rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: MagickCore/profile.c in ImageMagick before 7.0.3-2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.
Vulnerability ID: CVE-2016-7799
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-01-18
File: MagickCore/profile.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/280
Commit author: Cristy

Vulnerable version (before fix):
 MagickBooleanType SyncExifProfile(Image *image,StringInfo *profile)         break;  /* corrupt EXIF */       tag_value=(ssize_t) ReadProfileShort(endian,q);       format=(ssize_t) ReadProfileShort(endian,q+2);       if ((format-1) >= EXIF_NUM_FORMATS)         break;       components=(ssize_t) ReadProfileLong(endian,q+4);       if (components < 0)

Fixed version (after fix):
 MagickBooleanType SyncExifProfile(Image *image,StringInfo *profile)         break;  /* corrupt EXIF */       tag_value=(ssize_t) ReadProfileShort(endian,q);       format=(ssize_t) ReadProfileShort(endian,q+2);       if ((format < 0) || ((format-1) >= EXIF_NUM_FORMATS))         break;       components=(ssize_t) ReadProfileLong(endian,q+4);       if (components < 0)

Patch:
patch: @@ -2032,7 +2032,7 @@ MagickBooleanType SyncExifProfile(Image *image,StringInfo *profile)
         break;  /* corrupt EXIF */
       tag_value=(ssize_t) ReadProfileShort(endian,q);
       format=(ssize_t) ReadProfileShort(endian,q+2);
-      if ((format-1) >= EXIF_NUM_FORMATS)
+      if ((format < 0) || ((format-1) >= EXIF_NUM_FORMATS))
         break;
       components=(ssize_t) ReadProfileLong(endian,q+4);
       if (components < 0)
path: MagickCore/profile.c
Vulnerability: magick/attribute.c in ImageMagick 7.0.3-2 allows remote attackers to cause a denial of service (use-after-free) via a crafted file.
Vulnerability ID: CVE-2016-7906
CWE: CWE-416
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-01-18
File: MagickCore/attribute.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/281
Commit author: Cristy

Vulnerable version (before fix):
 MagickExport MagickBooleanType SetImageType(Image *image,const ImageType type,           status=QuantizeImage(quantize_info,image,exception);           quantize_info=DestroyQuantizeInfo(quantize_info);         }       image->colors=2;       image->alpha_trait=UndefinedPixelTrait;       break;     }

Fixed version (after fix):
 MagickExport MagickBooleanType SetImageType(Image *image,const ImageType type,           status=QuantizeImage(quantize_info,image,exception);           quantize_info=DestroyQuantizeInfo(quantize_info);         }       status=AcquireImageColormap(image,2,exception);       image->alpha_trait=UndefinedPixelTrait;       break;     }

Patch:
patch: @@ -1264,7 +1264,7 @@ MagickExport MagickBooleanType SetImageType(Image *image,const ImageType type,
           status=QuantizeImage(quantize_info,image,exception);
           quantize_info=DestroyQuantizeInfo(quantize_info);
         }
-      image->colors=2;
+      status=AcquireImageColormap(image,2,exception);
       image->alpha_trait=UndefinedPixelTrait;
       break;
     }
path: MagickCore/attribute.c
Vulnerability: Race condition in the environ_read function in fs/proc/base.c in the Linux kernel before 4.5.4 allows local users to obtain sensitive information from kernel memory by reading a /proc/*/environ file during a process-setup time interval in which environment-variable copying is incomplete.
Vulnerability ID: CVE-2016-7916
CWE: CWE-362
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2016-11-16
File: fs/proc/base.c
Commit message: proc: prevent accessing /proc/<PID>/environ until it's ready

If /proc/<PID>/environ gets read before the envp[] array is fully set up
in create_{aout,elf,elf_fdpic,flat}_tables(), we might end up trying to
read more bytes than are actually written, as env_start will already be
set but env_end will still be zero, making the range calculation
underflow, allowing to read beyond the end of what has been written.

Fix this as it is done for /proc/<PID>/cmdline by testing env_end for
zero.  It is, apparently, intentionally set last in create_*_tables().

This bug was found by the PaX size_overflow plugin that detected the
arithmetic underflow of 'this_len = env_end - (env_start + src)' when
env_end is still zero.

The expected consequence is that userland trying to access
/proc/<PID>/environ of a not yet fully set up process may get
inconsistent data as we're in the middle of copying in the environment
variables.

Fixes: https://forums.grsecurity.net/viewtopic.php?f=3&t=4363
Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=116461
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Emese Revfy <re.emese@gmail.com>
Cc: Pax Team <pageexec@freemail.hu>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Mateusz Guzik <mguzik@redhat.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Cyrill Gorcunov <gorcunov@openvz.org>
Cc: Jarod Wilson <jarod@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Mathias Krause

Vulnerable version (before fix):
 static ssize_t environ_read(struct file *file, char __user *buf, 	struct mm_struct *mm = file->private_data; 	unsigned long env_start, env_end;  	if (!mm) 		return 0;  	page = (char *)__get_free_page(GFP_TEMPORARY);

Fixed version (after fix):
 static ssize_t environ_read(struct file *file, char __user *buf, 	struct mm_struct *mm = file->private_data; 	unsigned long env_start, env_end;  	/* Ensure the process spawned far enough to have an environment. */ 	if (!mm || !mm->env_end) 		return 0;  	page = (char *)__get_free_page(GFP_TEMPORARY);

Patch:
patch: @@ -955,7 +955,8 @@ static ssize_t environ_read(struct file *file, char __user *buf,
 	struct mm_struct *mm = file->private_data;
 	unsigned long env_start, env_end;
 
-	if (!mm)
+	/* Ensure the process spawned far enough to have an environment. */
+	if (!mm || !mm->env_end)
 		return 0;
 
 	page = (char *)__get_free_page(GFP_TEMPORARY);
path: fs/proc/base.c
Vulnerability: The wrap_lines_smart function in ass_render.c in libass before 0.13.4 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to "0/3 line wrapping equalization."
Vulnerability ID: CVE-2016-7969
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/libass/libass
Published: 2017-03-03
File: libass/ass_render.c
Commit message: Fix line wrapping mode 0/3 bugs

This fixes two separate bugs:

a) Don't move a linebreak into the first symbol. This results in a empty
   line at the front, which does not help to equalize line lengths at all.
   Instead, merge line with the second one.
b) When moving a linebreak into a symbol that already is a break, the
   number of lines must be decremented. Otherwise, uninitialized memory
   is possibly used for later layout operations.

Found by fuzzer test case
id:000085,sig:11,src:003377+003350,op:splice,rep:8.

This might also affect and hopefully fix libass#229.

v2: change semantics according to review
Commit author: Grigori Goronzy

Vulnerable version (before fix):
 wrap_lines_smart(ASS_Renderer *render_priv, double max_text_width)                         (w->bbox.xMin + w->pos.x));                      if (DIFF(l1_new, l2_new) < DIFF(l1, l2)) {                         w->linebreak = 1;                         s2->linebreak = 0;                         exit = 0;                     }

Fixed version (after fix):
 wrap_lines_smart(ASS_Renderer *render_priv, double max_text_width)                         (w->bbox.xMin + w->pos.x));                      if (DIFF(l1_new, l2_new) < DIFF(l1, l2)) {                         if (w->linebreak || w == text_info->glyphs)                             text_info->n_lines--;                         if (w != text_info->glyphs)                             w->linebreak = 1;                         s2->linebreak = 0;                         exit = 0;                     }

Patch:
patch: @@ -1608,7 +1608,10 @@ wrap_lines_smart(ASS_Renderer *render_priv, double max_text_width)
                         (w->bbox.xMin + w->pos.x));
 
                     if (DIFF(l1_new, l2_new) < DIFF(l1, l2)) {
-                        w->linebreak = 1;
+                        if (w->linebreak || w == text_info->glyphs)
+                            text_info->n_lines--;
+                        if (w != text_info->glyphs)
+                            w->linebreak = 1;
                         s2->linebreak = 0;
                         exit = 0;
                     }
path: libass/ass_render.c
Vulnerability: Buffer overflow in the calc_coeff function in libass/ass_blur.c in libass before 0.13.4 allows remote attackers to cause a denial of service via unspecified vectors.
Vulnerability ID: CVE-2016-7970
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/libass/libass
Published: 2017-03-03
File: libass/ass_blur.c
Commit message: Fix blur coefficient calculation buffer overflow

Found by fuzzer test case id:000082,sig:11,src:002579,op:havoc,rep:8.
Correctness should be checked, but this fixes the overflow for good.
Commit author: Grigori Goronzy

Vulnerable version (before fix):
 static void calc_coeff(double mu[4], const int index[4], int prefilter, double r         (  17 -  126 * mul +  273 * mul2 -  164 * mul3) / 12096,     };      double mat_freq[13];     memcpy(mat_freq, kernel, sizeof(kernel));     memset(mat_freq + 4, 0, sizeof(mat_freq) - sizeof(kernel));     int n = 6;

Fixed version (after fix):
 static void calc_coeff(double mu[4], const int index[4], int prefilter, double r         (  17 -  126 * mul +  273 * mul2 -  164 * mul3) / 12096,     };      double mat_freq[14];     memcpy(mat_freq, kernel, sizeof(kernel));     memset(mat_freq + 4, 0, sizeof(mat_freq) - sizeof(kernel));     int n = 6;

Patch:
patch: @@ -744,7 +744,7 @@ static void calc_coeff(double mu[4], const int index[4], int prefilter, double r
         (  17 -  126 * mul +  273 * mul2 -  164 * mul3) / 12096,
     };
 
-    double mat_freq[13];
+    double mat_freq[14];
     memcpy(mat_freq, kernel, sizeof(kernel));
     memset(mat_freq + 4, 0, sizeof(mat_freq) - sizeof(kernel));
     int n = 6;
path: libass/ass_blur.c
Vulnerability: The check_allocations function in libass/ass_shaper.c in libass before 0.13.4 allows remote attackers to cause a denial of service (memory allocation failure) via unspecified vectors.
Vulnerability ID: CVE-2016-7972
CWE: CWE-399
Severity score: 2.9
Project: https://github.com/libass/libass
Published: 2017-03-03
File: libass/ass_shaper.c
Commit message: shaper: fix reallocation

Update the variable that tracks the allocated size. This potentially
improves performance and avoid some side effects, which lead to
undefined behavior in some cases.

Fixes fuzzer test case id:000051,sig:11,sync:fuzzer3,src:004221.
Commit author: Grigori Goronzy

Vulnerable version (before fix):
 static bool check_allocations(ASS_Shaper *shaper, size_t new_size)             !ASS_REALLOC_ARRAY(shaper->emblevels, new_size) ||             !ASS_REALLOC_ARRAY(shaper->cmap, new_size))             return false;     }     return true; }

Fixed version (after fix):
 static bool check_allocations(ASS_Shaper *shaper, size_t new_size)             !ASS_REALLOC_ARRAY(shaper->emblevels, new_size) ||             !ASS_REALLOC_ARRAY(shaper->cmap, new_size))             return false;         shaper->n_glyphs = new_size;     }     return true; }

Patch:
patch: @@ -100,6 +100,7 @@ static bool check_allocations(ASS_Shaper *shaper, size_t new_size)
             !ASS_REALLOC_ARRAY(shaper->emblevels, new_size) ||
             !ASS_REALLOC_ARRAY(shaper->cmap, new_size))
             return false;
+        shaper->n_glyphs = new_size;
     }
     return true;
 }
path: libass/ass_shaper.c
Vulnerability: The x86_decode_insn function in arch/x86/kvm/emulate.c in the Linux kernel before 4.8.7, when KVM is enabled, allows local users to cause a denial of service (host OS crash) via a certain use of a ModR/M byte in an undefined instruction.
Vulnerability ID: CVE-2016-8630
CWE: CWE-476
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2016-11-28
File: arch/x86/kvm/emulate.c
Commit message: kvm: x86: Check memopp before dereference (CVE-2016-8630)

Commit 41061cdb98 ("KVM: emulate: do not initialize memopp") removes a
check for non-NULL under incorrect assumptions. An undefined instruction
with a ModR/M byte with Mod=0 and R/M-5 (e.g. 0xc7 0x15) will attempt
to dereference a null pointer here.

Fixes: 41061cdb98a0bec464278b4db8e894a3121671f5
Message-Id: <1477592752-126650-2-git-send-email-osh@google.com>
Signed-off-by: Owen Hofmann <osh@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Commit author: Owen Hofmann

Vulnerable version (before fix):
 int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len) 	/* Decode and fetch the destination operand: register or memory. */ 	rc = decode_operand(ctxt, &ctxt->dst, (ctxt->d >> DstShift) & OpMask);  	if (ctxt->rip_relative) 		ctxt->memopp->addr.mem.ea = address_mask(ctxt, 					ctxt->memopp->addr.mem.ea + ctxt->_eip); 

Fixed version (after fix):
 int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len) 	/* Decode and fetch the destination operand: register or memory. */ 	rc = decode_operand(ctxt, &ctxt->dst, (ctxt->d >> DstShift) & OpMask);  	if (ctxt->rip_relative && likely(ctxt->memopp)) 		ctxt->memopp->addr.mem.ea = address_mask(ctxt, 					ctxt->memopp->addr.mem.ea + ctxt->_eip); 

Patch:
patch: @@ -5045,7 +5045,7 @@ int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len)
 	/* Decode and fetch the destination operand: register or memory. */
 	rc = decode_operand(ctxt, &ctxt->dst, (ctxt->d >> DstShift) & OpMask);
 
-	if (ctxt->rip_relative)
+	if (ctxt->rip_relative && likely(ctxt->memopp))
 		ctxt->memopp->addr.mem.ea = address_mask(ctxt,
 					ctxt->memopp->addr.mem.ea + ctxt->_eip);
path: arch/x86/kvm/emulate.c
Vulnerability: Integer overflow in the mem_check_range function in drivers/infiniband/sw/rxe/rxe_mr.c in the Linux kernel before 4.9.10 allows local users to cause a denial of service (memory corruption), obtain sensitive information from kernel memory, or possibly have unspecified other impact via a write or read request involving the "RDMA protocol over infiniband" (aka Soft RoCE) technology.
Vulnerability ID: CVE-2016-8636
CWE: CWE-190
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2017-02-22
File: drivers/infiniband/sw/rxe/rxe_mr.c
Commit message: IB/rxe: Fix mem_check_range integer overflow

Update the range check to avoid integer-overflow in edge case.
Resolves CVE 2016-8636.

Signed-off-by: Eyal Itkin <eyal.itkin@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Commit author: Eyal Itkin

Vulnerable version (before fix):
 int mem_check_range(struct rxe_mem *mem, u64 iova, size_t length)  	case RXE_MEM_TYPE_MR: 	case RXE_MEM_TYPE_FMR: 		return ((iova < mem->iova) || 			((iova + length) > (mem->iova + mem->length))) ? 			-EFAULT : 0;  	default: 		return -EFAULT;

Fixed version (after fix):
 int mem_check_range(struct rxe_mem *mem, u64 iova, size_t length)  	case RXE_MEM_TYPE_MR: 	case RXE_MEM_TYPE_FMR: 		if (iova < mem->iova || 		    length > mem->length || 		    iova > mem->iova + mem->length - length) 			return -EFAULT; 		return 0;  	default: 		return -EFAULT;

Patch:
patch: @@ -59,9 +59,11 @@ int mem_check_range(struct rxe_mem *mem, u64 iova, size_t length)
 
 	case RXE_MEM_TYPE_MR:
 	case RXE_MEM_TYPE_FMR:
-		return ((iova < mem->iova) ||
-			((iova + length) > (mem->iova + mem->length))) ?
-			-EFAULT : 0;
+		if (iova < mem->iova ||
+		    length > mem->length ||
+		    iova > mem->iova + mem->length - length)
+			return -EFAULT;
+		return 0;
 
 	default:
 		return -EFAULT;
path: drivers/infiniband/sw/rxe/rxe_mr.c
Vulnerability: The hash_accept function in crypto/algif_hash.c in the Linux kernel before 4.3.6 allows local users to cause a denial of service (OOPS) by attempting to trigger use of in-kernel hash algorithms for a socket that has received zero bytes of data.
Vulnerability ID: CVE-2016-8646
CWE: CWE-476
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2016-11-28
File: crypto/algif_hash.c
Commit message: crypto: algif_hash - Only export and import on sockets with data

The hash_accept call fails to work on sockets that have not received
any data.  For some algorithm implementations it may cause crashes.

This patch fixes this by ensuring that we only export and import on
sockets that have received data.

Cc: stable@vger.kernel.org
Reported-by: Harsh Jain <harshjain.prof@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Tested-by: Stephan Mueller <smueller@chronox.de>
Commit author: Herbert Xu

Vulnerable version (before fix):
 static int hash_accept(struct socket *sock, struct socket *newsock, int flags) 	struct sock *sk2; 	struct alg_sock *ask2; 	struct hash_ctx *ctx2; 	int err;  	err = crypto_ahash_export(req, state); 	if (err) 		return err;  static int hash_accept(struct socket *sock, struct socket *newsock, int flags) 	sk2 = newsock->sk; 	ask2 = alg_sk(sk2); 	ctx2 = ask2->private; 	ctx2->more = 1;  	err = crypto_ahash_import(&ctx2->req, state); 	if (err) {

Fixed version (after fix):
 static int hash_accept(struct socket *sock, struct socket *newsock, int flags) 	struct sock *sk2; 	struct alg_sock *ask2; 	struct hash_ctx *ctx2; 	bool more; 	int err;  	lock_sock(sk); 	more = ctx->more; 	err = more ? crypto_ahash_export(req, state) : 0; 	release_sock(sk);  	if (err) 		return err;  static int hash_accept(struct socket *sock, struct socket *newsock, int flags) 	sk2 = newsock->sk; 	ask2 = alg_sk(sk2); 	ctx2 = ask2->private; 	ctx2->more = more;  	if (!more) 		return err;  	err = crypto_ahash_import(&ctx2->req, state); 	if (err) {

Patch:
patch: @@ -181,9 +181,14 @@ static int hash_accept(struct socket *sock, struct socket *newsock, int flags)
 	struct sock *sk2;
 	struct alg_sock *ask2;
 	struct hash_ctx *ctx2;
+	bool more;
 	int err;
 
-	err = crypto_ahash_export(req, state);
+	lock_sock(sk);
+	more = ctx->more;
+	err = more ? crypto_ahash_export(req, state) : 0;
+	release_sock(sk);
+
 	if (err)
 		return err;
 
@@ -194,7 +199,10 @@ static int hash_accept(struct socket *sock, struct socket *newsock, int flags)
 	sk2 = newsock->sk;
 	ask2 = alg_sk(sk2);
 	ctx2 = ask2->private;
-	ctx2->more = 1;
+	ctx2->more = more;
+
+	if (!more)
+		return err;
 
 	err = crypto_ahash_import(&ctx2->req, state);
 	if (err) {
path: crypto/algif_hash.c
Vulnerability: Stack-based buffer overflow in the brcmf_cfg80211_start_ap function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel before 4.7.5 allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a long SSID Information Element in a command to a Netlink socket.
Vulnerability ID: CVE-2016-8658
CWE: CWE-119
Severity score: 7.8
Project: https://github.com/torvalds/linux
Published: 2016-10-16
File: drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
Commit message: brcmfmac: avoid potential stack overflow in brcmf_cfg80211_start_ap()

User-space can choose to omit NL80211_ATTR_SSID and only provide raw
IE TLV data. When doing so it can provide SSID IE with length exceeding
the allowed size. The driver further processes this IE copying it
into a local variable without checking the length. Hence stack can be
corrupted and used as exploit.

Cc: stable@vger.kernel.org # v4.7
Reported-by: Daxing Guo <freener.gdx@gmail.com>
Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Reviewed-by: Franky Lin <franky.lin@broadcom.com>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Commit author: Arend Van Spriel

Vulnerable version (before fix):
 brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev, 				(u8 *)&settings->beacon.head[ie_offset], 				settings->beacon.head_len - ie_offset, 				WLAN_EID_SSID); 		if (!ssid_ie) 			return -EINVAL;  		memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);

Fixed version (after fix):
 brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev, 				(u8 *)&settings->beacon.head[ie_offset], 				settings->beacon.head_len - ie_offset, 				WLAN_EID_SSID); 		if (!ssid_ie || ssid_ie->len > IEEE80211_MAX_SSID_LEN) 			return -EINVAL;  		memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);

Patch:
patch: @@ -4527,7 +4527,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
 				(u8 *)&settings->beacon.head[ie_offset],
 				settings->beacon.head_len - ie_offset,
 				WLAN_EID_SSID);
-		if (!ssid_ie)
+		if (!ssid_ie || ssid_ie->len > IEEE80211_MAX_SSID_LEN)
 			return -EINVAL;
 
 		memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);
path: drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
Vulnerability: Integer signedness error in the dynamicGetbuf function in gd_io_dp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted imagecreatefromstring call.
Vulnerability ID: CVE-2016-8670
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/libgd/libgd
Published: 2017-01-04
File: src/gd_io_dp.c
Commit message: Avoid potentially dangerous signed to unsigned conversion

We make sure to never pass a negative `rlen` as size to memcpy(). See
also <https://bugs.php.net/bug.php?id=73280>.

Patch provided by Emmanuel Law.
Commit author: Christoph M. Becker

Vulnerable version (before fix):
 static int dynamicGetbuf(gdIOCtxPtr ctx, void *buf, int len) 	if(remain >= len) { 		rlen = len; 	} else { 		if(remain == 0) { 			/* 2.0.34: EOF is incorrect. We use 0 for 			 * errors and EOF, just like fileGetbuf, 			 * which is a simple fread() wrapper.

Fixed version (after fix):
 static int dynamicGetbuf(gdIOCtxPtr ctx, void *buf, int len) 	if(remain >= len) { 		rlen = len; 	} else { 		if(remain <= 0) { 			/* 2.0.34: EOF is incorrect. We use 0 for 			 * errors and EOF, just like fileGetbuf, 			 * which is a simple fread() wrapper.

Patch:
patch: @@ -276,7 +276,7 @@ static int dynamicGetbuf(gdIOCtxPtr ctx, void *buf, int len)
 	if(remain >= len) {
 		rlen = len;
 	} else {
-		if(remain == 0) {
+		if(remain <= 0) {
 			/* 2.0.34: EOF is incorrect. We use 0 for
 			 * errors and EOF, just like fileGetbuf,
 			 * which is a simple fread() wrapper.
path: src/gd_io_dp.c