rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by, r151032ay, and r151034y and SmartOS before 20201022. There is a buffer overflow in parse_user_name in lib/libpam/pam_framework.c.
Vulnerability ID: CVE-2020-27678
CWE: CWE-120
Severity score: 6.4
Project: https://github.com/illumos/illumos-gate
Published: 2020-10-26
File: usr/src/lib/libpam/pam_framework.c
Commit message: 13242 parse_user_name in PAM is sloppy
Reviewed by: Alex Wilson <alex@cooperi.net>
Approved by: Gordon Ross <gordon.w.ross@gmail.com>
Commit author: Dan McDonald

Vulnerable version (before fix):
  */  /*  * Copyright (c) 2019, Joyent, Inc.  */  #include <syslog.h> parse_user_name(char *user_input, char **ret_username) 	 * - we skip leading whitespaces and ignore trailing whitespaces 	 */ 	while (*ptr != '\0') { 		if ((*ptr == ' ') || (*ptr == '\t')) 			break; 		else { 			username[index] = *ptr; 			index++; 			ptr++; 		} 	}  	/* ret_username will be freed in pam_get_user(). */ 	if ((*ret_username = malloc(index + 1)) == NULL) 		return (PAM_BUF_ERR); 	(void) strcpy(*ret_username, username); 	return (PAM_SUCCESS); } 

Fixed version (after fix):
  */  /*  * Copyright 2020, Joyent, Inc.  */  #include <syslog.h> parse_user_name(char *user_input, char **ret_username) 	 * - we skip leading whitespaces and ignore trailing whitespaces 	 */ 	while (*ptr != '\0') { 		if ((*ptr == ' ') || (*ptr == '\t') || 		    (index >= PAM_MAX_RESP_SIZE)) { 			break; 		} else { 			username[index] = *ptr; 			index++; 			ptr++; 		} 	}  	/* ret_username will be freed in pam_get_user(). */ 	if (index >= PAM_MAX_RESP_SIZE || 	    (*ret_username = strdup(username)) == NULL) 		return (PAM_BUF_ERR); 	return (PAM_SUCCESS); } 

Patch:
patch: @@ -24,7 +24,7 @@
  */
 
 /*
- * Copyright (c) 2019, Joyent, Inc.
+ * Copyright 2020, Joyent, Inc.
  */
 
 #include <syslog.h>
@@ -656,19 +656,20 @@ parse_user_name(char *user_input, char **ret_username)
 	 * - we skip leading whitespaces and ignore trailing whitespaces
 	 */
 	while (*ptr != '\0') {
-		if ((*ptr == ' ') || (*ptr == '\t'))
+		if ((*ptr == ' ') || (*ptr == '\t') ||
+		    (index >= PAM_MAX_RESP_SIZE)) {
 			break;
-		else {
+		} else {
 			username[index] = *ptr;
 			index++;
 			ptr++;
 		}
 	}
 
 	/* ret_username will be freed in pam_get_user(). */
-	if ((*ret_username = malloc(index + 1)) == NULL)
+	if (index >= PAM_MAX_RESP_SIZE ||
+	    (*ret_username = strdup(username)) == NULL)
 		return (PAM_BUF_ERR);
-	(void) strcpy(*ret_username, username);
 	return (PAM_SUCCESS);
 }
path: usr/src/lib/libpam/pam_framework.c
Vulnerability: ** UNSUPPORTED WHEN ASSIGNED ** An issue was discovered in ReadyTalk Avian 1.2.0 before 2020-10-27. The FileOutputStream.write() method in FileOutputStream.java has a boundary check to prevent out-of-bounds memory read/write operations. However, an integer overflow leads to bypassing this check and achieving the out-of-bounds access. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability ID: CVE-2020-28371
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/ReadyTalk/avian
Published: 2020-11-09
File: classpath/java/io/FileOutputStream.java
Commit message: Fix integer overflow leading to out-of-bounds read/write
Commit author: Pietro Oliva

Vulnerable version (before fix):
 public void write(byte[] b, int offset, int length) throws IOException {       throw new NullPointerException();     }      if (offset < 0 || offset + length > b.length) {       throw new ArrayIndexOutOfBoundsException();     } 

Fixed version (after fix):
 public void write(byte[] b, int offset, int length) throws IOException {       throw new NullPointerException();     }      if (offset < 0 || length < 0 || length > b.length || offset > b.length - length) {       throw new ArrayIndexOutOfBoundsException();     } 

Patch:
patch: @@ -52,7 +52,7 @@ public void write(byte[] b, int offset, int length) throws IOException {
       throw new NullPointerException();
     }
 
-    if (offset < 0 || offset + length > b.length) {
+    if (offset < 0 || length < 0 || length > b.length || offset > b.length - length) {
       throw new ArrayIndexOutOfBoundsException();
     }
path: classpath/java/io/FileOutputStream.java
Vulnerability: ** UNSUPPORTED WHEN ASSIGNED ** An issue was discovered in ReadyTalk Avian 1.2.0 before 2020-10-27. The FileOutputStream.write() method in FileOutputStream.java has a boundary check to prevent out-of-bounds memory read/write operations. However, an integer overflow leads to bypassing this check and achieving the out-of-bounds access. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability ID: CVE-2020-28371
CWE: CWE-190
Severity score: 6.4
Project: https://github.com/ReadyTalk/avian
Published: 2020-11-09
File: classpath/java/io/FileOutputStream.java
Commit message: Fix integer overflow leading to out-of-bounds read/write
Commit author: Pietro Oliva

Vulnerable version (before fix):
 public void write(byte[] b, int offset, int length) throws IOException {       throw new NullPointerException();     }      if (offset < 0 || offset + length > b.length) {       throw new ArrayIndexOutOfBoundsException();     } 

Fixed version (after fix):
 public void write(byte[] b, int offset, int length) throws IOException {       throw new NullPointerException();     }      if (offset < 0 || length < 0 || length > b.length || offset > b.length - length) {       throw new ArrayIndexOutOfBoundsException();     } 

Patch:
patch: @@ -52,7 +52,7 @@ public void write(byte[] b, int offset, int length) throws IOException {
       throw new NullPointerException();
     }
 
-    if (offset < 0 || offset + length > b.length) {
+    if (offset < 0 || length < 0 || length > b.length || offset > b.length - length) {
       throw new ArrayIndexOutOfBoundsException();
     }
path: classpath/java/io/FileOutputStream.java
Vulnerability: FUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can delete a page via a post ID to /pages/delete/3.
Vulnerability ID: CVE-2020-28705
CWE: CWE-352
Severity score: 2.9
Project: https://github.com/daylightstudio/FUEL-CMS
Published: 2021-03-10
File: fuel/modules/fuel/controllers/Module.php
Commit message: fix: issue #576 with expanded ability to delete pages
Commit author: David McReynolds

Vulnerable version (before fix):
 function delete($id = NULL)  		$inline = $this->fuel->admin->is_inline();  		if ( ! empty($_POST['id'])) 		{ 			$posted = explode('|', $this->input->post('id', TRUE));  			// run before_delete hook 			$this->_run_hook('before_delete', $posted);

Fixed version (after fix):
 function delete($id = NULL)  		$inline = $this->fuel->admin->is_inline();  		if (! empty($_POST['id'])) 		{ 			if (!empty($id)) 			{ 				$posted = array($id); 			} 			else 			{ 				$posted = explode('|', $this->input->post('id', TRUE)); 			}  			// run before_delete hook 			$this->_run_hook('before_delete', $posted);

Patch:
patch: @@ -1621,9 +1621,16 @@ function delete($id = NULL)
 
 		$inline = $this->fuel->admin->is_inline();
 
-		if ( ! empty($_POST['id']))
+		if (! empty($_POST['id']))
 		{
-			$posted = explode('|', $this->input->post('id', TRUE));
+			if (!empty($id))
+			{
+				$posted = array($id);
+			}
+			else
+			{
+				$posted = explode('|', $this->input->post('id', TRUE));
+			}
 
 			// run before_delete hook
 			$this->_run_hook('before_delete', $posted);
path: fuel/modules/fuel/controllers/Module.php
Vulnerability: reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter).
Vulnerability ID: CVE-2020-28874
CWE: CWE-287
Severity score: 2.9
Project: https://github.com/projectsend/projectsend
Published: 2021-01-26
File: reset-password.php
Commit message: Fix CVE-2020-28874 by @varandinawer
Commit author: Ignacio Nelson

Vulnerable version (before fix):
         }     }      /** The form was submitted */     if ($_POST) {         /**

Fixed version (after fix):
         }     }      /** Fix CVE-2020-28874 */     if (!empty($errorstate)) {         unset($user_data);     }      /** The form was submitted */     if ($_POST) {         /**

Patch:
patch: @@ -55,6 +55,11 @@
         }
     }
 
+    /** Fix CVE-2020-28874 */
+    if (!empty($errorstate)) {
+        unset($user_data);
+    }
+
     /** The form was submitted */
     if ($_POST) {
         /**
path: reset-password.php
Vulnerability: smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak via messages to an instance that performs many regex lookups.
Vulnerability ID: CVE-2020-35679
CWE: CWE-401
Severity score: 2.9
Project: https://github.com/openbsd/src
Published: 2020-12-24
File: usr.sbin/smtpd/table.c
Commit message: Use regfree after we're done with preg.

From gilles@
Commit author: martijn

Vulnerable version (before fix):
 /*	$OpenBSD: table.c,v 1.48 2019/01/10 07:40:52 eric Exp $	*/  /*  * Copyright (c) 2013 Eric Faurot <eric@openbsd.org> table_regex_match(const char *string, const char *pattern) { 	regex_t preg; 	int	cflags = REG_EXTENDED|REG_NOSUB;  	if (strncmp(pattern, "(?i)", 4) == 0) { 		cflags |= REG_ICASE; table_regex_match(const char *string, const char *pattern) 	if (regcomp(&preg, pattern, cflags) != 0) 		return (0);  	if (regexec(&preg, string, 0, NULL, 0) != 0) 		return (0);  	return (1);

Fixed version (after fix):
 /*	$OpenBSD: table.c,v 1.49 2020/12/23 08:12:14 martijn Exp $	*/  /*  * Copyright (c) 2013 Eric Faurot <eric@openbsd.org> table_regex_match(const char *string, const char *pattern) { 	regex_t preg; 	int	cflags = REG_EXTENDED|REG_NOSUB; 	int ret;  	if (strncmp(pattern, "(?i)", 4) == 0) { 		cflags |= REG_ICASE; table_regex_match(const char *string, const char *pattern) 	if (regcomp(&preg, pattern, cflags) != 0) 		return (0);  	ret = regexec(&preg, string, 0, NULL, 0);  	regfree(&preg);  	if (ret != 0) 		return (0);  	return (1);

Patch:
patch: @@ -1,4 +1,4 @@
-/*	$OpenBSD: table.c,v 1.48 2019/01/10 07:40:52 eric Exp $	*/
+/*	$OpenBSD: table.c,v 1.49 2020/12/23 08:12:14 martijn Exp $	*/
 
 /*
  * Copyright (c) 2013 Eric Faurot <eric@openbsd.org>
@@ -464,6 +464,7 @@ table_regex_match(const char *string, const char *pattern)
 {
 	regex_t preg;
 	int	cflags = REG_EXTENDED|REG_NOSUB;
+	int ret;
 
 	if (strncmp(pattern, "(?i)", 4) == 0) {
 		cflags |= REG_ICASE;
@@ -473,7 +474,11 @@ table_regex_match(const char *string, const char *pattern)
 	if (regcomp(&preg, pattern, cflags) != 0)
 		return (0);
 
-	if (regexec(&preg, string, 0, NULL, 0) != 0)
+	ret = regexec(&preg, string, 0, NULL, 0);
+
+	regfree(&preg);
+
+	if (ret != 0)
 		return (0);
 
 	return (1);
path: usr.sbin/smtpd/table.c
Vulnerability: smtpd/lka_filter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted pattern of client activity, because the filter state machine does not properly maintain the I/O channel between the SMTP engine and the filters layer.
Vulnerability ID: CVE-2020-35680
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/openbsd/src
Published: 2020-12-24
File: usr.sbin/smtpd/lka_filter.c
Commit message: smtpd's filter state machine can prematurely release resources
leading to a crash.  From gilles@
Commit author: millert

Vulnerable version (before fix):
 /*	$OpenBSD: lka_filter.c,v 1.64 2020/12/20 13:27:46 martijn Exp $	*/  /*  * Copyright (c) 2018 Gilles Chehade <gilles@poolp.org> filter_session_io(struct io *io, int evt, void *arg) 		filter_data(fs->id, line);  		goto nextline;  	case IO_DISCONNECTED: 		io_free(fs->io); 		fs->io = NULL; 		break; 	} } 

Fixed version (after fix):
 /*	$OpenBSD: lka_filter.c,v 1.65 2020/12/23 20:17:49 millert Exp $	*/  /*  * Copyright (c) 2018 Gilles Chehade <gilles@poolp.org> filter_session_io(struct io *io, int evt, void *arg) 		filter_data(fs->id, line);  		goto nextline; 	} } 

Patch:
patch: @@ -1,4 +1,4 @@
-/*	$OpenBSD: lka_filter.c,v 1.64 2020/12/20 13:27:46 martijn Exp $	*/
+/*	$OpenBSD: lka_filter.c,v 1.65 2020/12/23 20:17:49 millert Exp $	*/
 
 /*
  * Copyright (c) 2018 Gilles Chehade <gilles@poolp.org>
@@ -600,11 +600,6 @@ filter_session_io(struct io *io, int evt, void *arg)
 		filter_data(fs->id, line);
 
 		goto nextline;
-
-	case IO_DISCONNECTED:
-		io_free(fs->io);
-		fs->io = NULL;
-		break;
 	}
 }
path: usr.sbin/smtpd/lka_filter.c
Vulnerability: An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is heap-based buffer overflow in the function gp_rtp_builder_do_avc() in ietf/rtp_pck_mpeg4.c.
Vulnerability ID: CVE-2020-35979
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/gpac/gpac
Published: 2021-04-21
File: src/media_tools/isom_hinter.c
Commit message: fixed #1662
Commit author: jeanlf

Vulnerable version (before fix):
 GF_Err gf_hinter_track_process(GF_RTPHinter *tkHint) 				} 				remain -= size; 				tkHint->rtp_p->sl_header.accessUnitEndFlag = remain ? 0 : 1; 				e = gf_rtp_builder_process(tkHint->rtp_p, ptr, size, (u8) !remain, samp->dataLength, duration, (u8) (descIndex + GF_RTP_TX3G_SIDX_OFFSET) ); 				ptr += size; 				tkHint->rtp_p->sl_header.accessUnitStartFlag = 0; 			} 		} else {

Fixed version (after fix):
 GF_Err gf_hinter_track_process(GF_RTPHinter *tkHint) 				} 				remain -= size; 				tkHint->rtp_p->sl_header.accessUnitEndFlag = remain ? 0 : 1; 				if (!size) { 					GF_LOG(GF_LOG_WARNING, GF_LOG_RTP, ("[rtp hinter] Broken AVC nalu encapsulation: NALU size is 0, ignoring it\n", size)); 				} else { 					e = gf_rtp_builder_process(tkHint->rtp_p, ptr, size, (u8) !remain, samp->dataLength, duration, (u8) (descIndex + GF_RTP_TX3G_SIDX_OFFSET) ); 					ptr += size; 				} 				tkHint->rtp_p->sl_header.accessUnitStartFlag = 0; 			} 		} else {

Patch:
patch: @@ -793,8 +793,12 @@ GF_Err gf_hinter_track_process(GF_RTPHinter *tkHint)
 				}
 				remain -= size;
 				tkHint->rtp_p->sl_header.accessUnitEndFlag = remain ? 0 : 1;
-				e = gf_rtp_builder_process(tkHint->rtp_p, ptr, size, (u8) !remain, samp->dataLength, duration, (u8) (descIndex + GF_RTP_TX3G_SIDX_OFFSET) );
-				ptr += size;
+				if (!size) {
+					GF_LOG(GF_LOG_WARNING, GF_LOG_RTP, ("[rtp hinter] Broken AVC nalu encapsulation: NALU size is 0, ignoring it\n", size));
+				} else {
+					e = gf_rtp_builder_process(tkHint->rtp_p, ptr, size, (u8) !remain, samp->dataLength, duration, (u8) (descIndex + GF_RTP_TX3G_SIDX_OFFSET) );
+					ptr += size;
+				}
 				tkHint->rtp_p->sl_header.accessUnitStartFlag = 0;
 			}
 		} else {
path: src/media_tools/isom_hinter.c
Vulnerability: An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is a use-after-free in the function gf_isom_box_del() in isomedia/box_funcs.c.
Vulnerability ID: CVE-2020-35980
CWE: CWE-416
Severity score: 6.4
Project: https://github.com/gpac/gpac
Published: 2021-04-21
File: src/isomedia/isom_store.c
Commit message: fixed #1661
Commit author: jeanlf

Vulnerable version (before fix):
 void CleanWriters(GF_List *writers) { 	while (gf_list_count(writers)) { 		TrackWriter *writer = (TrackWriter*)gf_list_get(writers, 0); 		gf_isom_box_del(writer->stco); 		gf_isom_box_del((GF_Box *)writer->stsc); 		gf_free(writer);

Fixed version (after fix):
 void CleanWriters(GF_List *writers) { 	while (gf_list_count(writers)) { 		TrackWriter *writer = (TrackWriter*)gf_list_get(writers, 0); 		//in case we have an error in the middle of file write, remove our created stco and stsc from sample table 		gf_list_del_item(writer->stbl->child_boxes, writer->stco); 		gf_list_del_item(writer->stbl->child_boxes, writer->stsc); 		gf_isom_box_del(writer->stco); 		gf_isom_box_del((GF_Box *)writer->stsc); 		gf_free(writer);

Patch:
patch: @@ -102,6 +102,9 @@ void CleanWriters(GF_List *writers)
 {
 	while (gf_list_count(writers)) {
 		TrackWriter *writer = (TrackWriter*)gf_list_get(writers, 0);
+		//in case we have an error in the middle of file write, remove our created stco and stsc from sample table
+		gf_list_del_item(writer->stbl->child_boxes, writer->stco);
+		gf_list_del_item(writer->stbl->child_boxes, writer->stsc);
 		gf_isom_box_del(writer->stco);
 		gf_isom_box_del((GF_Box *)writer->stsc);
 		gf_free(writer);
path: src/isomedia/isom_store.c
Vulnerability: An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is an invalid pointer dereference in the function SetupWriters() in isomedia/isom_store.c.
Vulnerability ID: CVE-2020-35981
CWE: CWE-476
Severity score: 6.4
Project: https://github.com/gpac/gpac
Published: 2021-04-21
File: src/isomedia/isom_store.c
Commit message: fixed #1659
Commit author: jeanlf

Vulnerable version (before fix):
 GF_Err SetupWriters(MovieWriter *mw, GF_List *writers, u8 interleaving)  	trackCount = gf_list_count(movie->moov->trackList); 	for (i = 0; i < trackCount; i++) { 		trak = gf_isom_get_track(movie->moov, i+1);  		GF_SAFEALLOC(writer, TrackWriter); 		if (!writer) goto exit; 		writer->sampleNumber = 1;

Fixed version (after fix):
 GF_Err SetupWriters(MovieWriter *mw, GF_List *writers, u8 interleaving)  	trackCount = gf_list_count(movie->moov->trackList); 	for (i = 0; i < trackCount; i++) { 		GF_SampleTableBox *stbl; 		trak = gf_isom_get_track(movie->moov, i+1);  		stbl = (trak->Media && trak->Media->information) ? trak->Media->information->sampleTable : NULL; 		if (!stbl || !stbl->SampleSize || !stbl->ChunkOffset || !stbl->SampleToChunk) { 			return GF_ISOM_INVALID_FILE; 		}  		GF_SAFEALLOC(writer, TrackWriter); 		if (!writer) goto exit; 		writer->sampleNumber = 1;

Patch:
patch: @@ -150,8 +150,14 @@ GF_Err SetupWriters(MovieWriter *mw, GF_List *writers, u8 interleaving)
 
 	trackCount = gf_list_count(movie->moov->trackList);
 	for (i = 0; i < trackCount; i++) {
+		GF_SampleTableBox *stbl;
 		trak = gf_isom_get_track(movie->moov, i+1);
 
+		stbl = (trak->Media && trak->Media->information) ? trak->Media->information->sampleTable : NULL;
+		if (!stbl || !stbl->SampleSize || !stbl->ChunkOffset || !stbl->SampleToChunk) {
+			return GF_ISOM_INVALID_FILE;
+		}
+
 		GF_SAFEALLOC(writer, TrackWriter);
 		if (!writer) goto exit;
 		writer->sampleNumber = 1;
path: src/isomedia/isom_store.c
Vulnerability: An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is an invalid pointer dereference in the function gf_hinter_track_finalize() in media_tools/isom_hinter.c.
Vulnerability ID: CVE-2020-35982
CWE: CWE-476
Severity score: 6.4
Project: https://github.com/gpac/gpac
Published: 2021-04-21
File: src/media_tools/isom_hinter.c
Commit message: fixed #1660
Commit author: jeanlf

Vulnerable version (before fix):
 GF_Err gf_hinter_track_finalize(GF_RTPHinter *tkHint, Bool AddSystemInfo) 		if (avcc) { 			sprintf(sdpLine, "a=fmtp:%d profile-level-id=%02X%02X%02X; packetization-mode=1", tkHint->rtp_p->PayloadType, avcc->AVCProfileIndication, avcc->profile_compatibility, avcc->AVCLevelIndication); 		} else { 			sprintf(sdpLine, "a=fmtp:%d profile-level-id=%02X%02X%02X; packetization-mode=1", tkHint->rtp_p->PayloadType, svcc->AVCProfileIndication, svcc->profile_compatibility, svcc->AVCLevelIndication); 		} 

Fixed version (after fix):
 GF_Err gf_hinter_track_finalize(GF_RTPHinter *tkHint, Bool AddSystemInfo) 		if (avcc) { 			sprintf(sdpLine, "a=fmtp:%d profile-level-id=%02X%02X%02X; packetization-mode=1", tkHint->rtp_p->PayloadType, avcc->AVCProfileIndication, avcc->profile_compatibility, avcc->AVCLevelIndication); 		} else { 			if (!svcc) 				return GF_ISOM_INVALID_FILE; 			sprintf(sdpLine, "a=fmtp:%d profile-level-id=%02X%02X%02X; packetization-mode=1", tkHint->rtp_p->PayloadType, svcc->AVCProfileIndication, svcc->profile_compatibility, svcc->AVCLevelIndication); 		} 

Patch:
patch: @@ -967,6 +967,8 @@ GF_Err gf_hinter_track_finalize(GF_RTPHinter *tkHint, Bool AddSystemInfo)
 		if (avcc) {
 			sprintf(sdpLine, "a=fmtp:%d profile-level-id=%02X%02X%02X; packetization-mode=1", tkHint->rtp_p->PayloadType, avcc->AVCProfileIndication, avcc->profile_compatibility, avcc->AVCLevelIndication);
 		} else {
+			if (!svcc)
+				return GF_ISOM_INVALID_FILE;
 			sprintf(sdpLine, "a=fmtp:%d profile-level-id=%02X%02X%02X; packetization-mode=1", tkHint->rtp_p->PayloadType, svcc->AVCProfileIndication, svcc->profile_compatibility, svcc->AVCLevelIndication);
 		}
path: src/media_tools/isom_hinter.c
Vulnerability: mwifiex_cmd_802_11_ad_hoc_start in drivers/net/wireless/marvell/mwifiex/join.c in the Linux kernel through 5.10.4 might allow remote attackers to execute arbitrary code via a long SSID value, aka CID-5c455c5ab332.
Vulnerability ID: CVE-2020-36158
CWE: CWE-120
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2021-01-05
File: drivers/net/wireless/marvell/mwifiex/join.c
Commit message: mwifiex: Fix possible buffer overflows in mwifiex_cmd_802_11_ad_hoc_start

mwifiex_cmd_802_11_ad_hoc_start() calls memcpy() without checking
the destination size may trigger a buffer overflower,
which a local user could use to cause denial of service
or the execution of arbitrary code.
Fix it by putting the length check before calling memcpy().

Signed-off-by: Zhang Xiaohui <ruc_zhangxiaohui@163.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201206084801.26479-1-ruc_zhangxiaohui@163.com
Commit author: Zhang Xiaohui

Vulnerable version (before fix):
 mwifiex_cmd_802_11_ad_hoc_start(struct mwifiex_private *priv,  	memset(adhoc_start->ssid, 0, IEEE80211_MAX_SSID_LEN);  	memcpy(adhoc_start->ssid, req_ssid->ssid, req_ssid->ssid_len);  	mwifiex_dbg(adapter, INFO, "info: ADHOC_S_CMD: SSID = %s\n",

Fixed version (after fix):
 mwifiex_cmd_802_11_ad_hoc_start(struct mwifiex_private *priv,  	memset(adhoc_start->ssid, 0, IEEE80211_MAX_SSID_LEN);  	if (req_ssid->ssid_len > IEEE80211_MAX_SSID_LEN) 		req_ssid->ssid_len = IEEE80211_MAX_SSID_LEN; 	memcpy(adhoc_start->ssid, req_ssid->ssid, req_ssid->ssid_len);  	mwifiex_dbg(adapter, INFO, "info: ADHOC_S_CMD: SSID = %s\n",

Patch:
patch: @@ -877,6 +877,8 @@ mwifiex_cmd_802_11_ad_hoc_start(struct mwifiex_private *priv,
 
 	memset(adhoc_start->ssid, 0, IEEE80211_MAX_SSID_LEN);
 
+	if (req_ssid->ssid_len > IEEE80211_MAX_SSID_LEN)
+		req_ssid->ssid_len = IEEE80211_MAX_SSID_LEN;
 	memcpy(adhoc_start->ssid, req_ssid->ssid, req_ssid->ssid_len);
 
 	mwifiex_dbg(adapter, INFO, "info: ADHOC_S_CMD: SSID = %s\n",
path: drivers/net/wireless/marvell/mwifiex/join.c