rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asm_x86_nz.c may allow attackers to cause a denial of service (application crash via a stack-based buffer overflow) by crafting an input file, a related issue to CVE-2018-20456.
Vulnerability ID: CVE-2018-20455
CWE: CWE-787
Severity score: 2.9
Project: https://github.com/radare/radare2
Published: 2018-12-25
File: libr/asm/p/asm_x86_nz.c
Commit message: Fix #12372 and #12373 - Crash in x86 assembler (#12380)

0 ,0,[bP-bL-bP-bL-bL-r-bL-bP-bL-bL-
mov ,0,[ax+Bx-ax+Bx-ax+ax+Bx-ax+Bx--
leA ,0,[bP-bL-bL-bP-bL-bP-bL-60@bL-
leA ,0,[bP-bL-r-bP-bL-bP-bL-60@bL-
mov ,0,[ax+Bx-ax+Bx-ax+ax+Bx-ax+Bx--
Commit author: radare

Vulnerable version (before fix):
 static int parseOperand(RAsm *a, const char *str, Operand *op, bool isrepop) { 			if (last_type == TT_SPECIAL) { 				if (str[pos] == '+' || str[pos] == '-' || str[pos] == ']') { 					if (reg != X86R_UNDEFINED) { 						op->regs[reg_index] = reg; 						op->scale[reg_index] = temp; 						++reg_index; 					} else { 						op->offset += temp; 						op->regs[reg_index] = X86R_UNDEFINED; 					}  					temp = 1; 					reg = X86R_UNDEFINED; 				} else if (str[pos] == '*') {

Fixed version (after fix):
 static int parseOperand(RAsm *a, const char *str, Operand *op, bool isrepop) { 			if (last_type == TT_SPECIAL) { 				if (str[pos] == '+' || str[pos] == '-' || str[pos] == ']') { 					if (reg != X86R_UNDEFINED) { 						if (reg_index < 2) { 							op->regs[reg_index] = reg; 							op->scale[reg_index] = temp; 						} 						++reg_index; 					} else { 						op->offset += temp; 						if (reg_index < 2) { 							op->regs[reg_index] = X86R_UNDEFINED; 						} 					} 					temp = 1; 					reg = X86R_UNDEFINED; 				} else if (str[pos] == '*') {

Patch:
patch: @@ -4575,14 +4575,17 @@ static int parseOperand(RAsm *a, const char *str, Operand *op, bool isrepop) {
 			if (last_type == TT_SPECIAL) {
 				if (str[pos] == '+' || str[pos] == '-' || str[pos] == ']') {
 					if (reg != X86R_UNDEFINED) {
-						op->regs[reg_index] = reg;
-						op->scale[reg_index] = temp;
+						if (reg_index < 2) {
+							op->regs[reg_index] = reg;
+							op->scale[reg_index] = temp;
+						}
 						++reg_index;
 					} else {
 						op->offset += temp;
-						op->regs[reg_index] = X86R_UNDEFINED;
+						if (reg_index < 2) {
+							op->regs[reg_index] = X86R_UNDEFINED;
+						}
 					}
-
 					temp = 1;
 					reg = X86R_UNDEFINED;
 				} else if (str[pos] == '*') {
path: libr/asm/p/asm_x86_nz.c
Vulnerability: In radare2 prior to 3.1.2, the parseOperands function in libr/asm/arch/arm/armass64.c allows attackers to cause a denial-of-service (application crash caused by stack-based buffer overflow) by crafting an input file.
Vulnerability ID: CVE-2018-20460
CWE: CWE-787
Severity score: 2.9
Project: https://github.com/radare/radare2
Published: 2018-12-25
File: libr/asm/arch/arm/armass64.c
Commit message: Fix #12376 - crash in: rasm2 -a arm -b 64 '0 ,0,0,0,0,0,0,'
Commit author: pancake

Vulnerable version (before fix):
 static bool parseOperands(char* str, ArmOp *op) { 		while (token[0] == ' ') { 			token++; 		} 		op->operands[operand].type = ARM_NOTYPE; 		op->operands[operand].reg_type = ARM_UNDEFINED; 		op->operands[operand].shift = ARM_NO_SHIFT;

Fixed version (after fix):
 static bool parseOperands(char* str, ArmOp *op) { 		while (token[0] == ' ') { 			token++; 		} 		if (operand >= MAX_OPERANDS) { 			eprintf ("Too many operands\n"); 			return false; 		} 		op->operands[operand].type = ARM_NOTYPE; 		op->operands[operand].reg_type = ARM_UNDEFINED; 		op->operands[operand].shift = ARM_NO_SHIFT;

Patch:
patch: @@ -737,6 +737,10 @@ static bool parseOperands(char* str, ArmOp *op) {
 		while (token[0] == ' ') {
 			token++;
 		}
+		if (operand >= MAX_OPERANDS) {
+			eprintf ("Too many operands\n");
+			return false;
+		}
 		op->operands[operand].type = ARM_NOTYPE;
 		op->operands[operand].reg_type = ARM_UNDEFINED;
 		op->operands[operand].shift = ARM_NO_SHIFT;
path: libr/asm/arch/arm/armass64.c
Vulnerability: In radare2 prior to 3.1.1, core_anal_bytes in libr/core/cmd_anal.c allows attackers to cause a denial-of-service (application crash caused by out-of-bounds read) by crafting a binary file.
Vulnerability ID: CVE-2018-20461
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/radare/radare2
Published: 2018-12-25
File: libr/core/cmd_anal.c
Commit message: Fix #12375 - Crash in bd+ao (#12382)
Commit author: radare

Vulnerable version (before fix):
 static void core_anal_bytes(RCore *core, const ut8 *buf, int len, int nops, int 			} #endif 			printline ("bytes", NULL, 0); 			for (j = 0; j < size; j++) { 				r_cons_printf ("%02x", buf[j + idx]); 			} 			r_cons_newline (); 			if (op.val != UT64_MAX) 				printline ("val", "0x%08" PFMT64x "\n", op.val); 			if (op.ptr != UT64_MAX) 				printline ("ptr", "0x%08" PFMT64x "\n", op.ptr); 			if (op.refptr != -1) 				printline ("refptr", "%d\n", op.refptr); 			printline ("size", "%d\n", size); 			printline ("sign", "%s\n", r_str_bool (op.sign)); 			printline ("type", "%s\n", r_anal_optype_to_string (op.type));

Fixed version (after fix):
 static void core_anal_bytes(RCore *core, const ut8 *buf, int len, int nops, int 			} #endif 			printline ("bytes", NULL, 0); 			int minsz = R_MIN (len, size); 			minsz = R_MAX (minsz, 0); 			for (j = 0; j < minsz; j++) { 				ut8 ch = ((j + idx - 1) > minsz)? 0xff: buf[j + idx]; 				r_cons_printf ("%02x", ch); 			} 			r_cons_newline (); 			if (op.val != UT64_MAX) { 				printline ("val", "0x%08" PFMT64x "\n", op.val); 			} 			if (op.ptr != UT64_MAX) { 				printline ("ptr", "0x%08" PFMT64x "\n", op.ptr); 			} 			if (op.refptr != -1) { 				printline ("refptr", "%d\n", op.refptr); 			} 			printline ("size", "%d\n", size); 			printline ("sign", "%s\n", r_str_bool (op.sign)); 			printline ("type", "%s\n", r_anal_optype_to_string (op.type));

Patch:
patch: @@ -1568,16 +1568,22 @@ static void core_anal_bytes(RCore *core, const ut8 *buf, int len, int nops, int
 			}
 #endif
 			printline ("bytes", NULL, 0);
-			for (j = 0; j < size; j++) {
-				r_cons_printf ("%02x", buf[j + idx]);
+			int minsz = R_MIN (len, size);
+			minsz = R_MAX (minsz, 0);
+			for (j = 0; j < minsz; j++) {
+				ut8 ch = ((j + idx - 1) > minsz)? 0xff: buf[j + idx];
+				r_cons_printf ("%02x", ch);
 			}
 			r_cons_newline ();
-			if (op.val != UT64_MAX)
+			if (op.val != UT64_MAX) {
 				printline ("val", "0x%08" PFMT64x "\n", op.val);
-			if (op.ptr != UT64_MAX)
+			}
+			if (op.ptr != UT64_MAX) {
 				printline ("ptr", "0x%08" PFMT64x "\n", op.ptr);
-			if (op.refptr != -1)
+			}
+			if (op.refptr != -1) {
 				printline ("refptr", "%d\n", op.refptr);
+			}
 			printline ("size", "%d\n", size);
 			printline ("sign", "%s\n", r_str_bool (op.sign));
 			printline ("type", "%s\n", r_anal_optype_to_string (op.type));
path: libr/core/cmd_anal.c
Vulnerability: An issue was discovered in the Linux kernel before 4.18.11. The ipddp_ioctl function in drivers/net/appletalk/ipddp.c allows local users to obtain sensitive kernel address information by leveraging CAP_NET_ADMIN to read the ipddp_route dev and next fields via an SIOCFINDIPDDPRT ioctl call.
Vulnerability ID: CVE-2018-20511
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2018-12-27
File: drivers/net/appletalk/ipddp.c
Commit message: net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT

Fields ->dev and ->next of struct ipddp_route may be copied to
userspace on the SIOCFINDIPDDPRT ioctl. This is only accessible
to CAP_NET_ADMIN though. Let's manually copy the relevant fields
instead of using memcpy().

BugLink: http://blog.infosectcbr.com.au/2018/09/linux-kernel-infoleaks.html
Cc: Jann Horn <jannh@google.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Willy Tarreau

Vulnerable version (before fix):
 static int ipddp_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)                 case SIOCFINDIPDDPRT: 			spin_lock_bh(&ipddp_route_lock); 			rp = __ipddp_find_route(&rcp); 			if (rp) 				memcpy(&rcp2, rp, sizeof(rcp2)); 			spin_unlock_bh(&ipddp_route_lock);  			if (rp) {

Fixed version (after fix):
 static int ipddp_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)                 case SIOCFINDIPDDPRT: 			spin_lock_bh(&ipddp_route_lock); 			rp = __ipddp_find_route(&rcp); 			if (rp) { 				memset(&rcp2, 0, sizeof(rcp2)); 				rcp2.ip    = rp->ip; 				rcp2.at    = rp->at; 				rcp2.flags = rp->flags; 			} 			spin_unlock_bh(&ipddp_route_lock);  			if (rp) {

Patch:
patch: @@ -283,8 +283,12 @@ static int ipddp_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                 case SIOCFINDIPDDPRT:
 			spin_lock_bh(&ipddp_route_lock);
 			rp = __ipddp_find_route(&rcp);
-			if (rp)
-				memcpy(&rcp2, rp, sizeof(rcp2));
+			if (rp) {
+				memset(&rcp2, 0, sizeof(rcp2));
+				rcp2.ip    = rp->ip;
+				rcp2.at    = rp->at;
+				rcp2.flags = rp->flags;
+			}
 			spin_unlock_bh(&ipddp_route_lock);
 
 			if (rp) {
path: drivers/net/appletalk/ipddp.c
Vulnerability: There is an illegal READ memory access at caca/dither.c (function get_rgba_default) in libcaca 0.99.beta19 for the default bpp case.
Vulnerability ID: CVE-2018-20546
CWE: CWE-190
Severity score: 4.9
Project: https://github.com/cacalabs/libcaca
Published: 2018-12-28
File: caca/dither.c
Commit message: dither: fix integer multiplication overflow that caused crashes.

Fixes: #38 (CVE-2018-20546)
Fixes: #39 (CVE-2018-20547)
Commit author: Sam Hocevar

Vulnerable version (before fix):
  *  This library is free software. It comes without any warranty, to  *  the extent permitted by applicable law. You can redistribute it  *  and/or modify it under the terms of the Do What the Fuck You Want  *  to Public License, Version 2, as published by Sam Hocevar. See  *  http://www.wtfpl.net/ for more details.  */  /* enum color_mode struct caca_dither {     int bpp, has_palette, has_alpha;     int w, h, pitch;     int rmask, gmask, bmask, amask;     int rright, gright, bright, aright;     int rleft, gleft, bleft, aleft;

Fixed version (after fix):
  *  This library is free software. It comes without any warranty, to  *  the extent permitted by applicable law. You can redistribute it  *  and/or modify it under the terms of the Do What the Fuck You Want  *  to Public License, Version 2, as published by the WTFPL Task Force.  *  See http://www.wtfpl.net/ for more details.  */  /* enum color_mode struct caca_dither {     int bpp, has_palette, has_alpha;     size_t w, h, pitch;     int rmask, gmask, bmask, amask;     int rright, gright, bright, aright;     int rleft, gleft, bleft, aleft;

Patch:
patch: @@ -6,8 +6,8 @@
  *  This library is free software. It comes without any warranty, to
  *  the extent permitted by applicable law. You can redistribute it
  *  and/or modify it under the terms of the Do What the Fuck You Want
- *  to Public License, Version 2, as published by Sam Hocevar. See
- *  http://www.wtfpl.net/ for more details.
+ *  to Public License, Version 2, as published by the WTFPL Task Force.
+ *  See http://www.wtfpl.net/ for more details.
  */
 
 /*
@@ -116,7 +116,7 @@ enum color_mode
 struct caca_dither
 {
     int bpp, has_palette, has_alpha;
-    int w, h, pitch;
+    size_t w, h, pitch;
     int rmask, gmask, bmask, amask;
     int rright, gright, bright, aright;
     int rleft, gleft, bleft, aleft;
path: caca/dither.c
Vulnerability: LibVNC before 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was incomplete.
Vulnerability ID: CVE-2018-20749
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/LibVNC/libvncserver
Published: 2019-01-30
File: libvncserver/rfbserver.c
Commit message: Error out in rfbProcessFileTransferReadBuffer if length can not be allocated

re #273
Commit author: Christian Beier

Vulnerable version (before fix):
 char *rfbProcessFileTransferReadBuffer(rfbClientPtr cl, uint32_t length)     int   n=0;      FILEXFER_ALLOWED_OR_CLOSE_AND_RETURN("", cl, NULL);     /*     rfbLog("rfbProcessFileTransferReadBuffer(%dlen)\n", length);     */     if (length>0) {         buffer=malloc((uint64_t)length+1);         if (buffer!=NULL) {             if ((n = rfbReadExact(cl, (char *)buffer, length)) <= 0) {                 if (n != 0)

Fixed version (after fix):
 char *rfbProcessFileTransferReadBuffer(rfbClientPtr cl, uint32_t length)     int   n=0;      FILEXFER_ALLOWED_OR_CLOSE_AND_RETURN("", cl, NULL);      /*        We later alloc length+1, which might wrap around on 32-bit systems if length equals        0XFFFFFFFF, i.e. SIZE_MAX for 32-bit systems. On 64-bit systems, a length of 0XFFFFFFFF        will safely be allocated since this check will never trigger and malloc() can digest length+1        without problems as length is a uint32_t.     */     if(length == SIZE_MAX) { 	rfbErr("rfbProcessFileTransferReadBuffer: too big file transfer length requested: %u", (unsigned int)length); 	rfbCloseClient(cl); 	return NULL;     }      if (length>0) {         buffer=malloc((size_t)length+1);         if (buffer!=NULL) {             if ((n = rfbReadExact(cl, (char *)buffer, length)) <= 0) {                 if (n != 0)

Patch:
patch: @@ -1461,11 +1461,21 @@ char *rfbProcessFileTransferReadBuffer(rfbClientPtr cl, uint32_t length)
     int   n=0;
 
     FILEXFER_ALLOWED_OR_CLOSE_AND_RETURN("", cl, NULL);
+
     /*
-    rfbLog("rfbProcessFileTransferReadBuffer(%dlen)\n", length);
+       We later alloc length+1, which might wrap around on 32-bit systems if length equals
+       0XFFFFFFFF, i.e. SIZE_MAX for 32-bit systems. On 64-bit systems, a length of 0XFFFFFFFF
+       will safely be allocated since this check will never trigger and malloc() can digest length+1
+       without problems as length is a uint32_t.
     */
+    if(length == SIZE_MAX) {
+	rfbErr("rfbProcessFileTransferReadBuffer: too big file transfer length requested: %u", (unsigned int)length);
+	rfbCloseClient(cl);
+	return NULL;
+    }
+
     if (length>0) {
-        buffer=malloc((uint64_t)length+1);
+        buffer=malloc((size_t)length+1);
         if (buffer!=NULL) {
             if ((n = rfbReadExact(cl, (char *)buffer, length)) <= 0) {
                 if (n != 0)
path: libvncserver/rfbserver.c
Vulnerability: In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because a certain -1 return value is mishandled.
Vulnerability ID: CVE-2018-20760
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/gpac/gpac
Published: 2019-02-06
File: src/media_tools/text_import.c
Commit message: check error code on call to gf_utf8_wcstombs (#1177)
Commit author: Aurelien David

Vulnerable version (before fix):
 char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicod 	} 	sptr = (u16 *)szLine; 	i = (u32) gf_utf8_wcstombs(szLineConv, 1024, (const unsigned short **) &sptr); 	szLineConv[i] = 0; 	strcpy(szLine, szLineConv); 	/*this is ugly indeed: since input is UTF16-LE, there are many chances the fgets never reads the \0 after a \n*/

Fixed version (after fix):
 char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicod 	} 	sptr = (u16 *)szLine; 	i = (u32) gf_utf8_wcstombs(szLineConv, 1024, (const unsigned short **) &sptr); 	if (i >= (u32)ARRAY_LENGTH(szLineConv)) 		return NULL; 	szLineConv[i] = 0; 	strcpy(szLine, szLineConv); 	/*this is ugly indeed: since input is UTF16-LE, there are many chances the fgets never reads the \0 after a \n*/

Patch:
patch: @@ -269,6 +269,8 @@ char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicod
 	}
 	sptr = (u16 *)szLine;
 	i = (u32) gf_utf8_wcstombs(szLineConv, 1024, (const unsigned short **) &sptr);
+	if (i >= (u32)ARRAY_LENGTH(szLineConv))
+		return NULL;
 	szLineConv[i] = 0;
 	strcpy(szLine, szLineConv);
 	/*this is ugly indeed: since input is UTF16-LE, there are many chances the fgets never reads the \0 after a \n*/
path: src/media_tools/text_import.c
Vulnerability: read_ujpg in jpgcoder.cc in Dropbox Lepton 1.2.1 allows attackers to cause a denial-of-service (application runtime crash because of an integer overflow) via a crafted file.
Vulnerability ID: CVE-2018-20820
CWE: CWE-190
Severity score: 2.9
Project: https://github.com/dropbox/lepton
Published: 2019-04-23
File: src/lepton/jpgcoder.cc
Commit message: fix #111
Commit author: Daniel Reiter Horn

Vulnerable version (before fix):
 bool read_ujpg( void )                               Sirikata::BrotliCodec::Decompress(compressed_header_buffer.data(),                                                                 compressed_header_buffer.size(),                                                                 JpegAllocator<uint8_t>(),                                                                 max_file_size * 2 + 128 * 1024 * 1024));                 if (uncompressed_header_buffer.second) {                     always_assert(false && "Data not properly zlib coded");                     return false;

Fixed version (after fix):
 bool read_ujpg( void )                               Sirikata::BrotliCodec::Decompress(compressed_header_buffer.data(),                                                                 compressed_header_buffer.size(),                                                                 JpegAllocator<uint8_t>(),                                                                 ((size_t)max_file_size) * 2 + 128 * 1024 * 1024));                 if (uncompressed_header_buffer.second) {                     always_assert(false && "Data not properly zlib coded");                     return false;

Patch:
patch: @@ -4163,7 +4163,7 @@ bool read_ujpg( void )
                               Sirikata::BrotliCodec::Decompress(compressed_header_buffer.data(),
                                                                 compressed_header_buffer.size(),
                                                                 JpegAllocator<uint8_t>(),
-                                                                max_file_size * 2 + 128 * 1024 * 1024));
+                                                                ((size_t)max_file_size) * 2 + 128 * 1024 * 1024));
                 if (uncompressed_header_buffer.second) {
                     always_assert(false && "Data not properly zlib coded");
                     return false;
path: src/lepton/jpgcoder.cc
Vulnerability: include/admin/Menu/Ajax.php in Typesetter 5.1 has index.php/Admin/Menu/Ajax?cmd=AddHidden title XSS.
Vulnerability ID: CVE-2018-20837
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/Typesetter/Typesetter
Published: 2019-05-09
File: include/admin/Menu/Ajax.php
Commit message: prevent code injection (XSS)

fix for reflected XSS vulnerability spotted by Mithat Gögebakan,
www.netsparker.com
Commit author: juek

Vulnerable version (before fix):
 public function AddHidden(){ 		echo '<tr><th colspan="2">'.$langmessage['options'].'</th></tr>';  		//title 		echo '<tr><td>'; 		echo $langmessage['label']; 		echo '</td><td>'; 		echo '<input type="text" name="title" maxlength="100" size="50" value="'.htmlspecialchars($_REQUEST['title']).'" class="gpinput full_width" required/>'; 		echo '</td></tr>';  		//copy

Fixed version (after fix):
 public function AddHidden(){ 		echo '<tr><th colspan="2">'.$langmessage['options'].'</th></tr>';  		//title 		$new_title = htmlspecialchars($_REQUEST['title']); 		// prevent code injections 		$new_title = str_replace(array('=', '/', '{', '}', ':', ',', ';'), '', $new_title); 		echo '<tr><td>'; 		echo $langmessage['label']; 		echo '</td><td>'; 		echo '<input type="text" name="title" maxlength="100" size="50" value="'. $new_title .'" class="gpinput full_width" required/>'; 		echo '</td></tr>';  		//copy

Patch:
patch: @@ -155,10 +155,13 @@ public function AddHidden(){
 		echo '<tr><th colspan="2">'.$langmessage['options'].'</th></tr>';
 
 		//title
+		$new_title = htmlspecialchars($_REQUEST['title']);
+		// prevent code injections
+		$new_title = str_replace(array('=', '/', '{', '}', ':', ',', ';'), '', $new_title);
 		echo '<tr><td>';
 		echo $langmessage['label'];
 		echo '</td><td>';
-		echo '<input type="text" name="title" maxlength="100" size="50" value="'.htmlspecialchars($_REQUEST['title']).'" class="gpinput full_width" required/>';
+		echo '<input type="text" name="title" maxlength="100" size="50" value="'. $new_title .'" class="gpinput full_width" required/>';
 		echo '</td></tr>';
 
 		//copy
path: include/admin/Menu/Ajax.php
Vulnerability: An issue was discovered in the Linux kernel before 4.20. drivers/phy/mscc/phy-ocelot-serdes.c has an off-by-one error with a resultant ctrl->phys out-of-bounds read.
Vulnerability ID: CVE-2018-20854
CWE: CWE-125
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2019-07-26
File: drivers/phy/mscc/phy-ocelot-serdes.c
Commit message: phy: ocelot-serdes: fix out-of-bounds read

Currently, there is an out-of-bounds read on array ctrl->phys,
once variable i reaches the maximum array size of SERDES_MAX
in the for loop.

Fix this by changing the condition in the for loop from
i <= SERDES_MAX to i < SERDES_MAX.

Addresses-Coverity-ID: 1473966 ("Out-of-bounds read")
Addresses-Coverity-ID: 1473959 ("Out-of-bounds read")
Fixes: 51f6b410fc22 ("phy: add driver for Microsemi Ocelot SerDes muxing")
Reviewed-by: Quentin Schulz <quentin.schulz@bootlin.com>
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Gustavo A. R. Silva

Vulnerable version (before fix):
 static struct phy *serdes_simple_xlate(struct device *dev, 	port = args->args[0]; 	idx = args->args[1];  	for (i = 0; i <= SERDES_MAX; i++) { 		struct serdes_macro *macro = phy_get_drvdata(ctrl->phys[i]);  		if (idx != macro->idx) static int serdes_probe(struct platform_device *pdev) 	if (IS_ERR(ctrl->regs)) 		return PTR_ERR(ctrl->regs);  	for (i = 0; i <= SERDES_MAX; i++) { 		ret = serdes_phy_create(ctrl, i, &ctrl->phys[i]); 		if (ret) 			return ret;

Fixed version (after fix):
 static struct phy *serdes_simple_xlate(struct device *dev, 	port = args->args[0]; 	idx = args->args[1];  	for (i = 0; i < SERDES_MAX; i++) { 		struct serdes_macro *macro = phy_get_drvdata(ctrl->phys[i]);  		if (idx != macro->idx) static int serdes_probe(struct platform_device *pdev) 	if (IS_ERR(ctrl->regs)) 		return PTR_ERR(ctrl->regs);  	for (i = 0; i < SERDES_MAX; i++) { 		ret = serdes_phy_create(ctrl, i, &ctrl->phys[i]); 		if (ret) 			return ret;

Patch:
patch: @@ -206,7 +206,7 @@ static struct phy *serdes_simple_xlate(struct device *dev,
 	port = args->args[0];
 	idx = args->args[1];
 
-	for (i = 0; i <= SERDES_MAX; i++) {
+	for (i = 0; i < SERDES_MAX; i++) {
 		struct serdes_macro *macro = phy_get_drvdata(ctrl->phys[i]);
 
 		if (idx != macro->idx)
@@ -260,7 +260,7 @@ static int serdes_probe(struct platform_device *pdev)
 	if (IS_ERR(ctrl->regs))
 		return PTR_ERR(ctrl->regs);
 
-	for (i = 0; i <= SERDES_MAX; i++) {
+	for (i = 0; i < SERDES_MAX; i++) {
 		ret = serdes_phy_create(ctrl, i, &ctrl->phys[i]);
 		if (ret)
 			return ret;
path: drivers/phy/mscc/phy-ocelot-serdes.c