rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html.
Vulnerability ID: CVE-2021-33295
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/laurent22/joplin
Published: 2022-06-16
File: packages/renderer/htmlUtils.ts
Commit message: All: Security: Filter out NOSCRIPT tags that could be used to cause an XSS (thanks to Jubair Rehman for the PoC)
Commit author: Laurent Cozic

Vulnerable version (before fix):
 class HtmlUtils { 		return output.join('').replace(/\s+/g, ' '); 	}  	sanitizeHtml(html: string, options: any = null) { 		options = Object.assign({}, { 			// If true, adds a "jop-noMdConv" class to all the tags. 			// It can be used afterwards to restore HTML tags in Markdown. class HtmlUtils { 		// "link" can be used to escape the parser and inject JavaScript. 		// Adding "meta" too for the same reason as it shouldn't be used in 		// notes anyway. 		const disallowedTags = ['script', 'iframe', 'frameset', 'frame', 'object', 'base', 'embed', 'link', 'meta'];  		const parser = new htmlparser2.Parser({ 

Fixed version (after fix):
 class HtmlUtils { 		return output.join('').replace(/\s+/g, ' '); 	}  	public sanitizeHtml(html: string, options: any = null) { 		options = Object.assign({}, { 			// If true, adds a "jop-noMdConv" class to all the tags. 			// It can be used afterwards to restore HTML tags in Markdown. class HtmlUtils { 		// "link" can be used to escape the parser and inject JavaScript. 		// Adding "meta" too for the same reason as it shouldn't be used in 		// notes anyway. 		const disallowedTags = ['script', 'iframe', 'frameset', 'frame', 'object', 'base', 'embed', 'link', 'meta', 'noscript'];  		const parser = new htmlparser2.Parser({ 

Patch:
patch: @@ -133,7 +133,7 @@ class HtmlUtils {
 		return output.join('').replace(/\s+/g, ' ');
 	}
 
-	sanitizeHtml(html: string, options: any = null) {
+	public sanitizeHtml(html: string, options: any = null) {
 		options = Object.assign({}, {
 			// If true, adds a "jop-noMdConv" class to all the tags.
 			// It can be used afterwards to restore HTML tags in Markdown.
@@ -158,7 +158,7 @@ class HtmlUtils {
 		// "link" can be used to escape the parser and inject JavaScript.
 		// Adding "meta" too for the same reason as it shouldn't be used in
 		// notes anyway.
-		const disallowedTags = ['script', 'iframe', 'frameset', 'frame', 'object', 'base', 'embed', 'link', 'meta'];
+		const disallowedTags = ['script', 'iframe', 'frameset', 'frame', 'object', 'base', 'embed', 'link', 'meta', 'noscript'];
 
 		const parser = new htmlparser2.Parser({
path: packages/renderer/htmlUtils.ts
Vulnerability: Stack buffer overflow in the hevc_parse_vps_extension function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file.
Vulnerability ID: CVE-2021-33362
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/gpac/gpac
Published: 2021-09-13
File: src/media_tools/av_parsers.c
Commit message: fixed #1780 (fuzz)
Commit author: jeanlf

Vulnerable version (before fix):
 static Bool hevc_parse_vps_extension(HEVC_VPS *vps, GF_BitStream *bs) 	} 	vps->num_output_layer_sets = num_add_olss + NumLayerSets;   	layer_set_idx_for_ols_minus1[0] = 1; 	vps->output_layer_flag[0][0] = 1;

Fixed version (after fix):
 static Bool hevc_parse_vps_extension(HEVC_VPS *vps, GF_BitStream *bs) 	} 	vps->num_output_layer_sets = num_add_olss + NumLayerSets;  	if (vps->num_output_layer_sets > MAX_LHVC_LAYERS) { 		GF_LOG(GF_LOG_ERROR, GF_LOG_CODING, ("[HEVC] Wrong number of output layer sets in VPS %d, max %d supported\n", vps->num_output_layer_sets, MAX_LHVC_LAYERS)); 		vps->num_output_layer_sets = 1; 		return GF_FALSE; 	}  	layer_set_idx_for_ols_minus1[0] = 1; 	vps->output_layer_flag[0][0] = 1;

Patch:
patch: @@ -7475,6 +7475,11 @@ static Bool hevc_parse_vps_extension(HEVC_VPS *vps, GF_BitStream *bs)
 	}
 	vps->num_output_layer_sets = num_add_olss + NumLayerSets;
 
+	if (vps->num_output_layer_sets > MAX_LHVC_LAYERS) {
+		GF_LOG(GF_LOG_ERROR, GF_LOG_CODING, ("[HEVC] Wrong number of output layer sets in VPS %d, max %d supported\n", vps->num_output_layer_sets, MAX_LHVC_LAYERS));
+		vps->num_output_layer_sets = 1;
+		return GF_FALSE;
+	}
 
 	layer_set_idx_for_ols_minus1[0] = 1;
 	vps->output_layer_flag[0][0] = 1;
path: src/media_tools/av_parsers.c
Vulnerability: Memory leak in the infe_box_read function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
Vulnerability ID: CVE-2021-33363
CWE: CWE-401
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2021-09-13
File: src/isomedia/box_code_meta.c
Commit message: fixed #1786 (fuzz)
Commit author: jeanlf

Vulnerable version (before fix):
 GF_Err infe_box_read(GF_Box *s, GF_BitStream *bs) 				ptr->content_type = (char*)gf_malloc(sizeof(char)*string_len); 				if (!ptr->content_type) return GF_OUT_OF_MEM; 				memcpy(ptr->content_type, buf+string_start, string_len); 			} else { 				ptr->content_encoding = (char*)gf_malloc(sizeof(char)*string_len); 				if (!ptr->content_encoding) return GF_OUT_OF_MEM; 				memcpy(ptr->content_encoding, buf+string_start, string_len); 			} 			string_start += string_len; 			string_len = 0;

Fixed version (after fix):
 GF_Err infe_box_read(GF_Box *s, GF_BitStream *bs) 				ptr->content_type = (char*)gf_malloc(sizeof(char)*string_len); 				if (!ptr->content_type) return GF_OUT_OF_MEM; 				memcpy(ptr->content_type, buf+string_start, string_len); 			} else if (!ptr->content_encoding) { 				ptr->content_encoding = (char*)gf_malloc(sizeof(char)*string_len); 				if (!ptr->content_encoding) return GF_OUT_OF_MEM; 				memcpy(ptr->content_encoding, buf+string_start, string_len); 			} else { 				//we could throw an error but we silently accept this infe 				break; 			} 			string_start += string_len; 			string_len = 0;

Patch:
patch: @@ -566,10 +566,13 @@ GF_Err infe_box_read(GF_Box *s, GF_BitStream *bs)
 				ptr->content_type = (char*)gf_malloc(sizeof(char)*string_len);
 				if (!ptr->content_type) return GF_OUT_OF_MEM;
 				memcpy(ptr->content_type, buf+string_start, string_len);
-			} else {
+			} else if (!ptr->content_encoding) {
 				ptr->content_encoding = (char*)gf_malloc(sizeof(char)*string_len);
 				if (!ptr->content_encoding) return GF_OUT_OF_MEM;
 				memcpy(ptr->content_encoding, buf+string_start, string_len);
+			} else {
+				//we could throw an error but we silently accept this infe
+				break;
 			}
 			string_start += string_len;
 			string_len = 0;
path: src/isomedia/box_code_meta.c
Vulnerability: Memory leak in the def_parent_box_new function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
Vulnerability ID: CVE-2021-33364
CWE: CWE-401
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2021-09-13
File: src/isomedia/isom_intern.c
Commit message: fixed #1783 (fuzz)
Commit author: jeanlf

Vulnerable version (before fix):
 static GF_Err gf_isom_parse_movie_boxes_internal(GF_ISOFile *mov, u32 *boxType, 					if (pos<0) pos=0; 					gf_list_insert(mov->TopBoxes, brand, pos); 				} 			} 			break; 

Fixed version (after fix):
 static GF_Err gf_isom_parse_movie_boxes_internal(GF_ISOFile *mov, u32 *boxType, 					if (pos<0) pos=0; 					gf_list_insert(mov->TopBoxes, brand, pos); 				} 				gf_isom_box_del(a); 			} 			break; 

Patch:
patch: @@ -497,6 +497,7 @@ static GF_Err gf_isom_parse_movie_boxes_internal(GF_ISOFile *mov, u32 *boxType,
 					if (pos<0) pos=0;
 					gf_list_insert(mov->TopBoxes, brand, pos);
 				}
+				gf_isom_box_del(a);
 			}
 			break;
path: src/isomedia/isom_intern.c
Vulnerability: Memory leak in the gf_isom_get_root_od function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
Vulnerability ID: CVE-2021-33365
CWE: CWE-401
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2021-09-13
File: src/isomedia/isom_read.c
Commit message: fixed #1784 (fuzz)
Commit author: jeanlf

Vulnerable version (before fix):
 GF_Descriptor *gf_isom_get_root_od(GF_ISOFile *movie)  	//duplicate our descriptor 	movie->LastError = gf_odf_desc_copy((GF_Descriptor *) movie->moov->iods->descriptor, &desc); 	if (movie->LastError) return NULL;  	if (!useIOD) { 		isom_od = (GF_IsomObjectDescriptor *)desc;

Fixed version (after fix):
 GF_Descriptor *gf_isom_get_root_od(GF_ISOFile *movie)  	//duplicate our descriptor 	movie->LastError = gf_odf_desc_copy((GF_Descriptor *) movie->moov->iods->descriptor, &desc); 	if (movie->LastError) { 		if (od) { 			gf_list_del(od->ESDescriptors); 			gf_free(od); 		} 		if (iod) { 			gf_list_del(iod->ESDescriptors); 			gf_free(iod); 		} 		return NULL; 	}  	if (!useIOD) { 		isom_od = (GF_IsomObjectDescriptor *)desc;

Patch:
patch: @@ -694,7 +694,17 @@ GF_Descriptor *gf_isom_get_root_od(GF_ISOFile *movie)
 
 	//duplicate our descriptor
 	movie->LastError = gf_odf_desc_copy((GF_Descriptor *) movie->moov->iods->descriptor, &desc);
-	if (movie->LastError) return NULL;
+	if (movie->LastError) {
+		if (od) {
+			gf_list_del(od->ESDescriptors);
+			gf_free(od);
+		}
+		if (iod) {
+			gf_list_del(iod->ESDescriptors);
+			gf_free(iod);
+		}
+		return NULL;
+	}
 
 	if (!useIOD) {
 		isom_od = (GF_IsomObjectDescriptor *)desc;
path: src/isomedia/isom_read.c
Vulnerability: Memory leak in the gf_isom_oinf_read_entry function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
Vulnerability ID: CVE-2021-33366
CWE: CWE-401
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2021-09-13
File: src/isomedia/avc_ext.c
Commit message: fixed #1785 (fuzz)
Commit author: jeanlf

Vulnerable version (before fix):
 GF_Err gf_isom_oinf_read_entry(void *entry, GF_BitStream *bs) 		op->output_layer_set_idx = gf_bs_read_u16(bs); 		op->max_temporal_id = gf_bs_read_u8(bs); 		op->layer_count = gf_bs_read_u8(bs); 		if (op->layer_count > GF_ARRAY_LENGTH(op->layers_info)) 			return GF_NON_COMPLIANT_BITSTREAM; 		for (j = 0; j < op->layer_count; j++) { 			op->layers_info[j].ptl_idx = gf_bs_read_u8(bs); 			op->layers_info[j].layer_id = gf_bs_read_int(bs, 6);

Fixed version (after fix):
 GF_Err gf_isom_oinf_read_entry(void *entry, GF_BitStream *bs) 		op->output_layer_set_idx = gf_bs_read_u16(bs); 		op->max_temporal_id = gf_bs_read_u8(bs); 		op->layer_count = gf_bs_read_u8(bs); 		if (op->layer_count > GF_ARRAY_LENGTH(op->layers_info)) { 			gf_free(op); 			return GF_NON_COMPLIANT_BITSTREAM; 		} 		for (j = 0; j < op->layer_count; j++) { 			op->layers_info[j].ptl_idx = gf_bs_read_u8(bs); 			op->layers_info[j].layer_id = gf_bs_read_int(bs, 6);

Patch:
patch: @@ -3373,8 +3373,10 @@ GF_Err gf_isom_oinf_read_entry(void *entry, GF_BitStream *bs)
 		op->output_layer_set_idx = gf_bs_read_u16(bs);
 		op->max_temporal_id = gf_bs_read_u8(bs);
 		op->layer_count = gf_bs_read_u8(bs);
-		if (op->layer_count > GF_ARRAY_LENGTH(op->layers_info))
+		if (op->layer_count > GF_ARRAY_LENGTH(op->layers_info)) {
+			gf_free(op);
 			return GF_NON_COMPLIANT_BITSTREAM;
+		}
 		for (j = 0; j < op->layer_count; j++) {
 			op->layers_info[j].ptl_idx = gf_bs_read_u8(bs);
 			op->layers_info[j].layer_id = gf_bs_read_int(bs, 6);
path: src/isomedia/avc_ext.c
Vulnerability: There is a heap overflow problem in video/SDL_pixels.c in SDL (Simple DirectMedia Layer) 2.x to 2.0.18 versions. By crafting a malicious .BMP file, an attacker can cause the application using this library to crash, denial of service or Code execution.
Vulnerability ID: CVE-2021-33657
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/libsdl-org/SDL
Published: 2022-04-01
File: src/video/SDL_pixels.c
Commit message: Always create a full 256-entry map in case color values are out of range

Fixes https://github.com/libsdl-org/SDL/issues/5042
Commit author: Sam Lantinga

Vulnerable version (before fix):
 Map1to1(SDL_Palette * src, SDL_Palette * dst, int *identical)         }         *identical = 0;     }     map = (Uint8 *) SDL_malloc(src->ncolors);     if (map == NULL) {         SDL_OutOfMemory();         return (NULL); Map1toN(SDL_PixelFormat * src, Uint8 Rmod, Uint8 Gmod, Uint8 Bmod, Uint8 Amod,     SDL_Palette *pal = src->palette;      bpp = ((dst->BytesPerPixel == 3) ? 4 : dst->BytesPerPixel);     map = (Uint8 *) SDL_malloc(pal->ncolors * bpp);     if (map == NULL) {         SDL_OutOfMemory();         return (NULL);

Fixed version (after fix):
 Map1to1(SDL_Palette * src, SDL_Palette * dst, int *identical)         }         *identical = 0;     }     map = (Uint8 *) SDL_calloc(256, sizeof(Uint8));     if (map == NULL) {         SDL_OutOfMemory();         return (NULL); Map1toN(SDL_PixelFormat * src, Uint8 Rmod, Uint8 Gmod, Uint8 Bmod, Uint8 Amod,     SDL_Palette *pal = src->palette;      bpp = ((dst->BytesPerPixel == 3) ? 4 : dst->BytesPerPixel);     map = (Uint8 *) SDL_calloc(256, bpp);     if (map == NULL) {         SDL_OutOfMemory();         return (NULL);

Patch:
patch: @@ -947,7 +947,7 @@ Map1to1(SDL_Palette * src, SDL_Palette * dst, int *identical)
         }
         *identical = 0;
     }
-    map = (Uint8 *) SDL_malloc(src->ncolors);
+    map = (Uint8 *) SDL_calloc(256, sizeof(Uint8));
     if (map == NULL) {
         SDL_OutOfMemory();
         return (NULL);
@@ -971,7 +971,7 @@ Map1toN(SDL_PixelFormat * src, Uint8 Rmod, Uint8 Gmod, Uint8 Bmod, Uint8 Amod,
     SDL_Palette *pal = src->palette;
 
     bpp = ((dst->BytesPerPixel == 3) ? 4 : dst->BytesPerPixel);
-    map = (Uint8 *) SDL_malloc(pal->ncolors * bpp);
+    map = (Uint8 *) SDL_calloc(256, bpp);
     if (map == NULL) {
         SDL_OutOfMemory();
         return (NULL);
path: src/video/SDL_pixels.c
Vulnerability: fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05.
Vulnerability ID: CVE-2021-33909
CWE: CWE-120
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2021-07-20
File: fs/seq_file.c
Commit message: seq_file: disallow extremely large seq buffer allocations

There is no reasonable need for a buffer larger than this, and it avoids
int overflow pitfalls.

Fixes: 058504edd026 ("fs/seq_file: fallback to vmalloc allocation")
Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Eric Sandeen

Vulnerable version (before fix):
 static void seq_set_overflow(struct seq_file *m)  static void *seq_buf_alloc(unsigned long size) { 	return kvmalloc(size, GFP_KERNEL_ACCOUNT); } 

Fixed version (after fix):
 static void seq_set_overflow(struct seq_file *m)  static void *seq_buf_alloc(unsigned long size) { 	if (unlikely(size > MAX_RW_COUNT)) 		return NULL;  	return kvmalloc(size, GFP_KERNEL_ACCOUNT); } 

Patch:
patch: @@ -32,6 +32,9 @@ static void seq_set_overflow(struct seq_file *m)
 
 static void *seq_buf_alloc(unsigned long size)
 {
+	if (unlikely(size > MAX_RW_COUNT))
+		return NULL;
+
 	return kvmalloc(size, GFP_KERNEL_ACCOUNT);
 }
path: fs/seq_file.c
Vulnerability: A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1.8.13 allows remote attackers to inject arbitrary JavaScript or HTML by importing a crafted pad.
Vulnerability ID: CVE-2021-34817
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/ether/etherpad-lite
Published: 2021-07-19
File: src/static/js/chat.js
Commit message: escape userId before setting it as HTML attribute
Commit author: webzwo0i

Vulnerable version (before fix):
 exports.chat = (() => {             'Replacing with "unknown". This may be a bug or a database corruption.');       }        const authorClass = `author-${msg.userId.replace(/[^a-y0-9]/g, (c) => {         if (c === '.') return '-';         return `z${c.charCodeAt(0)}z`;

Fixed version (after fix):
 exports.chat = (() => {             'Replacing with "unknown". This may be a bug or a database corruption.');       }        msg.userId = padutils.escapeHtml(msg.userId);       const authorClass = `author-${msg.userId.replace(/[^a-y0-9]/g, (c) => {         if (c === '.') return '-';         return `z${c.charCodeAt(0)}z`;

Patch:
patch: @@ -129,6 +129,7 @@ exports.chat = (() => {
             'Replacing with "unknown". This may be a bug or a database corruption.');
       }
 
+      msg.userId = padutils.escapeHtml(msg.userId);
       const authorClass = `author-${msg.userId.replace(/[^a-y0-9]/g, (c) => {
         if (c === '.') return '-';
         return `z${c.charCodeAt(0)}z`;
path: src/static/js/chat.js
Vulnerability: tsMuxer v2.6.16 was discovered to contain a heap-based buffer overflow via the function BitStreamReader::getCurVal in bitStream.h.
Vulnerability ID: CVE-2021-35344
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/justdan96/tsMuxer
Published: 2021-12-03
File: tsMuxer/hevc.cpp
Commit message: [bug] Buffer overflow when SEI payloadSize > bits left

Fixes #433 .
Commit author: jcdr428

Vulnerable version (before fix):
 int HevcHdrUnit::deserialize()                 nbyte = m_reader.getBits(8);                 payloadSize += nbyte;             }             if (payloadType == 137 && !isHDR10)  // mastering_display_colour_volume             {                 isHDR10 = true;

Fixed version (after fix):
 int HevcHdrUnit::deserialize()                 nbyte = m_reader.getBits(8);                 payloadSize += nbyte;             }             if (m_reader.getBitsLeft() < payloadSize * 8)             {                 LTRACE(LT_WARN, 2, "Bad SEI detected. SEI too short");                 return 1;             }             if (payloadType == 137 && !isHDR10)  // mastering_display_colour_volume             {                 isHDR10 = true;

Patch:
patch: @@ -979,6 +979,11 @@ int HevcHdrUnit::deserialize()
                 nbyte = m_reader.getBits(8);
                 payloadSize += nbyte;
             }
+            if (m_reader.getBitsLeft() < payloadSize * 8)
+            {
+                LTRACE(LT_WARN, 2, "Bad SEI detected. SEI too short");
+                return 1;
+            }
             if (payloadType == 137 && !isHDR10)  // mastering_display_colour_volume
             {
                 isHDR10 = true;
path: tsMuxer/hevc.cpp
Vulnerability: Fluent Bit (aka fluent-bit) 1.7.0 through 1.7,4 has a double free in flb_free (called from flb_parser_json_do and flb_parser_do).
Vulnerability ID: CVE-2021-36088
CWE: CWE-415
Severity score: 6.4
Project: https://github.com/fluent/fluent-bit
Published: 2021-07-01
File: src/flb_parser_json.c
Commit message: parser: json: fix double-free (#3453)

Signed-off-by: davkor <david@adalogics.com>
Commit author: DavidKorczynski

Vulnerable version (before fix):
 int flb_parser_json_do(struct flb_parser *parser,     *out_size = tmp_out_size;     if (mp_buf != tmp_out_buf) {         flb_free(mp_buf);     }      /* Do time resolution ? */ int flb_parser_json_do(struct flb_parser *parser,         /* Ensure the pointer we are about to read is not NULL */         if (k->via.str.ptr == NULL) {             flb_free(mp_buf);             *out_buf = NULL;             msgpack_unpacked_destroy(&result);             return -1;

Fixed version (after fix):
 int flb_parser_json_do(struct flb_parser *parser,     *out_size = tmp_out_size;     if (mp_buf != tmp_out_buf) {         flb_free(mp_buf);         mp_buf = NULL;     }      /* Do time resolution ? */ int flb_parser_json_do(struct flb_parser *parser,         /* Ensure the pointer we are about to read is not NULL */         if (k->via.str.ptr == NULL) {             flb_free(mp_buf);             flb_free(tmp_out_buf);             *out_buf = NULL;             msgpack_unpacked_destroy(&result);             return -1;

Patch:
patch: @@ -111,6 +111,7 @@ int flb_parser_json_do(struct flb_parser *parser,
     *out_size = tmp_out_size;
     if (mp_buf != tmp_out_buf) {
         flb_free(mp_buf);
+        mp_buf = NULL;
     }
 
     /* Do time resolution ? */
@@ -141,6 +142,7 @@ int flb_parser_json_do(struct flb_parser *parser,
         /* Ensure the pointer we are about to read is not NULL */
         if (k->via.str.ptr == NULL) {
             flb_free(mp_buf);
+            flb_free(tmp_out_buf);
             *out_buf = NULL;
             msgpack_unpacked_destroy(&result);
             return -1;
path: src/flb_parser_json.c
Vulnerability: A heap-based buffer overflow vulnerability was found in ImageMagick in versions prior to 7.0.11-14 in ReadTIFFImage() in coders/tiff.c. This issue is due to an incorrect setting of the pixel array size, which can lead to a crash and segmentation fault.
Vulnerability ID: CVE-2021-3610
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2022-02-24
File: coders/tiff.c
Commit message: eliminate heap buffer overflow vulnerability, thanks to ZhangJiaxing (@r0fm1a) from Codesafe Team of Legendsec at Qi'anxin Group
Commit author: Cristy

Vulnerable version (before fix):
 static Image *ReadTIFFImage(const ImageInfo *image_info,         /*           Convert stripped TIFF image.         */         extent=2*TIFFStripSize(tiff); #if defined(TIFF_VERSION_BIG)         extent+=image->columns*sizeof(uint64); #else

Fixed version (after fix):
 static Image *ReadTIFFImage(const ImageInfo *image_info,         /*           Convert stripped TIFF image.         */         extent=4*TIFFStripSize(tiff); #if defined(TIFF_VERSION_BIG)         extent+=image->columns*sizeof(uint64); #else

Patch:
patch: @@ -1894,7 +1894,7 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
         /*
           Convert stripped TIFF image.
         */
-        extent=2*TIFFStripSize(tiff);
+        extent=4*TIFFStripSize(tiff);
 #if defined(TIFF_VERSION_BIG)
         extent+=image->columns*sizeof(uint64);
 #else
path: coders/tiff.c
Vulnerability: ACRN before 2.5 has a hw/pci/virtio/virtio.c vq_endchains NULL Pointer Dereference.
Vulnerability ID: CVE-2021-36143
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/projectacrn/acrn-hypervisor
Published: 2021-07-02
File: devicemodel/hw/pci/virtio/virtio.c
Commit message: dm: validate inputs in vq_endchains

 inputs shall be validated to avoid NULL pointer access.

Tracked-On: #6129
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Commit author: Yonghua Huang

Vulnerable version (before fix):
 vq_endchains(struct virtio_vq_info *vq, int used_all_avail) 	uint16_t event_idx, new_idx, old_idx; 	int intr;  	/* 	 * Interrupt generation: if we're using EVENT_IDX, 	 * interrupt if we've crossed the event threshold.

Fixed version (after fix):
 vq_endchains(struct virtio_vq_info *vq, int used_all_avail) 	uint16_t event_idx, new_idx, old_idx; 	int intr;  	if (!vq || !vq->used) 		return;  	/* 	 * Interrupt generation: if we're using EVENT_IDX, 	 * interrupt if we've crossed the event threshold.

Patch:
patch: @@ -647,6 +647,9 @@ vq_endchains(struct virtio_vq_info *vq, int used_all_avail)
 	uint16_t event_idx, new_idx, old_idx;
 	int intr;
 
+	if (!vq || !vq->used)
+		return;
+
 	/*
 	 * Interrupt generation: if we're using EVENT_IDX,
 	 * interrupt if we've crossed the event threshold.
path: devicemodel/hw/pci/virtio/virtio.c