rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: A Null pointer dereference vulnerability exits in MP4Box - GPAC version 0.8.0-rev177-g51a8ef874-master via the gf_isom_get_track_id function, which causes a denial of service.
Vulnerability ID: CVE-2020-25427
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2022-01-10
File: src/isomedia/box_funcs.c
Commit message: fixed potential crash - cf #1406
Commit author: jeanlf

Vulnerable version (before fix):
 GF_Err gf_isom_box_parse_ex(GF_Box **outBox, GF_BitStream *bs, u32 parent_type,  	newBox->size = size - hdr_size;  	if (newBox->size) { 		e = gf_isom_full_box_read(newBox, bs); 		if (!e) e = gf_isom_box_read(newBox, bs); 		newBox->size = size; 		end = gf_bs_get_position(bs); 	} else { 		newBox->size = size; 		//empty box 		e = GF_OK; 		end = gf_bs_get_position(bs); 	}  	if (e && (e != GF_ISOM_INCOMPLETE_FILE)) { 		gf_isom_box_del(newBox);

Fixed version (after fix):
 GF_Err gf_isom_box_parse_ex(GF_Box **outBox, GF_BitStream *bs, u32 parent_type,  	newBox->size = size - hdr_size;  	//parse even if size is 0 - this makes sure that we perform box parsing (usually in box->read) 	e = gf_isom_full_box_read(newBox, bs); 	if (!e) e = gf_isom_box_read(newBox, bs); 	newBox->size = size; 	end = gf_bs_get_position(bs);  	if (e && (e != GF_ISOM_INCOMPLETE_FILE)) { 		gf_isom_box_del(newBox);

Patch:
patch: @@ -205,17 +205,11 @@ GF_Err gf_isom_box_parse_ex(GF_Box **outBox, GF_BitStream *bs, u32 parent_type,
 
 	newBox->size = size - hdr_size;
 
-	if (newBox->size) {
-		e = gf_isom_full_box_read(newBox, bs);
-		if (!e) e = gf_isom_box_read(newBox, bs);
-		newBox->size = size;
-		end = gf_bs_get_position(bs);
-	} else {
-		newBox->size = size;
-		//empty box
-		e = GF_OK;
-		end = gf_bs_get_position(bs);
-	}
+	//parse even if size is 0 - this makes sure that we perform box parsing (usually in box->read)
+	e = gf_isom_full_box_read(newBox, bs);
+	if (!e) e = gf_isom_box_read(newBox, bs);
+	newBox->size = size;
+	end = gf_bs_get_position(bs);
 
 	if (e && (e != GF_ISOM_INCOMPLETE_FILE)) {
 		gf_isom_box_del(newBox);
path: src/isomedia/box_funcs.c
Vulnerability: An issue was discovered in MantisBT before 2.24.3. Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when attempting to update said custom field via bug_actiongroup_page.php.
Vulnerability ID: CVE-2020-25830
CWE: CWE-79
Severity score: 2.9
Project: http://github.com/mantisbt/mantisbt
Published: 2020-09-30
File: bug_actiongroup_page.php
Commit message: Fix XSS in bug_actiongroup_page.php

Improper escaping of the custom field's name allowed an attacker to
inject HTML into the page.

Credits to d3vpoo1 (https://gitlab.com/jrckmcsb) for the finding.

Fixes #27304
Commit author: Damien Regad

Vulnerable version (before fix):
 		break; 	case 'CUSTOM' : 		$t_custom_field_def = custom_field_get_definition( $t_custom_field_id ); 		$t_question_title = sprintf( lang_get( 'actiongroup_menu_update_field' ), lang_get_defaulted( $t_custom_field_def['name'] ) ); 		$t_button_title = $t_question_title; 		$t_form = 'custom_field_' . $t_custom_field_id; 		$t_event_params['custom_field_id'] = $t_custom_field_id;

Fixed version (after fix):
 		break; 	case 'CUSTOM' : 		$t_custom_field_def = custom_field_get_definition( $t_custom_field_id ); 		$t_question_title = sprintf( lang_get( 'actiongroup_menu_update_field' ), 			string_attribute( lang_get_defaulted( $t_custom_field_def['name'] ) ) 		); 		$t_button_title = $t_question_title; 		$t_form = 'custom_field_' . $t_custom_field_id; 		$t_event_params['custom_field_id'] = $t_custom_field_id;

Patch:
patch: @@ -225,7 +225,9 @@
 		break;
 	case 'CUSTOM' :
 		$t_custom_field_def = custom_field_get_definition( $t_custom_field_id );
-		$t_question_title = sprintf( lang_get( 'actiongroup_menu_update_field' ), lang_get_defaulted( $t_custom_field_def['name'] ) );
+		$t_question_title = sprintf( lang_get( 'actiongroup_menu_update_field' ),
+			string_attribute( lang_get_defaulted( $t_custom_field_def['name'] ) )
+		);
 		$t_button_title = $t_question_title;
 		$t_form = 'custom_field_' . $t_custom_field_id;
 		$t_event_params['custom_field_id'] = $t_custom_field_id;
path: bug_actiongroup_page.php
Vulnerability: JHEAD is a simple command line tool for displaying and some manipulation of EXIF header data embedded in Jpeg images from digital cameras. In affected versions there is a heap-buffer-overflow on jhead-3.04/jpgfile.c:285 ReadJpegSections. Crafted jpeg images can be provided to the user resulting in a program crash or potentially incorrect exif information retrieval. Users are advised to upgrade. There is no known workaround for this issue.
Vulnerability ID: CVE-2020-26208
CWE: CWE-787
Severity score: 4.9
Project: https://github.com/F-ZhaoYang/jhead
Published: 2022-02-02
File: jpgfile.c
Commit message: Just allocate 20 bytes extra at the end of a section. Otherwise, we end
up with a whole lot of little checks for structures that the file says
are there but are unexpectedly cut off in fuzz tests
Commit author: Matthias

Vulnerable version (before fix):
 int ReadJpegSections (FILE * infile, ReadMode_t ReadMode)          Sections[SectionsRead].Size = itemlen;          Data = (uchar *)malloc(itemlen);         if (Data == NULL){             ErrFatal("Could not allocate memory");         } int ReplaceThumbnail(const char * ThumbFileName)              return FALSE;         }          ThumbLen = 0;         ThumbnailFile = NULL;     } 

Fixed version (after fix):
 int ReadJpegSections (FILE * infile, ReadMode_t ReadMode)          Sections[SectionsRead].Size = itemlen;          // Allocate an extra 20 bytes more than needed, because sometimes when reading structures,         // if the section erroneously ends before short structures that should be there, that can trip         // memory checkers in combination with fuzzers.         Data = (uchar *)malloc(itemlen+20);         if (Data == NULL){             ErrFatal("Could not allocate memory");         } int ReplaceThumbnail(const char * ThumbFileName)              return FALSE;         }          ThumbLen = 0;         ThumbnailFile = NULL;     } 

Patch:
patch: @@ -169,7 +169,10 @@ int ReadJpegSections (FILE * infile, ReadMode_t ReadMode)
 
         Sections[SectionsRead].Size = itemlen;
 
-        Data = (uchar *)malloc(itemlen);
+        // Allocate an extra 20 bytes more than needed, because sometimes when reading structures,
+        // if the section erroneously ends before short structures that should be there, that can trip
+        // memory checkers in combination with fuzzers.
+        Data = (uchar *)malloc(itemlen+20);
         if (Data == NULL){
             ErrFatal("Could not allocate memory");
         }
@@ -476,7 +479,7 @@ int ReplaceThumbnail(const char * ThumbFileName)
              return FALSE;
         }
 
-        ThumbLen = 0;
+        ThumbLen = 0;
         ThumbnailFile = NULL;
     }
path: jpgfile.c
Vulnerability: Scratch Addons is a WebExtension that supports both Chrome and Firefox. Scratch Addons before version 1.3.2 is vulnerable to DOM-based XSS. If the victim visited a specific website, the More Links addon of the Scratch Addons extension used incorrect regular expression which caused the HTML-escaped values to be unescaped, leading to XSS. Scratch Addons version 1.3.2 fixes the bug. The extension will be automatically updated by the browser. More Links addon can be disabled via the option of the extension.
Vulnerability ID: CVE-2020-26239
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/ScratchAddons/ScratchAddons
Published: 2020-11-23
File: addons/more-links/userscript.js
Commit message: SECURITY: Fix DOM XSS in More Links addon
Commit author: apple502j

Vulnerable version (before fix):
 export default async function ({ addon, console }) {           let element = await addon.tab.waitForElement(".project-description", { markAsSeen: true });           // Need to convert #[numbers] to solve conflict between tags and external Scratch player links.           document.querySelectorAll(".project-description a").forEach((element) => {             if (/\d+/.test(element.textContent)) element.outerHTML = element.textContent;           });           element.normalize();           linkifyElement(element);

Fixed version (after fix):
 export default async function ({ addon, console }) {           let element = await addon.tab.waitForElement(".project-description", { markAsSeen: true });           // Need to convert #[numbers] to solve conflict between tags and external Scratch player links.           document.querySelectorAll(".project-description a").forEach((element) => {               if (/^#\d+$/.test(element.textContent) && element.previousSibling instanceof Text) {                   element.previousSibling.textContent += element.textContent;                   element.remove();               }           });           element.normalize();           linkifyElement(element);

Patch:
patch: @@ -15,7 +15,10 @@ export default async function ({ addon, console }) {
           let element = await addon.tab.waitForElement(".project-description", { markAsSeen: true });
           // Need to convert #[numbers] to solve conflict between tags and external Scratch player links.
           document.querySelectorAll(".project-description a").forEach((element) => {
-            if (/\d+/.test(element.textContent)) element.outerHTML = element.textContent;
+              if (/^#\d+$/.test(element.textContent) && element.previousSibling instanceof Text) {
+                  element.previousSibling.textContent += element.textContent;
+                  element.remove();
+              }
           });
           element.normalize();
           linkifyElement(element);
path: addons/more-links/userscript.js
Vulnerability: OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to import/export data and to create widget instances was able to inject an executable file on the server. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved
Vulnerability ID: CVE-2020-26285
CWE: CWE-434
Severity score: 6.4
Project: https://github.com/OpenMage/magento-lts
Published: 2021-01-21
File: app/code/core/Mage/Widget/Model/Widget/Instance.php
Commit message: Merge pull request from GHSA-hj6w-xrv3-wjj9

Security fix for GHSA-hj6w-xrv3-wjj9
Commit author: Mark Lewis

Vulnerable version (before fix):
 public function getWidgetSupportedTemplatesByBlock($blockReference)      */     public function generateLayoutUpdateXml($blockReference, $templatePath = '')     {         $templateFilename = Mage::getSingleton('core/design_package')->getTemplateFilename($templatePath, array(             '_area'    => $this->getArea(),             '_package' => $this->getPackage(),

Fixed version (after fix):
 public function getWidgetSupportedTemplatesByBlock($blockReference)      */     public function generateLayoutUpdateXml($blockReference, $templatePath = '')     {       if ($templatePath !== htmlspecialchars($templatePath, ENT_QUOTES | ENT_HTML5)         || $blockReference !== htmlspecialchars($blockReference, ENT_QUOTES | ENT_HTML5)) {           Mage::throwException('Templatepath or block reference contain special characters.');       }          $templateFilename = Mage::getSingleton('core/design_package')->getTemplateFilename($templatePath, array(             '_area'    => $this->getArea(),             '_package' => $this->getPackage(),

Patch:
patch: @@ -495,6 +495,11 @@ public function getWidgetSupportedTemplatesByBlock($blockReference)
      */
     public function generateLayoutUpdateXml($blockReference, $templatePath = '')
     {
+      if ($templatePath !== htmlspecialchars($templatePath, ENT_QUOTES | ENT_HTML5)
+        || $blockReference !== htmlspecialchars($blockReference, ENT_QUOTES | ENT_HTML5)) {
+          Mage::throwException('Templatepath or block reference contain special characters.');
+      }
+
         $templateFilename = Mage::getSingleton('core/design_package')->getTemplateFilename($templatePath, array(
             '_area'    => $this->getArea(),
             '_package' => $this->getPackage(),
path: app/code/core/Mage/Widget/Model/Widget/Instance.php
Vulnerability: OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to import/export data and to create widget instances was able to inject an executable file on the server. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved
Vulnerability ID: CVE-2020-26285
CWE: CWE-22
Severity score: 6.4
Project: https://github.com/OpenMage/magento-lts
Published: 2021-01-21
File: app/code/core/Mage/Widget/Model/Widget/Instance.php
Commit message: Merge pull request from GHSA-hj6w-xrv3-wjj9

Security fix for GHSA-hj6w-xrv3-wjj9
Commit author: Mark Lewis

Vulnerable version (before fix):
 public function getWidgetSupportedTemplatesByBlock($blockReference)      */     public function generateLayoutUpdateXml($blockReference, $templatePath = '')     {         $templateFilename = Mage::getSingleton('core/design_package')->getTemplateFilename($templatePath, array(             '_area'    => $this->getArea(),             '_package' => $this->getPackage(),

Fixed version (after fix):
 public function getWidgetSupportedTemplatesByBlock($blockReference)      */     public function generateLayoutUpdateXml($blockReference, $templatePath = '')     {       if ($templatePath !== htmlspecialchars($templatePath, ENT_QUOTES | ENT_HTML5)         || $blockReference !== htmlspecialchars($blockReference, ENT_QUOTES | ENT_HTML5)) {           Mage::throwException('Templatepath or block reference contain special characters.');       }          $templateFilename = Mage::getSingleton('core/design_package')->getTemplateFilename($templatePath, array(             '_area'    => $this->getArea(),             '_package' => $this->getPackage(),

Patch:
patch: @@ -495,6 +495,11 @@ public function getWidgetSupportedTemplatesByBlock($blockReference)
      */
     public function generateLayoutUpdateXml($blockReference, $templatePath = '')
     {
+      if ($templatePath !== htmlspecialchars($templatePath, ENT_QUOTES | ENT_HTML5)
+        || $blockReference !== htmlspecialchars($blockReference, ENT_QUOTES | ENT_HTML5)) {
+          Mage::throwException('Templatepath or block reference contain special characters.');
+      }
+
         $templateFilename = Mage::getSingleton('core/design_package')->getTemplateFilename($templatePath, array(
             '_area'    => $this->getArea(),
             '_package' => $this->getPackage(),
path: app/code/core/Mage/Widget/Model/Widget/Instance.php
Vulnerability: HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an attacker can inject arbitrary `script` tags in HedgeDoc notes using mermaid diagrams. Our content security policy prevents loading scripts from most locations, but `www.google-analytics.com` is allowed. Using Google Tag Manger it is possible to inject arbitrary JavaScript and execute it on page load. Depending on the configuration of the instance, the attacker may not need authentication to create or edit notes. The problem is patched in HedgeDoc 1.7.1. As a workaround one can disallow `www.google-analytics.com` in the `Content-Security-Policy` header. Note that other ways to leverage the `script` tag injection might exist.
Vulnerability ID: CVE-2020-26287
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/hedgedoc/hedgedoc
Published: 2020-12-29
File: public/js/extra.js
Commit message: Merge pull request from GHSA-g6w6-7xf9-m95p

Don't store mermaid diagrams in innerHTML
Commit author: David Mehren

Vulnerable version (before fix):
 export function finishView (view) {        window.mermaid.mermaidAPI.parse($value.text())       $ele.addClass('mermaid')       $ele.html($value.text())       window.mermaid.init(undefined, $ele)     } catch (err) {       var errormessage = err

Fixed version (after fix):
 export function finishView (view) {        window.mermaid.mermaidAPI.parse($value.text())       $ele.addClass('mermaid')       $ele.text($value.text())       window.mermaid.init(undefined, $ele)     } catch (err) {       var errormessage = err

Patch:
patch: @@ -386,7 +386,7 @@ export function finishView (view) {
 
       window.mermaid.mermaidAPI.parse($value.text())
       $ele.addClass('mermaid')
-      $ele.html($value.text())
+      $ele.text($value.text())
       window.mermaid.init(undefined, $ele)
     } catch (err) {
       var errormessage = err
path: public/js/extra.js
Vulnerability: The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in sc_oberthur_read_file.
Vulnerability ID: CVE-2020-26570
CWE: CWE-787
Severity score: 2.9
Project: https://github.com/OpenSC/OpenSC
Published: 2020-10-06
File: src/libopensc/pkcs15-oberthur.c
Commit message: Heap-buffer-overflow WRITE

fixes https://oss-fuzz.com/testcase-detail/5088104168554496
Commit author: Frank Morgner

Vulnerable version (before fix):
 sc_oberthur_read_file(struct sc_pkcs15_card *p15card, const char *in_path, 		rv = sc_read_binary(card, 0, *out, sz, 0); 	} 	else	{ 		int rec; 		int offs = 0; 		int rec_len = file->record_length;  		for (rec = 1; ; rec++)   { 			rv = sc_read_record(card, rec, *out + offs + 2, rec_len, SC_RECORD_BY_REC_NR); 			if (rv == SC_ERROR_RECORD_NOT_FOUND)   { 				rv = 0;

Fixed version (after fix):
 sc_oberthur_read_file(struct sc_pkcs15_card *p15card, const char *in_path, 		rv = sc_read_binary(card, 0, *out, sz, 0); 	} 	else	{ 		size_t rec; 		size_t offs = 0; 		size_t rec_len = file->record_length;  		for (rec = 1; ; rec++)   { 			if (rec > file->record_count) { 				rv = 0; 				break; 			} 			rv = sc_read_record(card, rec, *out + offs + 2, rec_len, SC_RECORD_BY_REC_NR); 			if (rv == SC_ERROR_RECORD_NOT_FOUND)   { 				rv = 0;

Patch:
patch: @@ -271,11 +271,15 @@ sc_oberthur_read_file(struct sc_pkcs15_card *p15card, const char *in_path,
 		rv = sc_read_binary(card, 0, *out, sz, 0);
 	}
 	else	{
-		int rec;
-		int offs = 0;
-		int rec_len = file->record_length;
+		size_t rec;
+		size_t offs = 0;
+		size_t rec_len = file->record_length;
 
 		for (rec = 1; ; rec++)   {
+			if (rec > file->record_count) {
+				rv = 0;
+				break;
+			}
 			rv = sc_read_record(card, rec, *out + offs + 2, rec_len, SC_RECORD_BY_REC_NR);
 			if (rv == SC_ERROR_RECORD_NOT_FOUND)   {
 				rv = 0;
path: src/libopensc/pkcs15-oberthur.c
Vulnerability: phpRedisAdmin before 1.13.2 allows XSS via the login.php username parameter.
Vulnerability ID: CVE-2020-27163
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/erikdubbelboer/phpRedisAdmin
Published: 2020-10-16
File: login.php
Commit message: Fix XSS
Commit author: Erik Dubbelboer

Vulnerable version (before fix):
     <label for="inputUser" class="sr-only">Username</label>     <input type="text" name="username" id="inputUser" class="form-control"            placeholder="Username"            value="<?= isset($_POST['username']) ? $_POST['username'] : '' ?>"            required <?= isset($_POST['username']) ? '' : 'autofocus' ?>>      <label for="inputPassword" class="sr-only">Password</label>

Fixed version (after fix):
     <label for="inputUser" class="sr-only">Username</label>     <input type="text" name="username" id="inputUser" class="form-control"            placeholder="Username"            value="<?= isset($_POST['username']) ? htmlentities($_POST['username'], defined('ENT_SUBSTITUTE') ? (ENT_QUOTES | ENT_SUBSTITUTE) : ENT_QUOTES, 'utf-8') : '' ?>"            required <?= isset($_POST['username']) ? '' : 'autofocus' ?>>      <label for="inputPassword" class="sr-only">Password</label>

Patch:
patch: @@ -25,7 +25,7 @@
     <label for="inputUser" class="sr-only">Username</label>
     <input type="text" name="username" id="inputUser" class="form-control"
            placeholder="Username"
-           value="<?= isset($_POST['username']) ? $_POST['username'] : '' ?>"
+           value="<?= isset($_POST['username']) ? htmlentities($_POST['username'], defined('ENT_SUBSTITUTE') ? (ENT_QUOTES | ENT_SUBSTITUTE) : ENT_QUOTES, 'utf-8') : '' ?>"
            required <?= isset($_POST['username']) ? '' : 'autofocus' ?>>
 
     <label for="inputPassword" class="sr-only">Password</label>
path: login.php
Vulnerability: In tmux before version 3.1c the function input_csi_dispatch_sgr_colon() in file input.c contained a stack-based buffer-overflow that can be exploited by terminal output.
Vulnerability ID: CVE-2020-27347
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/tmux/tmux
Published: 2020-11-06
File: input.c
Commit message: Do not write after the end of the array and overwrite the stack when
colon-separated SGR sequences contain empty arguments. Reported by Sergey
Nizovtsev.
Commit author: nicm

Vulnerable version (before fix):
 input_csi_dispatch_sgr_colon(struct input_ctx *ictx, u_int i) 				free(copy); 				return; 			} 		} else 			n++; 		log_debug("%s: %u = %d", __func__, n - 1, p[n - 1]); 	} 	free(copy);

Fixed version (after fix):
 input_csi_dispatch_sgr_colon(struct input_ctx *ictx, u_int i) 				free(copy); 				return; 			} 		} else { 			n++; 			if (n == nitems(p)) { 				free(copy); 				return; 			} 		} 		log_debug("%s: %u = %d", __func__, n - 1, p[n - 1]); 	} 	free(copy);

Patch:
patch: @@ -1976,8 +1976,13 @@ input_csi_dispatch_sgr_colon(struct input_ctx *ictx, u_int i)
 				free(copy);
 				return;
 			}
-		} else
+		} else {
 			n++;
+			if (n == nitems(p)) {
+				free(copy);
+				return;
+			}
+		}
 		log_debug("%s: %u = %d", __func__, n - 1, p[n - 1]);
 	}
 	free(copy);
path: input.c
Vulnerability: ImageMagick 7.0.10-34 allows Division by Zero in OptimizeLayerFrames in MagickCore/layer.c, which may cause a denial of service.
Vulnerability ID: CVE-2020-27560
CWE: CWE-369
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2020-10-22
File: MagickCore/layer.c
Commit message: There is a Division by Zero in function OptimizeLayerFrames (#2743)

in file MagickCore/layer.c. cur->ticks_per_seconds can be zero
with a crafted input argument *image. This is similar to
CVE-2019-13454.
Commit author: bonniegong

Vulnerable version (before fix):
 static Image *OptimizeLayerFrames(const Image *image,const LayerMethod method,     if ( disposals[i] == DelDispose ) {       size_t time = 0;       while ( disposals[i] == DelDispose ) {         time += curr->delay*1000/curr->ticks_per_second;         curr=GetNextImageInList(curr);         i++;       }       time += curr->delay*1000/curr->ticks_per_second;       prev_image->ticks_per_second = 100L;       prev_image->delay = time*prev_image->ticks_per_second/1000;     }

Fixed version (after fix):
 static Image *OptimizeLayerFrames(const Image *image,const LayerMethod method,     if ( disposals[i] == DelDispose ) {       size_t time = 0;       while ( disposals[i] == DelDispose ) {         time +=(size_t) (curr->delay*1000*           PerceptibleReciprocal((double) curr->ticks_per_second));         curr=GetNextImageInList(curr);         i++;       }       time += (size_t)(curr->delay*1000*         PerceptibleReciprocal((double) curr->ticks_per_second));       prev_image->ticks_per_second = 100L;       prev_image->delay = time*prev_image->ticks_per_second/1000;     }

Patch:
patch: @@ -1352,11 +1352,13 @@ static Image *OptimizeLayerFrames(const Image *image,const LayerMethod method,
     if ( disposals[i] == DelDispose ) {
       size_t time = 0;
       while ( disposals[i] == DelDispose ) {
-        time += curr->delay*1000/curr->ticks_per_second;
+        time +=(size_t) (curr->delay*1000*
+          PerceptibleReciprocal((double) curr->ticks_per_second));
         curr=GetNextImageInList(curr);
         i++;
       }
-      time += curr->delay*1000/curr->ticks_per_second;
+      time += (size_t)(curr->delay*1000*
+        PerceptibleReciprocal((double) curr->ticks_per_second));
       prev_image->ticks_per_second = 100L;
       prev_image->delay = time*prev_image->ticks_per_second/1000;
     }
path: MagickCore/layer.c