rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call.
Vulnerability ID: CVE-2016-10044
CWE: CWE-264
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2017-02-07
File: fs/aio.c
Commit message: aio: mark AIO pseudo-fs noexec

This ensures that do_mmap() won't implicitly make AIO memory mappings
executable if the READ_IMPLIES_EXEC personality flag is set.  Such
behavior is problematic because the security_mmap_file LSM hook doesn't
catch this case, potentially permitting an attacker to bypass a W^X
policy enforced by SELinux.

I have tested the patch on my machine.

To test the behavior, compile and run this:

    #define _GNU_SOURCE
    #include <unistd.h>
    #include <sys/personality.h>
    #include <linux/aio_abi.h>
    #include <err.h>
    #include <stdlib.h>
    #include <stdio.h>
    #include <sys/syscall.h>

    int main(void) {
        personality(READ_IMPLIES_EXEC);
        aio_context_t ctx = 0;
        if (syscall(__NR_io_setup, 1, &ctx))
            err(1, "io_setup");

        char cmd[1000];
        sprintf(cmd, "cat /proc/%d/maps | grep -F '/[aio]'",
            (int)getpid());
        system(cmd);
        return 0;
    }

In the output, "rw-s" is good, "rwxs" is bad.

Signed-off-by: Jann Horn <jann@thejh.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Jann Horn

Vulnerable version (before fix):
 static struct dentry *aio_mount(struct file_system_type *fs_type, 	static const struct dentry_operations ops = { 		.d_dname	= simple_dname, 	}; 	return mount_pseudo(fs_type, "aio:", NULL, &ops, AIO_RING_MAGIC); }  /* aio_setup

Fixed version (after fix):
 static struct dentry *aio_mount(struct file_system_type *fs_type, 	static const struct dentry_operations ops = { 		.d_dname	= simple_dname, 	}; 	struct dentry *root = mount_pseudo(fs_type, "aio:", NULL, &ops, 					   AIO_RING_MAGIC);  	if (!IS_ERR(root)) 		root->d_sb->s_iflags |= SB_I_NOEXEC; 	return root; }  /* aio_setup

Patch:
patch: @@ -239,7 +239,12 @@ static struct dentry *aio_mount(struct file_system_type *fs_type,
 	static const struct dentry_operations ops = {
 		.d_dname	= simple_dname,
 	};
-	return mount_pseudo(fs_type, "aio:", NULL, &ops, AIO_RING_MAGIC);
+	struct dentry *root = mount_pseudo(fs_type, "aio:", NULL, &ops,
+					   AIO_RING_MAGIC);
+
+	if (!IS_ERR(root))
+		root->d_sb->s_iflags |= SB_I_NOEXEC;
+	return root;
 }
 
 /* aio_setup
path: fs/aio.c
Vulnerability: coders/mat.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via a mat file with an invalid number of frames.
Vulnerability ID: CVE-2016-10069
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-03-02
File: coders/mat.c
Commit message: Added check for invalid number of frames.
Commit author: dirk

Vulnerable version (before fix):
 MATLAB_KO: ThrowReaderException(CorruptImageError,"ImproperImageHeader");       case 16: z2=z = ReadBlobXXXLong(image2);  /* 4D matrix animation */          if(z!=3 && z!=1)            ThrowReaderException(CoderError, "MultidimensionalMatricesAreNotSupported");           Frames = ReadBlobXXXLong(image2);          break;       default: ThrowReaderException(CoderError, "MultidimensionalMatricesAreNotSupported");     }

Fixed version (after fix):
 MATLAB_KO: ThrowReaderException(CorruptImageError,"ImproperImageHeader");       case 16: z2=z = ReadBlobXXXLong(image2);  /* 4D matrix animation */          if(z!=3 && z!=1)            ThrowReaderException(CoderError, "MultidimensionalMatricesAreNotSupported");          Frames = ReadBlobXXXLong(image2);          if (Frames == 0)            ThrowReaderException(CorruptImageError,"ImproperImageHeader");          break;       default: ThrowReaderException(CoderError, "MultidimensionalMatricesAreNotSupported");     }

Patch:
patch: @@ -942,7 +942,9 @@ MATLAB_KO: ThrowReaderException(CorruptImageError,"ImproperImageHeader");
       case 16: z2=z = ReadBlobXXXLong(image2);  /* 4D matrix animation */
          if(z!=3 && z!=1)
            ThrowReaderException(CoderError, "MultidimensionalMatricesAreNotSupported");
-          Frames = ReadBlobXXXLong(image2);
+         Frames = ReadBlobXXXLong(image2);
+         if (Frames == 0)
+           ThrowReaderException(CorruptImageError,"ImproperImageHeader");
          break;
       default: ThrowReaderException(CoderError, "MultidimensionalMatricesAreNotSupported");
     }
path: coders/mat.c
Vulnerability: Cross-site scripting (XSS) vulnerability in admin/plugin.php in Piwigo through 2.8.3 allows remote attackers to inject arbitrary web script or HTML via a crafted filename that is mishandled in a certain error case.
Vulnerability ID: CVE-2016-10083
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/Piwigo/Piwigo
Published: 2016-12-30
File: admin/plugin.php
Commit message: fixes #575, sanitize user input before display on die()
Commit author: plegall

Vulnerable version (before fix):
 } else {   die('Missing file '.$filename); } ?>\ No newline at end of file

Fixed version (after fix):
 } else {   die('Missing file '.htmlentities($filename)); } ?>\ No newline at end of file

Patch:
patch: @@ -63,6 +63,6 @@
 }
 else
 {
-  die('Missing file '.$filename);
+  die('Missing file '.htmlentities($filename));
 }
 ?>
\ No newline at end of file
path: admin/plugin.php
Vulnerability: Off-by-one error in coders/wpg.c in ImageMagick allows remote attackers to have unspecified impact via vectors related to a string copy.
Vulnerability ID: CVE-2016-10145
CWE: CWE-189
Severity score: 6.4
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-03-24
File: coders/wpg.c
Commit message: ...
Commit author: Cristy

Vulnerable version (before fix):
 static Image *ExtractPostscript(Image *image,const ImageInfo *image_info,   if(exception->severity != UndefinedException) goto FINISH_UNL;   if(magic_info->name == (char *) NULL) goto FINISH_UNL;    (void) strncpy(clone_info->magick,magic_info->name,MaxTextExtent);      /* Read nested image */   /*FormatString(clone_info->filename,"%s:%s",magic_info->name,postscript_file);*/

Fixed version (after fix):
 static Image *ExtractPostscript(Image *image,const ImageInfo *image_info,   if(exception->severity != UndefinedException) goto FINISH_UNL;   if(magic_info->name == (char *) NULL) goto FINISH_UNL;    (void) strncpy(clone_info->magick,magic_info->name,MaxTextExtent-1);      /* Read nested image */   /*FormatString(clone_info->filename,"%s:%s",magic_info->name,postscript_file);*/

Patch:
patch: @@ -803,7 +803,7 @@ static Image *ExtractPostscript(Image *image,const ImageInfo *image_info,
   if(exception->severity != UndefinedException) goto FINISH_UNL;
   if(magic_info->name == (char *) NULL) goto FINISH_UNL;
 
-  (void) strncpy(clone_info->magick,magic_info->name,MaxTextExtent);
+  (void) strncpy(clone_info->magick,magic_info->name,MaxTextExtent-1);
 
     /* Read nested image */
   /*FormatString(clone_info->filename,"%s:%s",magic_info->name,postscript_file);*/
path: coders/wpg.c
Vulnerability: Use-after-free vulnerability in the kvm_ioctl_create_device function in virt/kvm/kvm_main.c in the Linux kernel before 4.8.13 allows host OS users to cause a denial of service (host OS crash) or possibly gain privileges via crafted ioctl calls on the /dev/kvm device.
Vulnerability ID: CVE-2016-10150
CWE: CWE-416
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2017-02-06
File: virt/kvm/kvm_main.c
Commit message: KVM: use after free in kvm_ioctl_create_device()

We should move the ops->destroy(dev) after the list_del(&dev->vm_node)
so that we don't use "dev" after freeing it.

Fixes: a28ebea2adc4 ("KVM: Protect device ops->create and list_add with kvm->lock")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Commit author: Dan Carpenter

Vulnerable version (before fix):
 static int kvm_ioctl_create_device(struct kvm *kvm,  	ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC); 	if (ret < 0) { 		ops->destroy(dev); 		mutex_lock(&kvm->lock); 		list_del(&dev->vm_node); 		mutex_unlock(&kvm->lock); 		return ret; 	} 

Fixed version (after fix):
 static int kvm_ioctl_create_device(struct kvm *kvm,  	ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC); 	if (ret < 0) { 		mutex_lock(&kvm->lock); 		list_del(&dev->vm_node); 		mutex_unlock(&kvm->lock); 		ops->destroy(dev); 		return ret; 	} 

Patch:
patch: @@ -2889,10 +2889,10 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
 
 	ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC);
 	if (ret < 0) {
-		ops->destroy(dev);
 		mutex_lock(&kvm->lock);
 		list_del(&dev->vm_node);
 		mutex_unlock(&kvm->lock);
+		ops->destroy(dev);
 		return ret;
 	}
path: virt/kvm/kvm_main.c
Vulnerability: Use-after-free vulnerability in the kvm_ioctl_create_device function in virt/kvm/kvm_main.c in the Linux kernel before 4.8.13 allows host OS users to cause a denial of service (host OS crash) or possibly gain privileges via crafted ioctl calls on the /dev/kvm device.
Vulnerability ID: CVE-2016-10150
CWE: CWE-264
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2017-02-06
File: virt/kvm/kvm_main.c
Commit message: KVM: use after free in kvm_ioctl_create_device()

We should move the ops->destroy(dev) after the list_del(&dev->vm_node)
so that we don't use "dev" after freeing it.

Fixes: a28ebea2adc4 ("KVM: Protect device ops->create and list_add with kvm->lock")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Commit author: Dan Carpenter

Vulnerable version (before fix):
 static int kvm_ioctl_create_device(struct kvm *kvm,  	ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC); 	if (ret < 0) { 		ops->destroy(dev); 		mutex_lock(&kvm->lock); 		list_del(&dev->vm_node); 		mutex_unlock(&kvm->lock); 		return ret; 	} 

Fixed version (after fix):
 static int kvm_ioctl_create_device(struct kvm *kvm,  	ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC); 	if (ret < 0) { 		mutex_lock(&kvm->lock); 		list_del(&dev->vm_node); 		mutex_unlock(&kvm->lock); 		ops->destroy(dev); 		return ret; 	} 

Patch:
patch: @@ -2889,10 +2889,10 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
 
 	ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC);
 	if (ret < 0) {
-		ops->destroy(dev);
 		mutex_lock(&kvm->lock);
 		list_del(&dev->vm_node);
 		mutex_unlock(&kvm->lock);
+		ops->destroy(dev);
 		return ret;
 	}
path: virt/kvm/kvm_main.c
Vulnerability: The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.
Vulnerability ID: CVE-2016-10165
CWE: CWE-125
Severity score: 4.9
Project: https://github.com/mm2/Little-CMS
Published: 2017-02-03
File: src/cmstypes.c
Commit message: Added an extra check to MLU bounds

Thanks to Ibrahim el-sayed for spotting the bug
Commit author: Marti

Vulnerable version (before fix):
 void *Type_MLU_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER* io, cmsU          // Check for overflow         if (Offset < (SizeOfHeader + 8)) goto Error;          // True begin of the string         BeginOfThisString = Offset - SizeOfHeader - 8;

Fixed version (after fix):
 void *Type_MLU_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER* io, cmsU          // Check for overflow         if (Offset < (SizeOfHeader + 8)) goto Error;         if ((Offset + Len) > SizeOfTag + 8) goto Error;          // True begin of the string         BeginOfThisString = Offset - SizeOfHeader - 8;

Patch:
patch: @@ -1460,6 +1460,7 @@ void *Type_MLU_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER* io, cmsU
 
         // Check for overflow
         if (Offset < (SizeOfHeader + 8)) goto Error;
+        if ((Offset + Len) > SizeOfTag + 8) goto Error;
 
         // True begin of the string
         BeginOfThisString = Offset - SizeOfHeader - 8;
path: src/cmstypes.c
Vulnerability: BitlBee before 3.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a file transfer request for a contact that is not in the contact list.
Vulnerability ID: CVE-2016-10189
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/bitlbee/bitlbee
Published: 2017-03-14
File: protocols/bee_ft.c
Commit message: imcb_file_send_start: handle ft attempts from non-existing users
Commit author: dequis

Vulnerable version (before fix):
 file_transfer_t *imcb_file_send_start(struct im_connection *ic, char *handle, ch 	bee_t *bee = ic->bee; 	bee_user_t *bu = bee_user_by_handle(bee, ic, handle);  	if (bee->ui->ft_in_start) { 		return bee->ui->ft_in_start(bee, bu, file_name, file_size); 	} else { 		return NULL;

Fixed version (after fix):
 file_transfer_t *imcb_file_send_start(struct im_connection *ic, char *handle, ch 	bee_t *bee = ic->bee; 	bee_user_t *bu = bee_user_by_handle(bee, ic, handle);  	if (bee->ui->ft_in_start && bu) { 		return bee->ui->ft_in_start(bee, bu, file_name, file_size); 	} else { 		return NULL;

Patch:
patch: @@ -30,7 +30,7 @@ file_transfer_t *imcb_file_send_start(struct im_connection *ic, char *handle, ch
 	bee_t *bee = ic->bee;
 	bee_user_t *bu = bee_user_by_handle(bee, ic, handle);
 
-	if (bee->ui->ft_in_start) {
+	if (bee->ui->ft_in_start && bu) {
 		return bee->ui->ft_in_start(bee, bu, file_name, file_size);
 	} else {
 		return NULL;
path: protocols/bee_ft.c
Vulnerability: Heap-based buffer overflow in libavformat/rtmppkt.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check for RTMP packet size mismatches.
Vulnerability ID: CVE-2016-10191
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/FFmpeg/FFmpeg
Published: 2017-02-09
File: libavformat/rtmppkt.c
Commit message: avformat/rtmppkt: Check for packet size mismatches

Fixes out of array access

Found-by: Paul Cher <paulcher@icloud.com>
Reviewed-by: Paul Cher <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static int rtmp_packet_read_one_chunk(URLContext *h, RTMPPacket *p,     if (hdr != RTMP_PS_TWELVEBYTES)         timestamp += prev_pkt[channel_id].timestamp;      if (!prev_pkt[channel_id].read) {         if ((ret = ff_rtmp_packet_create(p, channel_id, type, timestamp,                                          size)) < 0)

Fixed version (after fix):
 static int rtmp_packet_read_one_chunk(URLContext *h, RTMPPacket *p,     if (hdr != RTMP_PS_TWELVEBYTES)         timestamp += prev_pkt[channel_id].timestamp;      if (prev_pkt[channel_id].read && size != prev_pkt[channel_id].size) {         av_log(NULL, AV_LOG_ERROR, "RTMP packet size mismatch %d != %d\n",                 size,                 prev_pkt[channel_id].size);         ff_rtmp_packet_destroy(&prev_pkt[channel_id]);         prev_pkt[channel_id].read = 0;     }      if (!prev_pkt[channel_id].read) {         if ((ret = ff_rtmp_packet_create(p, channel_id, type, timestamp,                                          size)) < 0)

Patch:
patch: @@ -235,6 +235,14 @@ static int rtmp_packet_read_one_chunk(URLContext *h, RTMPPacket *p,
     if (hdr != RTMP_PS_TWELVEBYTES)
         timestamp += prev_pkt[channel_id].timestamp;
 
+    if (prev_pkt[channel_id].read && size != prev_pkt[channel_id].size) {
+        av_log(NULL, AV_LOG_ERROR, "RTMP packet size mismatch %d != %d\n",
+                size,
+                prev_pkt[channel_id].size);
+        ff_rtmp_packet_destroy(&prev_pkt[channel_id]);
+        prev_pkt[channel_id].read = 0;
+    }
+
     if (!prev_pkt[channel_id].read) {
         if ((ret = ff_rtmp_packet_create(p, channel_id, type, timestamp,
                                          size)) < 0)
path: libavformat/rtmppkt.c
Vulnerability: Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check chunk size.
Vulnerability ID: CVE-2016-10192
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/FFmpeg/FFmpeg
Published: 2017-02-09
File: ffserver.c
Commit message: ffserver: Check chunk size

Fixes out of array access

Fixes: poc_ffserver.py
Found-by: Paul Cher <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static int http_receive_data(HTTPContext *c)         } else if (c->buffer_ptr - c->buffer >= 2 &&                    !memcmp(c->buffer_ptr - 1, "\r\n", 2)) {             c->chunk_size = strtol(c->buffer, 0, 16);             if (c->chunk_size == 0) // end of stream                 goto fail;             c->buffer_ptr = c->buffer;             break;         } else if (++loop_run > 10) static int http_receive_data(HTTPContext *c)             /* end of connection : close it */             goto fail;         else {             c->chunk_size -= len;             c->buffer_ptr += len;             c->data_count += len;

Fixed version (after fix):
 static int http_receive_data(HTTPContext *c)         } else if (c->buffer_ptr - c->buffer >= 2 &&                    !memcmp(c->buffer_ptr - 1, "\r\n", 2)) {             c->chunk_size = strtol(c->buffer, 0, 16);             if (c->chunk_size <= 0) { // end of stream or invalid chunk size                 c->chunk_size = 0;                 goto fail;             }             c->buffer_ptr = c->buffer;             break;         } else if (++loop_run > 10) static int http_receive_data(HTTPContext *c)             /* end of connection : close it */             goto fail;         else {             av_assert0(len <= c->chunk_size);             c->chunk_size -= len;             c->buffer_ptr += len;             c->data_count += len;

Patch:
patch: @@ -2738,8 +2738,10 @@ static int http_receive_data(HTTPContext *c)
         } else if (c->buffer_ptr - c->buffer >= 2 &&
                    !memcmp(c->buffer_ptr - 1, "\r\n", 2)) {
             c->chunk_size = strtol(c->buffer, 0, 16);
-            if (c->chunk_size == 0) // end of stream
+            if (c->chunk_size <= 0) { // end of stream or invalid chunk size
+                c->chunk_size = 0;
                 goto fail;
+            }
             c->buffer_ptr = c->buffer;
             break;
         } else if (++loop_run > 10)
@@ -2761,6 +2763,7 @@ static int http_receive_data(HTTPContext *c)
             /* end of connection : close it */
             goto fail;
         else {
+            av_assert0(len <= c->chunk_size);
             c->chunk_size -= len;
             c->buffer_ptr += len;
             c->data_count += len;
path: ffserver.c
Vulnerability: The search_make_new function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (out-of-bounds read) via an empty hostname.
Vulnerability ID: CVE-2016-10197
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/libevent/libevent
Published: 2017-03-15
File: evdns.c
Commit message: evdns: fix searching empty hostnames

From #332:
  Here follows a bug report by **Guido Vranken** via the _Tor bug bounty program_. Please credit Guido accordingly.

  ## Bug report

  The DNS code of Libevent contains this rather obvious OOB read:

  ```c
  static char *
  search_make_new(const struct search_state *const state, int n, const char *const base_name) {
      const size_t base_len = strlen(base_name);
      const char need_to_append_dot = base_name[base_len - 1] == '.' ? 0 : 1;
  ```

  If the length of ```base_name``` is 0, then line 3125 reads 1 byte before the buffer. This will trigger a crash on ASAN-protected builds.

  To reproduce:

  Build libevent with ASAN:
  ```
  $ CFLAGS='-fomit-frame-pointer -fsanitize=address' ./configure && make -j4
  ```
  Put the attached ```resolv.conf``` and ```poc.c``` in the source directory and then do:

  ```
  $ gcc -fsanitize=address -fomit-frame-pointer poc.c .libs/libevent.a
  $ ./a.out
  =================================================================
  ==22201== ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60060000efdf at pc 0x4429da bp 0x7ffe1ed47300 sp 0x7ffe1ed472f8
  READ of size 1 at 0x60060000efdf thread T0
  ```

P.S. we can add a check earlier, but since this is very uncommon, I didn't add it.

Fixes: #332
Commit author: Azat Khuzhin

Vulnerable version (before fix):
 search_set_from_hostname(struct evdns_base *base) { static char * search_make_new(const struct search_state *const state, int n, const char *const base_name) { 	const size_t base_len = strlen(base_name); 	const char need_to_append_dot = base_name[base_len - 1] == '.' ? 0 : 1; 	struct search_domain *dom;  	for (dom = state->head; dom; dom = dom->next) { 		if (!n--) { 			/* this is the postfix we want */

Fixed version (after fix):
 search_set_from_hostname(struct evdns_base *base) { static char * search_make_new(const struct search_state *const state, int n, const char *const base_name) { 	const size_t base_len = strlen(base_name); 	char need_to_append_dot; 	struct search_domain *dom;  	if (!base_len) return NULL; 	need_to_append_dot = base_name[base_len - 1] == '.' ? 0 : 1;  	for (dom = state->head; dom; dom = dom->next) { 		if (!n--) { 			/* this is the postfix we want */

Patch:
patch: @@ -3175,9 +3175,12 @@ search_set_from_hostname(struct evdns_base *base) {
 static char *
 search_make_new(const struct search_state *const state, int n, const char *const base_name) {
 	const size_t base_len = strlen(base_name);
-	const char need_to_append_dot = base_name[base_len - 1] == '.' ? 0 : 1;
+	char need_to_append_dot;
 	struct search_domain *dom;
 
+	if (!base_len) return NULL;
+	need_to_append_dot = base_name[base_len - 1] == '.' ? 0 : 1;
+
 	for (dom = state->head; dom; dom = dom->next) {
 		if (!n--) {
 			/* this is the postfix we want */
path: evdns.c
Vulnerability: Insufficient sanitization of the query parameter in templates/html/search_opensearch.php could lead to reflected cross-site scripting or iframe injection.
Vulnerability ID: CVE-2016-10245
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/doxygen/doxygen
Published: 2019-05-24
File: templates/html/search_opensearch.php
Commit message: Bug 762934 - External search does not properly escape user supplied data, resulting in vulnerability
Commit author: Dimitri van Heesch

Vulnerable version (before fix):
  $mode = array_key_exists('v', $_GET)?$_GET['v']:""; $query = array_key_exists('query', $_GET)?$_GET['query']:"";  $query_results = run_query($query); 

Fixed version (after fix):
  $mode = array_key_exists('v', $_GET)?$_GET['v']:""; $query = array_key_exists('query', $_GET)?$_GET['query']:""; $query = preg_replace("/[^a-zA-Z0-9\-\_\.\x80-\xFF]/i", " ", $query );  $query_results = run_query($query); 

Patch:
patch: @@ -3,6 +3,7 @@
 
 $mode = array_key_exists('v', $_GET)?$_GET['v']:"";
 $query = array_key_exists('query', $_GET)?$_GET['query']:"";
+$query = preg_replace("/[^a-zA-Z0-9\-\_\.\x80-\xFF]/i", " ", $query );
 
 $query_results = run_query($query);
path: templates/html/search_opensearch.php