rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Ming (aka libming) 0.4.8 has a heap buffer overflow and underflow in the decompileCAST function in util/decompile.c in libutil.a. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted SWF file.
Vulnerability ID: CVE-2019-12982
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/libming/libming
Published: 2019-06-26
File: util/decompile.c
Commit message: decompileAction: Prevent heap buffer overflow and underflow with using OpCode
Commit author: Young Xiao

Vulnerable version (before fix):
 decompileCAST(int n, SWF_ACTION *actions, int maxn) int decompileAction(int n, SWF_ACTION *actions, int maxn) { 	if( n > maxn ) SWF_error("Action overflow!!");  #ifdef DEBUG 	fprintf(stderr,"%d:\tACTION[%3.3d]: %s\n", 	        actions[n].SWF_ACTIONRECORD.Offset, n,  	        actionName(actions[n].SWF_ACTIONRECORD.ActionCode)); #endif  	switch(actions[n].SWF_ACTIONRECORD.ActionCode) 	{ 	case SWFACTION_END: 		return 0;

Fixed version (after fix):
 decompileCAST(int n, SWF_ACTION *actions, int maxn) int decompileAction(int n, SWF_ACTION *actions, int maxn) {  #ifdef DEBUG 	fprintf(stderr,"%d:\tACTION[%3.3d]: %s\n", 	        actions[n].SWF_ACTIONRECORD.Offset, n,  	        actionName(actions[n].SWF_ACTIONRECORD.ActionCode)); #endif  	switch(OpCode(actions, n, maxn)) 	{ 	case SWFACTION_END: 		return 0;

Patch:
patch: @@ -3202,15 +3202,14 @@ decompileCAST(int n, SWF_ACTION *actions, int maxn)
 int
 decompileAction(int n, SWF_ACTION *actions, int maxn)
 {
-	if( n > maxn ) SWF_error("Action overflow!!");
 
 #ifdef DEBUG
 	fprintf(stderr,"%d:\tACTION[%3.3d]: %s\n",
 	        actions[n].SWF_ACTIONRECORD.Offset, n, 
 	        actionName(actions[n].SWF_ACTIONRECORD.ActionCode));
 #endif
 
-	switch(actions[n].SWF_ACTIONRECORD.ActionCode)
+	switch(OpCode(actions, n, maxn))
 	{
 	case SWFACTION_END:
 		return 0;
path: util/decompile.c
Vulnerability: A NULL pointer dereference vulnerability in the function nfc_genl_deactivate_target() in net/nfc/netlink.c in the Linux kernel before 5.1.13 can be triggered by a malicious user-mode program that omits certain NFC attributes, leading to denial of service.
Vulnerability ID: CVE-2019-12984
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2019-06-26
File: net/nfc/netlink.c
Commit message: nfc: Ensure presence of required attributes in the deactivate_target handler

Check that the NFC_ATTR_TARGET_INDEX attributes (in addition to
NFC_ATTR_DEVICE_INDEX) are provided by the netlink client prior to
accessing them. This prevents potential unhandled NULL pointer dereference
exceptions which can be triggered by malicious user-mode programs,
if they omit one or both of these attributes.

Signed-off-by: Young Xiao <92siuyang@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Young Xiao

Vulnerable version (before fix):
 static int nfc_genl_deactivate_target(struct sk_buff *skb, 	u32 device_idx, target_idx; 	int rc;  	if (!info->attrs[NFC_ATTR_DEVICE_INDEX]) 		return -EINVAL;  	device_idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]);

Fixed version (after fix):
 static int nfc_genl_deactivate_target(struct sk_buff *skb, 	u32 device_idx, target_idx; 	int rc;  	if (!info->attrs[NFC_ATTR_DEVICE_INDEX] || 	    !info->attrs[NFC_ATTR_TARGET_INDEX]) 		return -EINVAL;  	device_idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]);

Patch:
patch: @@ -911,7 +911,8 @@ static int nfc_genl_deactivate_target(struct sk_buff *skb,
 	u32 device_idx, target_idx;
 	int rc;
 
-	if (!info->attrs[NFC_ATTR_DEVICE_INDEX])
+	if (!info->attrs[NFC_ATTR_DEVICE_INDEX] ||
+	    !info->attrs[NFC_ATTR_TARGET_INDEX])
 		return -EINVAL;
 
 	device_idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]);
path: net/nfc/netlink.c
Vulnerability: An issue was discovered in mxGraph through 4.0.0, related to the "draw.io Diagrams" plugin before 8.3.14 for Confluence and other products. Improper input validation/sanitization of a color field leads to XSS. This is associated with javascript/examples/grapheditor/www/js/Dialogs.js.
Vulnerability ID: CVE-2019-13127
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/jgraph/mxgraph
Published: 2019-07-01
File: javascript/examples/grapheditor/www/js/Dialogs.js
Commit message: Added validation of input color codes
Commit author: David Benson

Vulnerable version (before fix):
 var ColorDialog = function(editorUi, color, apply, cancelFn) 	var applyBtn = mxUtils.button(mxResources.get('apply'), function() 	{ 		var color = input.value; 		ColorDialog.addRecentColor(color, 12); 		 		if (color != 'none' && color.charAt(0) != '#') 		{ 			color = '#' + color; 		}  		applyFunction(color); 		editorUi.hideDialog(); 	}); 	applyBtn.className = 'geBtn gePrimaryBtn';

Fixed version (after fix):
 var ColorDialog = function(editorUi, color, apply, cancelFn) 	var applyBtn = mxUtils.button(mxResources.get('apply'), function() 	{ 		var color = input.value; 		// https://stackoverflow.com/questions/8027423/how-to-check-if-a-string-is-a-valid-hex-color-representation/8027444 		var colorValid  = /(^#?[0-9A-F]{6}$)|(^#[0-9A-F]{3}$)/i.test(color); 		 		if (colorValid) 		{ 			ColorDialog.addRecentColor(color, 12); 			 			if (color != 'none' && color.charAt(0) != '#') 			{ 				color = '#' + color; 			}  			applyFunction(color);			 		}  		editorUi.hideDialog(); 	}); 	applyBtn.className = 'geBtn gePrimaryBtn';

Patch:
patch: @@ -204,14 +204,21 @@ var ColorDialog = function(editorUi, color, apply, cancelFn)
 	var applyBtn = mxUtils.button(mxResources.get('apply'), function()
 	{
 		var color = input.value;
-		ColorDialog.addRecentColor(color, 12);
+		// https://stackoverflow.com/questions/8027423/how-to-check-if-a-string-is-a-valid-hex-color-representation/8027444
+		var colorValid  = /(^#?[0-9A-F]{6}$)|(^#[0-9A-F]{3}$)/i.test(color);
 		
-		if (color != 'none' && color.charAt(0) != '#')
+		if (colorValid)
 		{
-			color = '#' + color;
+			ColorDialog.addRecentColor(color, 12);
+			
+			if (color != 'none' && color.charAt(0) != '#')
+			{
+				color = '#' + color;
+			}
+
+			applyFunction(color);			
 		}
 
-		applyFunction(color);
 		editorUi.hideDialog();
 	});
 	applyBtn.className = 'geBtn gePrimaryBtn';
path: javascript/examples/grapheditor/www/js/Dialogs.js
Vulnerability: An issue was discovered in mxGraph through 4.0.0, related to the "draw.io Diagrams" plugin before 8.3.14 for Confluence and other products. Improper input validation/sanitization of a color field leads to XSS. This is associated with javascript/examples/grapheditor/www/js/Dialogs.js.
Vulnerability ID: CVE-2019-13127
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/jgraph/mxgraph
Published: 2019-07-01
File: javascript/examples/grapheditor/www/js/Dialogs.js
Commit message: Added validation of input color codes
Commit author: David Benson

Vulnerable version (before fix):
 var ColorDialog = function(editorUi, color, apply, cancelFn) 	var applyBtn = mxUtils.button(mxResources.get('apply'), function() 	{ 		var color = input.value; 		ColorDialog.addRecentColor(color, 12); 		 		if (color != 'none' && color.charAt(0) != '#') 		{ 			color = '#' + color; 		}  		applyFunction(color); 		editorUi.hideDialog(); 	}); 	applyBtn.className = 'geBtn gePrimaryBtn';

Fixed version (after fix):
 var ColorDialog = function(editorUi, color, apply, cancelFn) 	var applyBtn = mxUtils.button(mxResources.get('apply'), function() 	{ 		var color = input.value; 		// https://stackoverflow.com/questions/8027423/how-to-check-if-a-string-is-a-valid-hex-color-representation/8027444 		var colorValid  = /(^#?[0-9A-F]{6}$)|(^#[0-9A-F]{3}$)/i.test(color); 		 		if (colorValid) 		{ 			ColorDialog.addRecentColor(color, 12); 			 			if (color != 'none' && color.charAt(0) != '#') 			{ 				color = '#' + color; 			}  			applyFunction(color);			 		}  		editorUi.hideDialog(); 	}); 	applyBtn.className = 'geBtn gePrimaryBtn';

Patch:
patch: @@ -204,14 +204,21 @@ var ColorDialog = function(editorUi, color, apply, cancelFn)
 	var applyBtn = mxUtils.button(mxResources.get('apply'), function()
 	{
 		var color = input.value;
-		ColorDialog.addRecentColor(color, 12);
+		// https://stackoverflow.com/questions/8027423/how-to-check-if-a-string-is-a-valid-hex-color-representation/8027444
+		var colorValid  = /(^#?[0-9A-F]{6}$)|(^#[0-9A-F]{3}$)/i.test(color);
 		
-		if (color != 'none' && color.charAt(0) != '#')
+		if (colorValid)
 		{
-			color = '#' + color;
+			ColorDialog.addRecentColor(color, 12);
+			
+			if (color != 'none' && color.charAt(0) != '#')
+			{
+				color = '#' + color;
+			}
+
+			applyFunction(color);			
 		}
 
-		applyFunction(color);
 		editorUi.hideDialog();
 	});
 	applyBtn.className = 'geBtn gePrimaryBtn';
path: javascript/examples/grapheditor/www/js/Dialogs.js
Vulnerability: ImageMagick before 7.0.8-50 has an integer overflow vulnerability in the function TIFFSeekCustomStream in coders/tiff.c.
Vulnerability ID: CVE-2019-13136
CWE: CWE-190
Severity score: 6.4
Project: https://github.com/ImageMagick/ImageMagick
Published: 2019-07-01
File: coders/tiff.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1602
Commit author: Cristy

Vulnerable version (before fix):
 static MagickOffsetType TIFFSeekCustomStream(const MagickOffsetType offset,     }     case SEEK_CUR:     {       if ((profile->offset+offset) < 0)         return(-1);       profile->offset+=offset;

Fixed version (after fix):
 static MagickOffsetType TIFFSeekCustomStream(const MagickOffsetType offset,     }     case SEEK_CUR:     {       if (((offset > 0) && (profile->offset > (SSIZE_MAX-offset))) ||           ((offset < 0) && (profile->offset < (-SSIZE_MAX-offset))))         {           errno=EOVERFLOW;           return(-1);         }       if ((profile->offset+offset) < 0)         return(-1);       profile->offset+=offset;

Patch:
patch: @@ -258,6 +258,12 @@ static MagickOffsetType TIFFSeekCustomStream(const MagickOffsetType offset,
     }
     case SEEK_CUR:
     {
+      if (((offset > 0) && (profile->offset > (SSIZE_MAX-offset))) ||
+          ((offset < 0) && (profile->offset < (-SSIZE_MAX-offset))))
+        {
+          errno=EOVERFLOW;
+          return(-1);
+        }
       if ((profile->offset+offset) < 0)
         return(-1);
       profile->offset+=offset;
path: coders/tiff.c
Vulnerability: A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.
Vulnerability ID: CVE-2019-13224
CWE: CWE-416
Severity score: 6.4
Project: https://github.com/kkos/oniguruma
Published: 2019-07-10
File: src/regext.c
Commit message: Fix CVE-2019-13224: don't allow different encodings for onig_new_deluxe()
Commit author: K.Kosako

Vulnerable version (before fix):
  #include "regint.h"  static void conv_ext0be32(const UChar* s, const UChar* end, UChar* conv) { conv_encoding(OnigEncoding from, OnigEncoding to, const UChar* s, const UChar* e    return ONIGERR_NOT_SUPPORTED_ENCODING_COMBINATION; }  extern int onig_new_deluxe(regex_t** reg, const UChar* pattern, const UChar* pattern_end, onig_new_deluxe(regex_t** reg, const UChar* pattern, const UChar* pattern_end,   if (IS_NOT_NULL(einfo)) einfo->par = (UChar* )NULL;    if (ci->pattern_enc != ci->target_enc) {     r = conv_encoding(ci->pattern_enc, ci->target_enc, pattern, pattern_end,                       &cpat, &cpat_end);     if (r != 0) return r;   }   else {     cpat     = (UChar* )pattern;

Fixed version (after fix):
  #include "regint.h"  #if 0 static void conv_ext0be32(const UChar* s, const UChar* end, UChar* conv) { conv_encoding(OnigEncoding from, OnigEncoding to, const UChar* s, const UChar* e    return ONIGERR_NOT_SUPPORTED_ENCODING_COMBINATION; } #endif  extern int onig_new_deluxe(regex_t** reg, const UChar* pattern, const UChar* pattern_end, onig_new_deluxe(regex_t** reg, const UChar* pattern, const UChar* pattern_end,   if (IS_NOT_NULL(einfo)) einfo->par = (UChar* )NULL;    if (ci->pattern_enc != ci->target_enc) {     return ONIGERR_NOT_SUPPORTED_ENCODING_COMBINATION;   }   else {     cpat     = (UChar* )pattern;

Patch:
patch: @@ -29,6 +29,7 @@
 
 #include "regint.h"
 
+#if 0
 static void
 conv_ext0be32(const UChar* s, const UChar* end, UChar* conv)
 {
@@ -158,6 +159,7 @@ conv_encoding(OnigEncoding from, OnigEncoding to, const UChar* s, const UChar* e
 
   return ONIGERR_NOT_SUPPORTED_ENCODING_COMBINATION;
 }
+#endif
 
 extern int
 onig_new_deluxe(regex_t** reg, const UChar* pattern, const UChar* pattern_end,
@@ -169,9 +171,7 @@ onig_new_deluxe(regex_t** reg, const UChar* pattern, const UChar* pattern_end,
   if (IS_NOT_NULL(einfo)) einfo->par = (UChar* )NULL;
 
   if (ci->pattern_enc != ci->target_enc) {
-    r = conv_encoding(ci->pattern_enc, ci->target_enc, pattern, pattern_end,
-                      &cpat, &cpat_end);
-    if (r != 0) return r;
+    return ONIGERR_NOT_SUPPORTED_ENCODING_COMBINATION;
   }
   else {
     cpat     = (UChar* )pattern;
path: src/regext.c
Vulnerability: ImageMagick 7.0.8-50 Q16 has direct memory leaks in AcquireMagickMemory because of an error in CLIListOperatorImages in MagickWand/operation.c for a NULL value.
Vulnerability ID: CVE-2019-13296
CWE: CWE-401
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2019-07-05
File: MagickWand/operation.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1604
Commit author: Cristy

Vulnerable version (before fix):
 WandPrivate MagickBooleanType CLIListOperatorImages(MagickCLI *cli_wand,           reconstruct_image=RemoveFirstImageFromList(&_images);           /* FUTURE - produce Exception, rather than silent fail */           if (reconstruct_image == (Image *) NULL)             break;           metric=UndefinedErrorMetric;           option=GetImageOption(_image_info,"metric");           if (option != (const char *) NULL)

Fixed version (after fix):
 WandPrivate MagickBooleanType CLIListOperatorImages(MagickCLI *cli_wand,           reconstruct_image=RemoveFirstImageFromList(&_images);           /* FUTURE - produce Exception, rather than silent fail */           if (reconstruct_image == (Image *) NULL)             {                image=DestroyImage(image);               break;             }           metric=UndefinedErrorMetric;           option=GetImageOption(_image_info,"metric");           if (option != (const char *) NULL)

Patch:
patch: @@ -3868,7 +3868,10 @@ WandPrivate MagickBooleanType CLIListOperatorImages(MagickCLI *cli_wand,
           reconstruct_image=RemoveFirstImageFromList(&_images);
           /* FUTURE - produce Exception, rather than silent fail */
           if (reconstruct_image == (Image *) NULL)
-            break;
+            { 
+              image=DestroyImage(image);
+              break;
+            }
           metric=UndefinedErrorMetric;
           option=GetImageOption(_image_info,"metric");
           if (option != (const char *) NULL)
path: MagickWand/operation.c
Vulnerability: ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.
Vulnerability ID: CVE-2019-13301
CWE: CWE-401
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2019-07-05
File: MagickCore/annotate.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1589
Commit author: Cristy

Vulnerable version (before fix):
 MagickExport MagickBooleanType AnnotateImage(Image *image,       number_lines++;   textlist=AcquireQuantumMemory(number_lines+1,sizeof(*textlist));   if (textlist == (char **) NULL)     return(MagickFalse);   p=text;   for (i=0; i < number_lines; i++)   { MagickExport MagickBooleanType AnnotateImage(Image *image,       (void) ParseGeometry(annotate_info->geometry,&geometry_info);     }   if (SetImageStorageClass(image,DirectClass,exception) == MagickFalse)     return(MagickFalse);   if (IsGrayColorspace(image->colorspace) != MagickFalse)     (void) SetImageColorspace(image,sRGBColorspace,exception);   status=MagickTrue;

Fixed version (after fix):
 MagickExport MagickBooleanType AnnotateImage(Image *image,       number_lines++;   textlist=AcquireQuantumMemory(number_lines+1,sizeof(*textlist));   if (textlist == (char **) NULL)     {       annotate_info=DestroyDrawInfo(annotate_info);       annotate=DestroyDrawInfo(annotate);       return(MagickFalse);     }   p=text;   for (i=0; i < number_lines; i++)   { MagickExport MagickBooleanType AnnotateImage(Image *image,       (void) ParseGeometry(annotate_info->geometry,&geometry_info);     }   if (SetImageStorageClass(image,DirectClass,exception) == MagickFalse)     {       annotate_info=DestroyDrawInfo(annotate_info);       annotate=DestroyDrawInfo(annotate);       textlist=(char **) RelinquishMagickMemory(textlist);       return(MagickFalse);     }   if (IsGrayColorspace(image->colorspace) != MagickFalse)     (void) SetImageColorspace(image,sRGBColorspace,exception);   status=MagickTrue;

Patch:
patch: @@ -274,7 +274,11 @@ MagickExport MagickBooleanType AnnotateImage(Image *image,
       number_lines++;
   textlist=AcquireQuantumMemory(number_lines+1,sizeof(*textlist));
   if (textlist == (char **) NULL)
-    return(MagickFalse);
+    {
+      annotate_info=DestroyDrawInfo(annotate_info);
+      annotate=DestroyDrawInfo(annotate);
+      return(MagickFalse);
+    }
   p=text;
   for (i=0; i < number_lines; i++)
   {
@@ -303,7 +307,12 @@ MagickExport MagickBooleanType AnnotateImage(Image *image,
       (void) ParseGeometry(annotate_info->geometry,&geometry_info);
     }
   if (SetImageStorageClass(image,DirectClass,exception) == MagickFalse)
-    return(MagickFalse);
+    {
+      annotate_info=DestroyDrawInfo(annotate_info);
+      annotate=DestroyDrawInfo(annotate);
+      textlist=(char **) RelinquishMagickMemory(textlist);
+      return(MagickFalse);
+    }
   if (IsGrayColorspace(image->colorspace) != MagickFalse)
     (void) SetImageColorspace(image,sRGBColorspace,exception);
   status=MagickTrue;
path: MagickCore/annotate.c
Vulnerability: ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/fourier.c in ComplexImages.
Vulnerability ID: CVE-2019-13302
CWE: CWE-125
Severity score: 6.4
Project: https://github.com/ImageMagick/ImageMagick
Published: 2019-07-05
File: MagickCore/fourier.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1597
Commit author: Cristy

Vulnerable version (before fix):
 MagickExport Image *ComplexImages(const Image *images,const ComplexOperator op,   MagickOffsetType     progress;    ssize_t     y;  MagickExport Image *ComplexImages(const Image *images,const ComplexOperator op,     }   Cr_image=complex_images;   Ci_image=complex_images->next;   Ar_view=AcquireVirtualCacheView(Ar_image,exception);   Ai_view=AcquireVirtualCacheView(Ai_image,exception);   Br_view=AcquireVirtualCacheView(Br_image,exception); MagickExport Image *ComplexImages(const Image *images,const ComplexOperator op,       register ssize_t         i;        for (i=0; i < (ssize_t) GetPixelChannels(Cr_image); i++)       {         switch (op)         {

Fixed version (after fix):
 MagickExport Image *ComplexImages(const Image *images,const ComplexOperator op,   MagickOffsetType     progress;    size_t     number_channels;    ssize_t     y;  MagickExport Image *ComplexImages(const Image *images,const ComplexOperator op,     }   Cr_image=complex_images;   Ci_image=complex_images->next;   number_channels=MagickMin(MagickMin(MagickMin(     Ar_image->number_channels,Ai_image->number_channels),MagickMin(     Br_image->number_channels,Bi_image->number_channels)),MagickMin(     Cr_image->number_channels,Ci_image->number_channels));   Ar_view=AcquireVirtualCacheView(Ar_image,exception);   Ai_view=AcquireVirtualCacheView(Ai_image,exception);   Br_view=AcquireVirtualCacheView(Br_image,exception); MagickExport Image *ComplexImages(const Image *images,const ComplexOperator op,       register ssize_t         i;        for (i=0; i < (ssize_t) number_channels; i++)       {         switch (op)         {

Patch:
patch: @@ -164,6 +164,9 @@ MagickExport Image *ComplexImages(const Image *images,const ComplexOperator op,
   MagickOffsetType
     progress;
 
+  size_t
+    number_channels;
+
   ssize_t
     y;
 
@@ -216,6 +219,10 @@ MagickExport Image *ComplexImages(const Image *images,const ComplexOperator op,
     }
   Cr_image=complex_images;
   Ci_image=complex_images->next;
+  number_channels=MagickMin(MagickMin(MagickMin(
+    Ar_image->number_channels,Ai_image->number_channels),MagickMin(
+    Br_image->number_channels,Bi_image->number_channels)),MagickMin(
+    Cr_image->number_channels,Ci_image->number_channels));
   Ar_view=AcquireVirtualCacheView(Ar_image,exception);
   Ai_view=AcquireVirtualCacheView(Ai_image,exception);
   Br_view=AcquireVirtualCacheView(Br_image,exception);
@@ -263,7 +270,7 @@ MagickExport Image *ComplexImages(const Image *images,const ComplexOperator op,
       register ssize_t
         i;
 
-      for (i=0; i < (ssize_t) GetPixelChannels(Cr_image); i++)
+      for (i=0; i < (ssize_t) number_channels; i++)
       {
         switch (op)
         {
path: MagickCore/fourier.c
Vulnerability: In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default.
Vulnerability ID: CVE-2019-14283
CWE: CWE-125
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2019-07-26
File: drivers/block/floppy.c
Commit message: floppy: fix out-of-bounds read in copy_buffer

This fixes a global out-of-bounds read access in the copy_buffer
function of the floppy driver.

The FDDEFPRM ioctl allows one to set the geometry of a disk.  The sect
and head fields (unsigned int) of the floppy_drive structure are used to
compute the max_sector (int) in the make_raw_rw_request function.  It is
possible to overflow the max_sector.  Next, max_sector is passed to the
copy_buffer function and used in one of the memcpy calls.

An unprivileged user could trigger the bug if the device is accessible,
but requires a floppy disk to be inserted.

The patch adds the check for the .sect * .head multiplication for not
overflowing in the set_geometry function.

The bug was found by syzkaller.

Signed-off-by: Denis Efremov <efremov@ispras.ru>
Tested-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Denis Efremov

Vulnerable version (before fix):
 static int set_geometry(unsigned int cmd, struct floppy_struct *g, 	int cnt;  	/* sanity checking for parameters. */ 	if (g->sect <= 0 || 	    g->head <= 0 || 	    /* check for zero in F_SECT_PER_TRACK */ 	    (unsigned char)((g->sect << 2) >> FD_SIZECODE(g)) == 0 || 	    g->track <= 0 || g->track > UDP->tracks >> STRETCH(g) ||

Fixed version (after fix):
 static int set_geometry(unsigned int cmd, struct floppy_struct *g, 	int cnt;  	/* sanity checking for parameters. */ 	if ((int)g->sect <= 0 || 	    (int)g->head <= 0 || 	    /* check for overflow in max_sector */ 	    (int)(g->sect * g->head) <= 0 || 	    /* check for zero in F_SECT_PER_TRACK */ 	    (unsigned char)((g->sect << 2) >> FD_SIZECODE(g)) == 0 || 	    g->track <= 0 || g->track > UDP->tracks >> STRETCH(g) ||

Patch:
patch: @@ -3233,8 +3233,10 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
 	int cnt;
 
 	/* sanity checking for parameters. */
-	if (g->sect <= 0 ||
-	    g->head <= 0 ||
+	if ((int)g->sect <= 0 ||
+	    (int)g->head <= 0 ||
+	    /* check for overflow in max_sector */
+	    (int)(g->sect * g->head) <= 0 ||
 	    /* check for zero in F_SECT_PER_TRACK */
 	    (unsigned char)((g->sect << 2) >> FD_SIZECODE(g)) == 0 ||
 	    g->track <= 0 || g->track > UDP->tracks >> STRETCH(g) ||
path: drivers/block/floppy.c