rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: XSS via Embedded SVG in SVG Diagram Format in GitHub repository plantuml/plantuml prior to 1.2022.4. Stored XSS in the context of the diagram embedder. Depending on the actual context, this ranges from stealing secrets to account hijacking or even to code execution for example in desktop applications. Web based applications are the ones most affected. Since the SVG format allows clickable links in diagrams, it is commonly used in plugins for web based projects (like the Confluence plugin, etc. see https://plantuml.com/de/running).
Vulnerability ID: CVE-2022-1231
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/plantuml/plantuml
Published: 2022-04-15
File: src/net/sourceforge/plantuml/ugraphic/UImageSvg.java
Commit message: wip
Commit author: Arnaud Roques

Vulnerable version (before fix):
 public UImageSvg(String svg, double scale) { 		this.scale = scale; 	}  	private String clean(String svg) { 		svg = svg.toLowerCase().replaceAll("\\s", ""); 		if (svg.contains("<script>")) 			return EMPTY_SVG; 		if (svg.contains("</script>")) 			return EMPTY_SVG; 		if (svg.contains("<foreignobject")) 			return EMPTY_SVG; 		if (svg.contains("</foreignobject>")) 			return EMPTY_SVG; 		return svg; 	}

Fixed version (after fix):
 public UImageSvg(String svg, double scale) { 		this.scale = scale; 	}  	private String clean(final String svg) { 		final String svg2 = svg.toLowerCase().replaceAll("\\s", ""); 		if (svg2.contains("<script>")) 			return EMPTY_SVG; 		if (svg2.contains("</script>")) 			return EMPTY_SVG; 		if (svg2.contains("<foreignobject")) 			return EMPTY_SVG; 		if (svg2.contains("</foreignobject>")) 			return EMPTY_SVG; 		return svg; 	}

Patch:
patch: @@ -52,15 +52,15 @@ public UImageSvg(String svg, double scale) {
 		this.scale = scale;
 	}
 
-	private String clean(String svg) {
-		svg = svg.toLowerCase().replaceAll("\\s", "");
-		if (svg.contains("<script>"))
+	private String clean(final String svg) {
+		final String svg2 = svg.toLowerCase().replaceAll("\\s", "");
+		if (svg2.contains("<script>"))
 			return EMPTY_SVG;
-		if (svg.contains("</script>"))
+		if (svg2.contains("</script>"))
 			return EMPTY_SVG;
-		if (svg.contains("<foreignobject"))
+		if (svg2.contains("<foreignobject"))
 			return EMPTY_SVG;
-		if (svg.contains("</foreignobject>"))
+		if (svg2.contains("</foreignobject>"))
 			return EMPTY_SVG;
 		return svg;
 	}
path: src/net/sourceforge/plantuml/ugraphic/UImageSvg.java
Vulnerability: Heap buffer overflow in libr/bin/format/mach0/mach0.c in GitHub repository radareorg/radare2 prior to 5.8.6. If address sanitizer is disabled during the compiling, the program should executes into the `r_str_ncpy` function. Therefore I think it is very likely to be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html).
Vulnerability ID: CVE-2022-1240
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/radareorg/radare2
Published: 2022-04-06
File: libr/bin/format/mach0/mach0.c
Commit message: Fix oobread in the macho parser ##crash

* Reported by @Han0nly via huntr.dev
* Reproducers: heapoverflow1
* BountyID: e589bd97-4c74-4e79-93b5-0951a281facc
Commit author: pancake

Vulnerable version (before fix):
 static void parse_relocation_info(struct MACH0_(obj_t) *bin, RSkipList *relocs, 	for (i = 0; i < num; i++) { 		struct relocation_info a_info = info[i]; 		ut32 sym_num = a_info.r_symbolnum; 		if (sym_num > bin->nsymtab) { 			continue; 		} 

Fixed version (after fix):
 static void parse_relocation_info(struct MACH0_(obj_t) *bin, RSkipList *relocs, 	for (i = 0; i < num; i++) { 		struct relocation_info a_info = info[i]; 		ut32 sym_num = a_info.r_symbolnum; 		if (sym_num >= bin->nsymtab) { 			continue; 		} 

Patch:
patch: @@ -3178,7 +3178,7 @@ static void parse_relocation_info(struct MACH0_(obj_t) *bin, RSkipList *relocs,
 	for (i = 0; i < num; i++) {
 		struct relocation_info a_info = info[i];
 		ut32 sym_num = a_info.r_symbolnum;
-		if (sym_num > bin->nsymtab) {
+		if (sym_num >= bin->nsymtab) {
 			continue;
 		}
path: libr/bin/format/mach0/mach0.c
Vulnerability: Out-of-bounds Read in mrb_get_args in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
Vulnerability ID: CVE-2022-1276
CWE: CWE-125
Severity score: 6.4
Project: https://github.com/mruby/mruby
Published: 2022-04-10
File: mrbgems/mruby-compiler/core/codegen.c
Commit message: codegen.c: need to pack argument when `n==13` too.

Because we have extra 2 arguments coming (kw and rhs).
Commit author: Yukihiro "Matz" Matsumoto

Vulnerable version (before fix):
 gen_assignment(codegen_scope *s, node *tree, node *rhs, int sp, int val)           }         }         if (tree->cdr->car) {       /* keyword arguments */           if (n == 14) {             pop_n(n);             genop_2(s, OP_ARRAY, cursp(), n);             push();

Fixed version (after fix):
 gen_assignment(codegen_scope *s, node *tree, node *rhs, int sp, int val)           }         }         if (tree->cdr->car) {       /* keyword arguments */           if (n == 13 || n == 14) {             pop_n(n);             genop_2(s, OP_ARRAY, cursp(), n);             push();

Patch:
patch: @@ -1905,7 +1905,7 @@ gen_assignment(codegen_scope *s, node *tree, node *rhs, int sp, int val)
           }
         }
         if (tree->cdr->car) {       /* keyword arguments */
-          if (n == 14) {
+          if (n == 13 || n == 14) {
             pop_n(n);
             genop_2(s, OP_ARRAY, cursp(), n);
             push();
path: mrbgems/mruby-compiler/core/codegen.c
Vulnerability: NULL Pointer Dereference in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability allows attackers to cause a denial of service (application crash).
Vulnerability ID: CVE-2022-1283
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/radareorg/radare2
Published: 2022-04-08
File: libr/bin/format/ne/ne.c
Commit message: Fix null deref in the ne parser ##crash

* Reported by @hmsec via huntr.dev
* Reproducer: nepoc00
* BountyID: bfeb8fb8-644d-4587-80d4-cb704c404013
Commit author: Sergi Àlvarez i Capilla

Vulnerable version (before fix):
 RList *r_bin_ne_get_symbols(r_bin_ne_obj_t *bin) { 	} 	RList *entries = r_bin_ne_get_entrypoints (bin); 	bool resident = true, first = true; 	while (true) { 		ut8 sz = r_buf_read8_at (bin->buf, off); 		if (!sz) { 			first = true; RList *r_bin_ne_get_imports(r_bin_ne_obj_t *bin) { }  RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { 	RList *entries = r_list_newf (free); 	if (!entries) { 		return NULL;

Fixed version (after fix):
 RList *r_bin_ne_get_symbols(r_bin_ne_obj_t *bin) { 	} 	RList *entries = r_bin_ne_get_entrypoints (bin); 	bool resident = true, first = true; 	while (entries) { 		ut8 sz = r_buf_read8_at (bin->buf, off); 		if (!sz) { 			first = true; RList *r_bin_ne_get_imports(r_bin_ne_obj_t *bin) { }  RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { 	if (!bin->entry_table) { 		return NULL; 	} 	RList *entries = r_list_newf (free); 	if (!entries) { 		return NULL;

Patch:
patch: @@ -115,7 +115,7 @@ RList *r_bin_ne_get_symbols(r_bin_ne_obj_t *bin) {
 	}
 	RList *entries = r_bin_ne_get_entrypoints (bin);
 	bool resident = true, first = true;
-	while (true) {
+	while (entries) {
 		ut8 sz = r_buf_read8_at (bin->buf, off);
 		if (!sz) {
 			first = true;
@@ -352,6 +352,9 @@ RList *r_bin_ne_get_imports(r_bin_ne_obj_t *bin) {
 }
 
 RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) {
+	if (!bin->entry_table) {
+		return NULL;
+	}
 	RList *entries = r_list_newf (free);
 	if (!entries) {
 		return NULL;
path: libr/bin/format/ne/ne.c
Vulnerability: heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.
Vulnerability ID: CVE-2022-1284
CWE: CWE-416
Severity score: 2.9
Project: https://github.com/radareorg/radare2
Published: 2022-04-08
File: libr/core/canal.c
Commit message: Fix UAF in `aaef` ##crash

* Reported by @hdthky
* Reproducer: uaf-aef
* BountyID: e98ad92c-3a64-48fb-84d4-d13afdbcbdd7
Commit author: Sergi Àlvarez i Capilla

Vulnerable version (before fix):
 R_API void r_core_anal_esil(RCore *core, const char *str, const char *target) { 		arch = R2_ARCH_MIPS; 	}  	const char *sn = r_reg_get_name (core->anal->reg, R_REG_NAME_SN); 	if (!sn) { 		eprintf ("Warning: No SN reg alias for current architecture.\n"); 	} 	r_reg_arena_push (core->anal->reg);  	IterCtx ictx = { start, end, fcn, NULL }; R_API void r_core_anal_esil(RCore *core, const char *str, const char *target) { 				goto repeat; 			} 		} 		if (sn && op.type == R_ANAL_OP_TYPE_SWI) { 			r_strf_buffer (64); 			r_flag_space_set (core->flags, R_FLAGS_FS_SYSCALLS);

Fixed version (after fix):
 R_API void r_core_anal_esil(RCore *core, const char *str, const char *target) { 		arch = R2_ARCH_MIPS; 	}  	r_reg_arena_push (core->anal->reg);  	IterCtx ictx = { start, end, fcn, NULL }; R_API void r_core_anal_esil(RCore *core, const char *str, const char *target) { 				goto repeat; 			} 		} 		const char *sn = r_reg_get_name (core->anal->reg, R_REG_NAME_SN); 		if (!sn) { 			eprintf ("Warning: No SN reg alias for current architecture.\n"); 		} 		if (sn && op.type == R_ANAL_OP_TYPE_SWI) { 			r_strf_buffer (64); 			r_flag_space_set (core->flags, R_FLAGS_FS_SYSCALLS);

Patch:
patch: @@ -5295,10 +5295,6 @@ R_API void r_core_anal_esil(RCore *core, const char *str, const char *target) {
 		arch = R2_ARCH_MIPS;
 	}
 
-	const char *sn = r_reg_get_name (core->anal->reg, R_REG_NAME_SN);
-	if (!sn) {
-		eprintf ("Warning: No SN reg alias for current architecture.\n");
-	}
 	r_reg_arena_push (core->anal->reg);
 
 	IterCtx ictx = { start, end, fcn, NULL };
@@ -5409,6 +5405,10 @@ R_API void r_core_anal_esil(RCore *core, const char *str, const char *target) {
 				goto repeat;
 			}
 		}
+		const char *sn = r_reg_get_name (core->anal->reg, R_REG_NAME_SN);
+		if (!sn) {
+			eprintf ("Warning: No SN reg alias for current architecture.\n");
+		}
 		if (sn && op.type == R_ANAL_OP_TYPE_SWI) {
 			r_strf_buffer (64);
 			r_flag_space_set (core->flags, R_FLAGS_FS_SYSCALLS);
path: libr/core/canal.c
Vulnerability: heap-buffer-overflow in mrb_vm_exec in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
Vulnerability ID: CVE-2022-1286
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/mruby/mruby
Published: 2022-04-10
File: src/class.c
Commit message: class.c: clear method cache after `remove_method`.
Commit author: Yukihiro "Matz" Matsumoto

Vulnerable version (before fix):
 mrb_remove_method(mrb_state *mrb, struct RClass *c, mrb_sym mid)   MRB_CLASS_ORIGIN(c);   h = c->mt;    if (h && mt_del(mrb, h, mid)) return;   mrb_name_error(mrb, mid, "method '%n' not defined in %C", mid, c); } 

Fixed version (after fix):
 mrb_remove_method(mrb_state *mrb, struct RClass *c, mrb_sym mid)   MRB_CLASS_ORIGIN(c);   h = c->mt;    if (h && mt_del(mrb, h, mid)) {     mrb_mc_clear_by_class(mrb, c);     return;   }   mrb_name_error(mrb, mid, "method '%n' not defined in %C", mid, c); } 

Patch:
patch: @@ -2361,7 +2361,10 @@ mrb_remove_method(mrb_state *mrb, struct RClass *c, mrb_sym mid)
   MRB_CLASS_ORIGIN(c);
   h = c->mt;
 
-  if (h && mt_del(mrb, h, mid)) return;
+  if (h && mt_del(mrb, h, mid)) {
+    mrb_mc_clear_by_class(mrb, c);
+    return;
+  }
   mrb_name_error(mrb, mid, "method '%n' not defined in %C", mid, c);
 }
path: src/class.c
Vulnerability: Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability may allow attackers to read sensitive information or cause a crash.
Vulnerability ID: CVE-2022-1297
CWE: CWE-125
Severity score: 4.9
Project: https://github.com/radareorg/radare2
Published: 2022-04-11
File: libr/bin/format/ne/ne.c
Commit message: Fix oobread and unaligned casts in the NE entrypoint logic ##crash

* Reported by @hmsec via huntr.dev
* Reproducer: nepocaligns
* BountyID: ec538fa4-06c6-4050-a141-f60153ddeaac
Commit author: pancake

Vulnerable version (before fix):
 RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { 				off += 2; 				ut8 segnum = *(bin->entry_table + off); 				off++; 				ut16 segoff = *(ut16 *)(bin->entry_table + off); 				if (segnum > 0) { 					entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff; 				} 			} else { // Fixed 				if (bundle_type < bin->ne_header->SegCount) { 					entry->paddr = (ut64)bin->segment_entries[bundle_type - 1].offset 						* bin->alignment + *(ut16 *)(bin->entry_table + off); 				} 			} 			off += 2;

Fixed version (after fix):
 RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) { 				off += 2; 				ut8 segnum = *(bin->entry_table + off); 				off++; 				if (off > bin->ne_header->EntryTableLength) { 					break; 				} 				ut16 segoff = r_read_le16 (bin->entry_table + off); 				if (segnum > 0 && segnum < bin->ne_header->SegCount) { 					entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff; 				} 			} else { // Fixed 				if (off + 2 >= bin->ne_header->EntryTableLength) { 					break; 				} 				ut16 delta = r_read_le16 (bin->entry_table + off); 				if (bundle_type < bin->ne_header->SegCount) { 					entry->paddr = (ut64)bin->segment_entries[bundle_type - 1].offset 						* bin->alignment + delta; 				} 			} 			off += 2;

Patch:
patch: @@ -408,14 +408,21 @@ RList *r_bin_ne_get_entrypoints(r_bin_ne_obj_t *bin) {
 				off += 2;
 				ut8 segnum = *(bin->entry_table + off);
 				off++;
-				ut16 segoff = *(ut16 *)(bin->entry_table + off);
-				if (segnum > 0) {
+				if (off > bin->ne_header->EntryTableLength) {
+					break;
+				}
+				ut16 segoff = r_read_le16 (bin->entry_table + off);
+				if (segnum > 0 && segnum < bin->ne_header->SegCount) {
 					entry->paddr = (ut64)bin->segment_entries[segnum - 1].offset * bin->alignment + segoff;
 				}
 			} else { // Fixed
+				if (off + 2 >= bin->ne_header->EntryTableLength) {
+					break;
+				}
+				ut16 delta = r_read_le16 (bin->entry_table + off);
 				if (bundle_type < bin->ne_header->SegCount) {
 					entry->paddr = (ut64)bin->segment_entries[bundle_type - 1].offset
-						* bin->alignment + *(ut16 *)(bin->entry_table + off);
+						* bin->alignment + delta;
 				}
 			}
 			off += 2;
path: libr/bin/format/ne/ne.c
Vulnerability: An issue was discovered in in bwm-ng v0.6.2. An arbitrary null write exists in get_cmdln_options() function in src/options.c.
Vulnerability ID: CVE-2022-1341
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/vgropp/bwm-ng
Published: 2022-04-18
File: src/options.c
Commit message: Fix https://github.com/vgropp/bwm-ng/issues/26
Commit author: Oliver Falk

Vulnerable version (before fix):
 void get_cmdln_options(int argc, char *argv[]) {         pwd_entry=getpwuid(getuid());         if (pwd_entry!=NULL) {             str=(char*)malloc(strlen(pwd_entry->pw_dir)+14);             snprintf(str,strlen(pwd_entry->pw_dir)+14,"%s/.bwm-ng.conf",pwd_entry->pw_dir);             read_config(str);             free(str);

Fixed version (after fix):
 void get_cmdln_options(int argc, char *argv[]) {         pwd_entry=getpwuid(getuid());         if (pwd_entry!=NULL) {             str=(char*)malloc(strlen(pwd_entry->pw_dir)+14);             if(!str) {               printf("Fatal: failed to allocate %zu bytes.\n", strlen(pwd_entry->pw_dir)+14);               exit(EXIT_FAILURE);             }             snprintf(str,strlen(pwd_entry->pw_dir)+14,"%s/.bwm-ng.conf",pwd_entry->pw_dir);             read_config(str);             free(str);

Patch:
patch: @@ -335,6 +335,10 @@ void get_cmdln_options(int argc, char *argv[]) {
         pwd_entry=getpwuid(getuid());
         if (pwd_entry!=NULL) {
             str=(char*)malloc(strlen(pwd_entry->pw_dir)+14);
+            if(!str) {
+              printf("Fatal: failed to allocate %zu bytes.\n", strlen(pwd_entry->pw_dir)+14);
+              exit(EXIT_FAILURE);
+            }
             snprintf(str,strlen(pwd_entry->pw_dir)+14,"%s/.bwm-ng.conf",pwd_entry->pw_dir);
             read_config(str);
             free(str);
path: src/options.c
Vulnerability: NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of making the radare2 crash, thus affecting the availability of the system.
Vulnerability ID: CVE-2022-1382
CWE: CWE-476
Severity score: 6.9
Project: https://github.com/radareorg/radare2
Published: 2022-04-18
File: libr/bin/format/ne/ne.c
Commit message: Fix null deref in ne parser ##crash

* Reported by @cnitlrt via huntr.dev
* BountyID: d8b6d239-6d7b-4783-b26b-5be848c01aa1/
* Reproducer: nenull
Commit author: pancake

Vulnerable version (before fix):
 static char *__func_name_from_ord(const char *module, ut16 ordinal) {  RList *r_bin_ne_get_segments(r_bin_ne_obj_t *bin) { 	int i; 	if (!bin) { 		return NULL; 	} 	RList *segments = r_list_newf (free);

Fixed version (after fix):
 static char *__func_name_from_ord(const char *module, ut16 ordinal) {  RList *r_bin_ne_get_segments(r_bin_ne_obj_t *bin) { 	int i; 	if (!bin || !bin->segment_entries) { 		return NULL; 	} 	RList *segments = r_list_newf (free);

Patch:
patch: @@ -77,7 +77,7 @@ static char *__func_name_from_ord(const char *module, ut16 ordinal) {
 
 RList *r_bin_ne_get_segments(r_bin_ne_obj_t *bin) {
 	int i;
-	if (!bin) {
+	if (!bin || !bin->segment_entries) {
 		return NULL;
 	}
 	RList *segments = r_list_newf (free);
path: libr/bin/format/ne/ne.c
Vulnerability: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.8. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
Vulnerability ID: CVE-2022-1383
CWE: CWE-787
Severity score: 4.9
Project: https://github.com/radareorg/radare2
Published: 2022-04-18
File: libr/bin/format/mach0/coresymbolication.c
Commit message: Fix oobread bug in NE parser ##crash

* Reported by @cnitlrt via huntrdev
* BountyID: 02b4b563-b946-4343-9092-38d1c5cd60c9
* Reproducer: neoobread
Commit author: pancake

Vulnerable version (before fix):
 RCoreSymCacheElement *r_coresym_cache_element_new(RBinFile *bf, RBuffer *buf, ut 				sect->vaddr += page_zero_size; 			} 			cursor += word_size; 			if (cursor >= end) { 				break; 			} 			sect->size = r_read_ble (cursor, false, bits); 			cursor += word_size; 			if (cursor >= end) { 				break; 			} 			ut64 sect_name_off = r_read_ble (cursor, false, bits); RCoreSymCacheElement *r_coresym_cache_element_new(RBinFile *bf, RBuffer *buf, ut 				cursor += word_size; 			} 			string_origin = relative_to_strings? b + start_of_strings : sect_start; 			sect->name = str_dup_safe (b, string_origin + (size_t)sect_name_off, end); 		} 	} 	if (hdr->n_symbols) {

Fixed version (after fix):
 RCoreSymCacheElement *r_coresym_cache_element_new(RBinFile *bf, RBuffer *buf, ut 				sect->vaddr += page_zero_size; 			} 			cursor += word_size; 			if (cursor + word_size >= end) { 				break; 			} 			sect->size = r_read_ble (cursor, false, bits); 			cursor += word_size; 			if (cursor + word_size >= end) { 				break; 			} 			ut64 sect_name_off = r_read_ble (cursor, false, bits); RCoreSymCacheElement *r_coresym_cache_element_new(RBinFile *bf, RBuffer *buf, ut 				cursor += word_size; 			} 			string_origin = relative_to_strings? b + start_of_strings : sect_start; 			if (sect_name_off < (ut64)(size_t)(end - string_origin)) { 				sect->name = str_dup_safe (b, string_origin + sect_name_off, end); 			} else { 				sect->name = strdup (""); 			} 		} 	} 	if (hdr->n_symbols) {

Patch:
patch: @@ -274,12 +274,12 @@ RCoreSymCacheElement *r_coresym_cache_element_new(RBinFile *bf, RBuffer *buf, ut
 				sect->vaddr += page_zero_size;
 			}
 			cursor += word_size;
-			if (cursor >= end) {
+			if (cursor + word_size >= end) {
 				break;
 			}
 			sect->size = r_read_ble (cursor, false, bits);
 			cursor += word_size;
-			if (cursor >= end) {
+			if (cursor + word_size >= end) {
 				break;
 			}
 			ut64 sect_name_off = r_read_ble (cursor, false, bits);
@@ -291,7 +291,11 @@ RCoreSymCacheElement *r_coresym_cache_element_new(RBinFile *bf, RBuffer *buf, ut
 				cursor += word_size;
 			}
 			string_origin = relative_to_strings? b + start_of_strings : sect_start;
-			sect->name = str_dup_safe (b, string_origin + (size_t)sect_name_off, end);
+			if (sect_name_off < (ut64)(size_t)(end - string_origin)) {
+				sect->name = str_dup_safe (b, string_origin + sect_name_off, end);
+			} else {
+				sect->name = strdup ("");
+			}
 		}
 	}
 	if (hdr->n_symbols) {
path: libr/bin/format/mach0/coresymbolication.c
Vulnerability: Out-of-bounds Read in mrb_obj_is_kind_of in in GitHub repository mruby/mruby prior to 3.2. # Impact: Possible arbitrary code execution if being exploited.
Vulnerability ID: CVE-2022-1427
CWE: CWE-125
Severity score: 6.4
Project: https://github.com/mruby/mruby
Published: 2022-04-23
File: src/vm.c
Commit message: vm.c: check if target_class is NULL (when prepended).
Commit author: Yukihiro "Matz" Matsumoto

Vulnerable version (before fix):
 mrb_vm_exec(mrb_state *mrb, const struct RProc *proc, const mrb_code *pc)         mrb_exc_set(mrb, exc);         goto L_RAISE;       }       if (target_class->flags & MRB_FL_CLASS_IS_PREPENDED) {         target_class = mrb_vm_ci_target_class(ci);       }       else if (target_class->tt == MRB_TT_MODULE) {         target_class = mrb_vm_ci_target_class(ci);         if (!target_class || target_class->tt != MRB_TT_ICLASS) {           goto super_typeerror;

Fixed version (after fix):
 mrb_vm_exec(mrb_state *mrb, const struct RProc *proc, const mrb_code *pc)         mrb_exc_set(mrb, exc);         goto L_RAISE;       }       if ((target_class->flags & MRB_FL_CLASS_IS_PREPENDED) || target_class->tt == MRB_TT_MODULE) {         target_class = mrb_vm_ci_target_class(ci);         if (!target_class || target_class->tt != MRB_TT_ICLASS) {           goto super_typeerror;

Patch:
patch: @@ -1750,10 +1750,7 @@ mrb_vm_exec(mrb_state *mrb, const struct RProc *proc, const mrb_code *pc)
         mrb_exc_set(mrb, exc);
         goto L_RAISE;
       }
-      if (target_class->flags & MRB_FL_CLASS_IS_PREPENDED) {
-        target_class = mrb_vm_ci_target_class(ci);
-      }
-      else if (target_class->tt == MRB_TT_MODULE) {
+      if ((target_class->flags & MRB_FL_CLASS_IS_PREPENDED) || target_class->tt == MRB_TT_MODULE) {
         target_class = mrb_vm_ci_target_class(ci);
         if (!target_class || target_class->tt != MRB_TT_ICLASS) {
           goto super_typeerror;
path: src/vm.c