullPath) && !$override_file_name) {

Patch:
patch: @@ -880,7 +880,7 @@ function get_file_path () {
 
     $targetPath = $path . $ds;
     if ( is_writable($targetPath) ) {
-        $fullPath = $path . '/' . $_REQUEST['fullpath'];
+        $fullPath = $path . '/' . str_replace("./","_",$_REQUEST['fullpath']);
         $folder = substr($fullPath, 0, strrpos($fullPath, "/"));
 
         if(file_exists ($fullPath) && !$override_file_name) {
path: tinyfilemanager.php
Vulnerability: pep_sock_accept in net/phonet/pep.c in the Linux kernel through 5.15.8 has a refcount leak.
Vulnerability ID: CVE-2021-45095
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2021-12-16
File: net/phonet/pep.c
Commit message: phonet: refcount leak in pep_sock_accep

sock_hold(sk) is invoked in pep_sock_accept(), but __sock_put(sk) is not
invoked in subsequent failure branches(pep_accept_conn() != 0).

Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Link: https://lore.kernel.org/r/20211209082839.33985-1-hbh25y@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Commit author: Hangyu Hua

Vulnerable version (before fix):
 static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp,  	err = pep_accept_conn(newsk, skb); 	if (err) { 		sock_put(newsk); 		newsk = NULL; 		goto drop;

Fixed version (after fix):
 static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp,  	err = pep_accept_conn(newsk, skb); 	if (err) { 		__sock_put(sk); 		sock_put(newsk); 		newsk = NULL; 		goto drop;

Patch:
patch: @@ -868,6 +868,7 @@ static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp,
 
 	err = pep_accept_conn(newsk, skb);
 	if (err) {
+		__sock_put(sk);
 		sock_put(newsk);
 		newsk = NULL;
 		goto drop;
path: net/phonet/pep.c
Vulnerability: An issue was discovered in the Linux kernel before 5.15.11. There is a memory leak in the __rds_conn_create() function in net/rds/connection.c in a certain combination of circumstances.
Vulnerability ID: CVE-2021-45480
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2021-12-24
File: net/rds/connection.c
Commit message: rds: memory leak in __rds_conn_create()

__rds_conn_create() did not release conn->c_path when loop_trans != 0 and
trans->t_prefer_loopback != 0 and is_outgoing == 0.

Fixes: aced3ce57cd3 ("RDS tcp loopback connection can hang")
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Reviewed-by: Sharath Srinivasan <sharath.srinivasan@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Hangyu Hua

Vulnerable version (before fix):
 static struct rds_connection *__rds_conn_create(struct net *net, 				 * should end up here, but if it 				 * does, reset/destroy the connection. 				 */ 				kmem_cache_free(rds_conn_slab, conn); 				conn = ERR_PTR(-EOPNOTSUPP); 				goto out;

Fixed version (after fix):
 static struct rds_connection *__rds_conn_create(struct net *net, 				 * should end up here, but if it 				 * does, reset/destroy the connection. 				 */ 				kfree(conn->c_path); 				kmem_cache_free(rds_conn_slab, conn); 				conn = ERR_PTR(-EOPNOTSUPP); 				goto out;

Patch:
patch: @@ -253,6 +253,7 @@ static struct rds_connection *__rds_conn_create(struct net *net,
 				 * should end up here, but if it
 				 * does, reset/destroy the connection.
 				 */
+				kfree(conn->c_path);
 				kmem_cache_free(rds_conn_slab, conn);
 				conn = ERR_PTR(-EOPNOTSUPP);
 				goto out;
path: net/rds/connection.c
Vulnerability: GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile (called from PCIDSK::CPCIDSKSegment::ReadFromFile and PCIDSK::CPCIDSKBinarySegment::CPCIDSKBinarySegment).
Vulnerability ID: CVE-2021-45943
CWE: CWE-787
Severity score: 2.9
Project: https://github.com/OSGeo/gdal
Published: 2022-01-01
File: frmts/pcidsk/sdk/segment/cpcidskbinarysegment.cpp
Commit message: Merge pull request #4944 from rouault/fix_ossfuzz_41993

PCIDSK: fix write heap-buffer-overflow. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41993
Commit author: Even Rouault

Vulnerable version (before fix):
 #include "pcidsk_exception.h" #include "core/pcidsk_utils.h"  #include <vector> #include <string> #include <cassert> void CPCIDSKBinarySegment::Load()     if (loaded_) {         return;     }      seg_data.SetSize((int)data_size - 1024);      ReadFromFile(seg_data.buffer, 0, data_size - 1024); 

Fixed version (after fix):
 #include "pcidsk_exception.h" #include "core/pcidsk_utils.h"  #include <limits> #include <vector> #include <string> #include <cassert> void CPCIDSKBinarySegment::Load()     if (loaded_) {         return;     }     if( data_size - 1024 > static_cast<uint64_t>(std::numeric_limits<int>::max()) )     {         return ThrowPCIDSKException("too large data_size");     }      seg_data.SetSize((int)(data_size - 1024));      ReadFromFile(seg_data.buffer, 0, data_size - 1024); 

Patch:
patch: @@ -31,6 +31,7 @@
 #include "pcidsk_exception.h"
 #include "core/pcidsk_utils.h"
 
+#include <limits>
 #include <vector>
 #include <string>
 #include <cassert>
@@ -73,8 +74,12 @@ void CPCIDSKBinarySegment::Load()
     if (loaded_) {
         return;
     }
+    if( data_size - 1024 > static_cast<uint64_t>(std::numeric_limits<int>::max()) )
+    {
+        return ThrowPCIDSKException("too large data_size");
+    }
 
-    seg_data.SetSize((int)data_size - 1024);
+    seg_data.SetSize((int)(data_size - 1024));
 
     ReadFromFile(seg_data.buffer, 0, data_size - 1024);
path: frmts/pcidsk/sdk/segment/cpcidskbinarysegment.cpp