rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The get_vlc2 function in get_bits.h in Libav before 11.9 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted mp3 file, possibly related to startcode sequences during m4v detection.
Vulnerability ID: CVE-2016-8675
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/libav/libav
Published: 2017-02-15
File: libavformat/m4vdec.c
Commit message: m4vdec: Check for non-startcode 00 00 00 sequences in probe

This makes the m4v detection less trigger-happy.

Bug-Id: 949
Signed-off-by: Diego Biurrun <diego@biurrun.de>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static int mpeg4video_probe(AVProbeData *probe_packet)      for (i = 0; i < probe_packet->buf_size; i++) {         temp_buffer = (temp_buffer << 8) + probe_packet->buf[i];         if ((temp_buffer & 0xffffff00) != 0x100)             continue;          if (temp_buffer == VOP_START_CODE)             VOP++;         else if (temp_buffer == VISUAL_OBJECT_START_CODE)             VISO++;         else if (temp_buffer < 0x120)             VO++;         else if (temp_buffer < 0x130)             VOL++;         else if (!(0x1AF < temp_buffer && temp_buffer < 0x1B7) &&                  !(0x1B9 < temp_buffer && temp_buffer < 0x1C4))

Fixed version (after fix):
 static int mpeg4video_probe(AVProbeData *probe_packet)      for (i = 0; i < probe_packet->buf_size; i++) {         temp_buffer = (temp_buffer << 8) + probe_packet->buf[i];         if (temp_buffer & 0xfffffe00)             continue;         if (temp_buffer < 2)             continue;          if (temp_buffer == VOP_START_CODE)             VOP++;         else if (temp_buffer == VISUAL_OBJECT_START_CODE)             VISO++;         else if (temp_buffer >= 0x100 && temp_buffer < 0x120)             VO++;         else if (temp_buffer >= 0x120 && temp_buffer < 0x130)             VOL++;         else if (!(0x1AF < temp_buffer && temp_buffer < 0x1B7) &&                  !(0x1B9 < temp_buffer && temp_buffer < 0x1C4))

Patch:
patch: @@ -33,16 +33,18 @@ static int mpeg4video_probe(AVProbeData *probe_packet)
 
     for (i = 0; i < probe_packet->buf_size; i++) {
         temp_buffer = (temp_buffer << 8) + probe_packet->buf[i];
-        if ((temp_buffer & 0xffffff00) != 0x100)
+        if (temp_buffer & 0xfffffe00)
+            continue;
+        if (temp_buffer < 2)
             continue;
 
         if (temp_buffer == VOP_START_CODE)
             VOP++;
         else if (temp_buffer == VISUAL_OBJECT_START_CODE)
             VISO++;
-        else if (temp_buffer < 0x120)
+        else if (temp_buffer >= 0x100 && temp_buffer < 0x120)
             VO++;
-        else if (temp_buffer < 0x130)
+        else if (temp_buffer >= 0x120 && temp_buffer < 0x130)
             VOL++;
         else if (!(0x1AF < temp_buffer && temp_buffer < 0x1B7) &&
                  !(0x1B9 < temp_buffer && temp_buffer < 0x1C4))
path: libavformat/m4vdec.c
Vulnerability: Stack-based buffer overflow in the safe_fprintf function in tar/util.c in libarchive 3.2.1 allows remote attackers to cause a denial of service via a crafted non-printable multibyte character in a filename.
Vulnerability ID: CVE-2016-8687
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/libarchive/libarchive
Published: 2017-02-15
File: tar/util.c
Commit message: Issue #767:  Buffer overflow printing a filename

The safe_fprintf function attempts to ensure clean output for an
arbitrary sequence of bytes by doing a trial conversion of the
multibyte characters to wide characters -- if the resulting wide
character is printable then we pass through the corresponding bytes
unaltered, otherwise, we convert them to C-style ASCII escapes.

The stack trace in Issue #767 suggest that the 20-byte buffer
was getting overflowed trying to format a non-printable multibyte
character.  This should only happen if there is a valid multibyte
character of more than 5 bytes that was unprintable.  (Each byte
would get expanded to a four-charcter octal-style escape of the form
"\123" resulting in >20 characters for the >5 byte multibyte character.)

I've not been able to reproduce this, but have expanded the conversion
buffer to 128 bytes on the belief that no multibyte character set
has a single character of more than 32 bytes.
Commit author: Tim Kientzle

Vulnerable version (before fix):
 safe_fprintf(FILE *f, const char *fmt, ...) 		}  		/* If our output buffer is full, dump it and keep going. */ 		if (i > (sizeof(outbuff) - 20)) { 			outbuff[i] = '\0'; 			fprintf(f, "%s", outbuff); 			i = 0;

Fixed version (after fix):
 safe_fprintf(FILE *f, const char *fmt, ...) 		}  		/* If our output buffer is full, dump it and keep going. */ 		if (i > (sizeof(outbuff) - 128)) { 			outbuff[i] = '\0'; 			fprintf(f, "%s", outbuff); 			i = 0;

Patch:
patch: @@ -182,7 +182,7 @@ safe_fprintf(FILE *f, const char *fmt, ...)
 		}
 
 		/* If our output buffer is full, dump it and keep going. */
-		if (i > (sizeof(outbuff) - 20)) {
+		if (i > (sizeof(outbuff) - 128)) {
 			outbuff[i] = '\0';
 			fprintf(f, "%s", outbuff);
 			i = 0;
path: tar/util.c
Vulnerability: The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted XRsiz value in a BMP image to the imginfo command.
Vulnerability ID: CVE-2016-8691
CWE: CWE-369
Severity score: 2.9
Project: https://github.com/mdadams/jasper
Published: 2017-02-15
File: src/libjasper/jpc/jpc_cs.c
Commit message: Added range check on XRsiz and YRsiz fields of SIZ marker segment.
Commit author: Michael Adams

Vulnerable version (before fix):
 static int jpc_siz_getparms(jpc_ms_t *ms, jpc_cstate_t *cstate, 			jas_free(siz->comps); 			return -1; 		} 		siz->comps[i].sgnd = (tmp >> 7) & 1; 		siz->comps[i].prec = (tmp & 0x7f) + 1; 	}

Fixed version (after fix):
 static int jpc_siz_getparms(jpc_ms_t *ms, jpc_cstate_t *cstate, 			jas_free(siz->comps); 			return -1; 		} 		if (siz->comps[i].hsamp == 0 || siz->comps[i].hsamp > 255) { 			jas_eprintf("invalid XRsiz value %d\n", siz->comps[i].hsamp); 			jas_free(siz->comps); 			return -1; 		} 		if (siz->comps[i].vsamp == 0 || siz->comps[i].vsamp > 255) { 			jas_eprintf("invalid YRsiz value %d\n", siz->comps[i].vsamp); 			jas_free(siz->comps); 			return -1; 		} 		siz->comps[i].sgnd = (tmp >> 7) & 1; 		siz->comps[i].prec = (tmp & 0x7f) + 1; 	}

Patch:
patch: @@ -512,6 +512,16 @@ static int jpc_siz_getparms(jpc_ms_t *ms, jpc_cstate_t *cstate,
 			jas_free(siz->comps);
 			return -1;
 		}
+		if (siz->comps[i].hsamp == 0 || siz->comps[i].hsamp > 255) {
+			jas_eprintf("invalid XRsiz value %d\n", siz->comps[i].hsamp);
+			jas_free(siz->comps);
+			return -1;
+		}
+		if (siz->comps[i].vsamp == 0 || siz->comps[i].vsamp > 255) {
+			jas_eprintf("invalid YRsiz value %d\n", siz->comps[i].vsamp);
+			jas_free(siz->comps);
+			return -1;
+		}
 		siz->comps[i].sgnd = (tmp >> 7) & 1;
 		siz->comps[i].prec = (tmp & 0x7f) + 1;
 	}
path: src/libjasper/jpc/jpc_cs.c
Vulnerability: Double free vulnerability in the mem_close function in jas_stream.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image to the imginfo command.
Vulnerability ID: CVE-2016-8693
CWE: CWE-415
Severity score: 6.4
Project: https://github.com/mdadams/jasper
Published: 2017-02-15
File: src/libjasper/base/jas_stream.c
Commit message: The memory stream interface allows for a buffer size of zero.
The case of a zero-sized buffer was not handled correctly, as it could
lead to a double free.
This problem has now been fixed (hopefully).
One might ask whether a zero-sized buffer should be allowed at all,
but this is a question for another day.
Commit author: Michael Adams

Vulnerable version (before fix):
 static int mem_resize(jas_stream_memobj_t *m, int bufsize) { 	unsigned char *buf;  	assert(m->buf_); 	assert(bufsize >= 0); 	if (!(buf = jas_realloc2(m->buf_, bufsize, sizeof(unsigned char)))) { 		return -1; 	} 	m->buf_ = buf;

Fixed version (after fix):
 static int mem_resize(jas_stream_memobj_t *m, int bufsize) { 	unsigned char *buf;  	//assert(m->buf_); 	assert(bufsize >= 0); 	if (!(buf = jas_realloc2(m->buf_, bufsize, sizeof(unsigned char))) && 	  bufsize) { 		return -1; 	} 	m->buf_ = buf;

Patch:
patch: @@ -993,9 +993,10 @@ static int mem_resize(jas_stream_memobj_t *m, int bufsize)
 {
 	unsigned char *buf;
 
-	assert(m->buf_);
+	//assert(m->buf_);
 	assert(bufsize >= 0);
-	if (!(buf = jas_realloc2(m->buf_, bufsize, sizeof(unsigned char)))) {
+	if (!(buf = jas_realloc2(m->buf_, bufsize, sizeof(unsigned char))) &&
+	  bufsize) {
 		return -1;
 	}
 	m->buf_ = buf;
path: src/libjasper/base/jas_stream.c
Vulnerability: ** DISPUTED ** The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate KEXINIT requests.  NOTE: a third party reports that "OpenSSH upstream does not consider this as a security issue."
Vulnerability ID: CVE-2016-8858
CWE: CWE-399
Severity score: 6.9
Project: https://github.com/openssh/openssh-portable
Published: 2016-12-09
File: kex.c
Commit message: upstream commit

Unregister the KEXINIT handler after message has been
received. Otherwise an unauthenticated peer can repeat the KEXINIT and cause
allocation of up to 128MB -- until the connection is closed. Reported by
shilei-c at 360.cn

Upstream-ID: 43649ae12a27ef94290db16d1a98294588b75c05
Commit author: markus@openbsd.org

Vulnerable version (before fix):
 /* $OpenBSD: kex.c,v 1.126 2016/09/28 21:44:52 djm Exp $ */ /*  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.  * kex_input_kexinit(int type, u_int32_t seq, void *ctxt) 	if (kex == NULL) 		return SSH_ERR_INVALID_ARGUMENT;  	ptr = sshpkt_ptr(ssh, &dlen); 	if ((r = sshbuf_put(kex->peer, ptr, dlen)) != 0) 		return r;

Fixed version (after fix):
 /* $OpenBSD: kex.c,v 1.127 2016/10/10 19:28:48 markus Exp $ */ /*  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.  * kex_input_kexinit(int type, u_int32_t seq, void *ctxt) 	if (kex == NULL) 		return SSH_ERR_INVALID_ARGUMENT;  	ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, NULL); 	ptr = sshpkt_ptr(ssh, &dlen); 	if ((r = sshbuf_put(kex->peer, ptr, dlen)) != 0) 		return r;

Patch:
patch: @@ -1,4 +1,4 @@
-/* $OpenBSD: kex.c,v 1.126 2016/09/28 21:44:52 djm Exp $ */
+/* $OpenBSD: kex.c,v 1.127 2016/10/10 19:28:48 markus Exp $ */
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
  *
@@ -481,6 +481,7 @@ kex_input_kexinit(int type, u_int32_t seq, void *ctxt)
 	if (kex == NULL)
 		return SSH_ERR_INVALID_ARGUMENT;
 
+	ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, NULL);
 	ptr = sshpkt_ptr(ssh, &dlen);
 	if ((r = sshbuf_put(kex->peer, ptr, dlen)) != 0)
 		return r;
path: kex.c
Vulnerability: Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/ecommerce/controllers/cartController.php.
Vulnerability ID: CVE-2016-8898
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/exponentcms/exponent-cms
Published: 2019-05-24
File: framework/core/subsystems/expRouter.php
Commit message: remove warning from expRouter code
Commit author: dleffler

Vulnerable version (before fix):
 public function routeRequest() {         }         // do the same for the other id's         foreach ($_REQUEST as $key=>$var) {             if (is_string($var) && strrpos($key,'_id',-3) !== false) {                 if (isset($_GET[$key]))                     $_GET[$key] = intval($_GET[$key]);                 if (isset($_POST[$key]))

Fixed version (after fix):
 public function routeRequest() {         }         // do the same for the other id's         foreach ($_REQUEST as $key=>$var) {             if (is_string($var) && strlen($key) >= 3 && strrpos($key,'_id',-3) !== false) {                 if (isset($_GET[$key]))                     $_GET[$key] = intval($_GET[$key]);                 if (isset($_POST[$key]))

Patch:
patch: @@ -209,7 +209,7 @@ public function routeRequest() {
         }
         // do the same for the other id's
         foreach ($_REQUEST as $key=>$var) {
-            if (is_string($var) && strrpos($key,'_id',-3) !== false) {
+            if (is_string($var) && strlen($key) >= 3 && strrpos($key,'_id',-3) !== false) {
                 if (isset($_GET[$key]))
                     $_GET[$key] = intval($_GET[$key]);
                 if (isset($_POST[$key]))
path: framework/core/subsystems/expRouter.php
Vulnerability: Revive Adserver before 3.2.3 suffers from persistent XSS. Usernames are not properly escaped when displayed in the audit trail widget of the dashboard upon login, allowing persistent XSS attacks. An authenticated user with enough privileges to create other users could exploit the vulnerability to access the administrator account.
Vulnerability ID: CVE-2016-9126
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/revive-adserver/revive-adserver
Published: 2017-03-28
File: lib/templates/admin/dashboard/audit.html
Commit message: Fix h1 report 97073

Persistent XSS
--------------

Tengku Zahasman has reported via HackerOne that usernames were not properly
escaped when displayed in the audit trail widget of the dashboard upon login,
allowing persistent XSS attacks. An authenticated user with enough privileges
to create other users could exploit the vulnerability to access the
administrator account.

A CVE-ID has been requested, but not assigned yet.

CWE: CWE-79
CVSSv2: 5.6 (AV:N/AC:H/Au:S/C:C/I:P/A:N)
Commit author: Matteo Beccati

Vulnerable version (before fix):
             <li>                 <div class="title">                     <a target="_top" href="userlog-audit-detailed.php?auditId={$aValue.auditid}">                         {$aValue.desc}                     </a>                 </div>                 <div>

Fixed version (after fix):
             <li>                 <div class="title">                     <a target="_top" href="userlog-audit-detailed.php?auditId={$aValue.auditid}">                         {$aValue.desc|escape}                     </a>                 </div>                 <div>

Patch:
patch: @@ -30,7 +30,7 @@
             <li>
                 <div class="title">
                     <a target="_top" href="userlog-audit-detailed.php?auditId={$aValue.auditid}">
-                        {$aValue.desc}
+                        {$aValue.desc|escape}
                     </a>
                 </div>
                 <div>
path: lib/templates/admin/dashboard/audit.html
Vulnerability: In /framework/modules/core/controllers/expHTMLEditorController.php of Exponent CMS 2.4.0, untrusted input is used to construct a table name, and in the selectObject method in mysqli class, table names are wrapped with a character that common filters do not filter, allowing for SQL Injection. Impact is Information Disclosure.
Vulnerability ID: CVE-2016-9184
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/exponentcms/exponent-cms
Published: 2016-11-04
File: framework/modules/core/controllers/expHTMLEditorController.php
Commit message: better fix security vulnerability in editor preview; reported by fyth
Commit author: dleffler

Vulnerable version (before fix):
 function __construct($src = null, $params = array())         parent:: __construct($src, $params);         if (empty($this->params['editor'])) {             $this->params['editor'] = SITE_WYSIWYG_EDITOR;         }     }  function preview()                 $demo->skin = 'lightgray';             }         } else {             $demo = self::getEditorSettings($this->params['id'], expString::escape($this->params['editor']));         }         assign_to_template(             array(

Fixed version (after fix):
 function __construct($src = null, $params = array())         parent:: __construct($src, $params);         if (empty($this->params['editor'])) {             $this->params['editor'] = SITE_WYSIWYG_EDITOR;         } else {             $this->params['editor'] = preg_replace("/[^[:alnum:][:space:]]/u", '', $this->params['editor']);         }     }  function preview()                 $demo->skin = 'lightgray';             }         } else {             $demo = self::getEditorSettings($this->params['id'], $this->params['editor']);         }         assign_to_template(             array(

Patch:
patch: @@ -62,6 +62,8 @@ function __construct($src = null, $params = array())
         parent:: __construct($src, $params);
         if (empty($this->params['editor'])) {
             $this->params['editor'] = SITE_WYSIWYG_EDITOR;
+        } else {
+            $this->params['editor'] = preg_replace("/[^[:alnum:][:space:]]/u", '', $this->params['editor']);
         }
     }
 
@@ -171,7 +173,7 @@ function preview()
                 $demo->skin = 'lightgray';
             }
         } else {
-            $demo = self::getEditorSettings($this->params['id'], expString::escape($this->params['editor']));
+            $demo = self::getEditorSettings($this->params['id'], $this->params['editor']);
         }
         assign_to_template(
             array(
path: framework/modules/core/controllers/expHTMLEditorController.php
Vulnerability: In /framework/modules/core/controllers/expHTMLEditorController.php of Exponent CMS 2.4.0, untrusted input is used to construct a table name, and in the selectObject method in mysqli class, table names are wrapped with a character that common filters do not filter, allowing for SQL Injection. Impact is Information Disclosure.
Vulnerability ID: CVE-2016-9184
CWE: CWE-89
Severity score: 2.9
Project: https://github.com/exponentcms/exponent-cms
Published: 2016-11-04
File: framework/modules/core/controllers/expHTMLEditorController.php
Commit message: better fix security vulnerability in editor preview; reported by fyth
Commit author: dleffler

Vulnerable version (before fix):
 function __construct($src = null, $params = array())         parent:: __construct($src, $params);         if (empty($this->params['editor'])) {             $this->params['editor'] = SITE_WYSIWYG_EDITOR;         }     }  function preview()                 $demo->skin = 'lightgray';             }         } else {             $demo = self::getEditorSettings($this->params['id'], expString::escape($this->params['editor']));         }         assign_to_template(             array(

Fixed version (after fix):
 function __construct($src = null, $params = array())         parent:: __construct($src, $params);         if (empty($this->params['editor'])) {             $this->params['editor'] = SITE_WYSIWYG_EDITOR;         } else {             $this->params['editor'] = preg_replace("/[^[:alnum:][:space:]]/u", '', $this->params['editor']);         }     }  function preview()                 $demo->skin = 'lightgray';             }         } else {             $demo = self::getEditorSettings($this->params['id'], $this->params['editor']);         }         assign_to_template(             array(

Patch:
patch: @@ -62,6 +62,8 @@ function __construct($src = null, $params = array())
         parent:: __construct($src, $params);
         if (empty($this->params['editor'])) {
             $this->params['editor'] = SITE_WYSIWYG_EDITOR;
+        } else {
+            $this->params['editor'] = preg_replace("/[^[:alnum:][:space:]]/u", '', $this->params['editor']);
         }
     }
 
@@ -171,7 +173,7 @@ function preview()
                 $demo->skin = 'lightgray';
             }
         } else {
-            $demo = self::getEditorSettings($this->params['id'], expString::escape($this->params['editor']));
+            $demo = self::getEditorSettings($this->params['id'], $this->params['editor']);
         }
         assign_to_template(
             array(
path: framework/modules/core/controllers/expHTMLEditorController.php
Vulnerability: A Blind SQL Injection Vulnerability in Exponent CMS through 2.4.0, with the rerank array parameter, can lead to site database information disclosure and denial of service.
Vulnerability ID: CVE-2016-9272
CWE: CWE-89
Severity score: 4.9
Project: https://github.com/exponentcms/exponent-cms
Published: 2016-11-11
File: framework/core/controllers/expController.php
Commit message: fix sql injection security vulnerability; reported by Nicky [#1394 state:resolved] [#1395 state:resolved]
Commit author: dleffler

Vulnerable version (before fix):
 public function manage_ranks() {         $rank = 1;         foreach ($this->params['rerank'] as $id) {             $modelname = $this->params['model'];             $obj = new $modelname($id);             $obj->rank = $rank;             $obj->save(false, true);             $rank++;

Fixed version (after fix):
 public function manage_ranks() {         $rank = 1;         foreach ($this->params['rerank'] as $id) {             $modelname = $this->params['model'];             $obj = new $modelname(intval($id));             $obj->rank = $rank;             $obj->save(false, true);             $rank++;

Patch:
patch: @@ -772,7 +772,7 @@ public function manage_ranks() {
         $rank = 1;
         foreach ($this->params['rerank'] as $id) {
             $modelname = $this->params['model'];
-            $obj = new $modelname($id);
+            $obj = new $modelname(intval($id));
             $obj->rank = $rank;
             $obj->save(false, true);
             $rank++;
path: framework/core/controllers/expController.php
Vulnerability: SQL Injection in framework/modules/search/controllers/searchController.php in Exponent CMS v2.4.0 allows remote attackers to read database information via action=search&module=search with the search_string parameter.
Vulnerability ID: CVE-2016-9282
CWE: CWE-89
Severity score: 2.9
Project: https://github.com/exponentcms/exponent-cms
Published: 2016-11-11
File: framework/modules/search/controllers/searchController.php
Commit message: fix security vulnerability in search method, reported by pang0lin
Commit author: dleffler

Vulnerable version (before fix):
 public function search()         if (get_magic_quotes_gpc()) {             $terms = stripslashes($terms);         }         $terms = htmlspecialchars($terms);          if ($router->current_url == substr(URL_FULL, 0, -1)) {  // give us a user friendly url             unset($router->params['int']);

Fixed version (after fix):
 public function search()         if (get_magic_quotes_gpc()) {             $terms = stripslashes($terms);         }         $terms = expString::escape(htmlspecialchars($terms));          if ($router->current_url == substr(URL_FULL, 0, -1)) {  // give us a user friendly url             unset($router->params['int']);

Patch:
patch: @@ -58,7 +58,7 @@ public function search()
         if (get_magic_quotes_gpc()) {
             $terms = stripslashes($terms);
         }
-        $terms = htmlspecialchars($terms);
+        $terms = expString::escape(htmlspecialchars($terms));
 
         if ($router->current_url == substr(URL_FULL, 0, -1)) {  // give us a user friendly url
             unset($router->params['int']);
path: framework/modules/search/controllers/searchController.php