starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2021-35502 (published 2021-06-25T21:15Z)

app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-template:index.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/MISP/MISP
commit_details: repo_url: https://github.com/MISP/MISP
author: mokaddem
author_date: 2021-06-24 08:39:51+02:00
msg: security: [generic-template:index] Fixed unsanitized input
repository: repo_url: https://github.com/MISP/MISP
repo_name: MISP/MISP
description: MISP (core software) - Open Source Threat Intelligence and Sharing Platform
repo_language: PHP
owner: MISP
file_changes: filename: generic_field.ctp
change_type: ModificationType.MODIFY
diff: @@ -8,7 +8,7 @@
             }, $data));
         } else {
             if (count($data) > 0) {
-                $data = $data[0];
+                $data = h($data[0]);
             } else {
                 $data = '';
             }

programming_language: PHP
CVE-2021-3974 (published 2021-11-19T11:15Z)

vim is vulnerable to Use After Free

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2021-11-17 18:22:56+00:00
msg: patch 8.2.3612: using freed memory with regexp using a mark

Problem:    Using freed memory with regexp using a mark.
Solution:   Get the line again after getting the mark position.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: regexp.c
change_type: ModificationType.MODIFY
diff: @@ -1129,7 +1129,7 @@ typedef struct {
     // The current match-position is stord in these variables:
     linenr_T	lnum;		// line number, relative to first line
     char_u	*line;		// start of current line
-    char_u	*input;		// current input, points into "regline"
+    char_u	*input;		// current input, points into "line"
 
     int	need_clear_subexpr;	// subexpressions still need to be cleared
 #ifdef FEAT_SYN_HL

programming_language: C
filename: regexp_nfa.c
change_type: ModificationType.MODIFY
diff: @@ -6834,8 +6834,16 @@ nfa_regmatch(
 	    case NFA_MARK_GT:
 	    case NFA_MARK_LT:
 	      {
+		size_t	col = rex.input - rex.line;
 		pos_T	*pos = getmark_buf(rex.reg_buf, t->state->val, FALSE);
 
+		// Line may have been freed, get it again.
+		if (REG_MULTI)
+		{
+		    rex.line = reg_getline(rex.lnum);
+		    rex.input = rex.line + col;
+		}
+
 		// Compare the mark position to the match position, if the mark
 		// exists and mark is set in reg_buf.
 		if (pos != NULL && pos->lnum > 0)

programming_language: C
filename: test_regexp_latin.vim
change_type: ModificationType.MODIFY
diff: @@ -1037,4 +1037,12 @@ func Test_matching_pos()
   set re&
 endfunc
 
+func Test_using_mark_position()
+  " this was using freed memory
+  new
+  norm O0
+  call assert_fails("s/\\%')", 'E486:')
+  bwipe!
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -757,6 +757,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    3612,
 /**/
     3611,
 /**/

programming_language: Ruby
CVE-2021-44833 (published 2021-12-12T06:15Z)

The CLI 1.0.0 for Amazon AWS OpenSearch has weak permissions for the configuration file.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-276
cwe_name: Incorrect Default Permissions
description: During installation, installed file permissions are set to allow anyone to modify those files.
extended_description: 
      
      
     
     

Fix information:
repo_url: https://github.com/opensearch-project/opensearch-cli
commit_details: repo_url: https://github.com/opensearch-project/opensearch-cli
author: Vijayan Balasubramanian
author_date: 2021-10-27 10:29:44-07:00
msg: Update default folder and file permission

Update folder path to 700 and file path to 600.

Signed-off-by: Vijayan Balasubramanian <balasvij@amazon.com>
repository: repo_url: https://github.com/opensearch-project/opensearch-cli
repo_name: opensearch-project/opensearch-cli
description: A full-featured command line interface (CLI) for OpenSearch.
repo_language: Go
owner: opensearch-project
file_changes: filename: root.go
change_type: ModificationType.MODIFY
diff: @@ -40,7 +40,8 @@ const (
 	defaultConfigFileName = "config"
 	flagConfig            = "config"
 	flagProfileName       = "profile"
-	folderPermission      = 0755 // only owner can write, while everyone can read and execute
+	FolderPermission      = 0700 // only owner can read, write and execute
+	FilePermission        = 0600 // only owner can read and write
 	ConfigEnvVarName      = "OPENSEARCH_CLI_CONFIG"
 	RootCommandName       = "opensearch-cli"
 	version               = "1.0.0"
@@ -118,7 +119,7 @@ func createDefaultConfigFileIfNotExists() error {
 	}
 	folderPath := filepath.Dir(defaultFilePath)
 	if !isExists(folderPath) {
-		err := os.Mkdir(folderPath, folderPermission)
+		err := os.Mkdir(folderPath, FolderPermission)
 		if err != nil {
 			return err
 		}
@@ -127,6 +128,9 @@ func createDefaultConfigFileIfNotExists() error {
 	if err != nil {
 		return err
 	}
+	if err = f.Chmod(FilePermission); err != nil {
+		return err
+	}
 	return f.Close()
 }
 

programming_language: Go
CVE-2024-41131 (published 2024-07-22T15:15Z)

ImageSharp is a 2D graphics API. An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service. All users are advised to upgrade to v3.1.5 or v2.1.9.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/SixLabors/ImageSharp
commit_details: repo_url: https://github.com/SixLabors/ImageSharp
author: James Jackson-South
author_date: 2024-06-21 08:53:24+10:00
msg: Merge pull request #2754 from SixLabors/backport-v3/gif-lzw

v3 - Backport. Handle out of bounds Gif LZW max code
repository: repo_url: https://github.com/SixLabors/ImageSharp
repo_name: SixLabors/ImageSharp
description: :camera: A modern, cross-platform, 2D Graphics library for .NET
repo_language: C#
owner: SixLabors
CVE-2024-39906 (published 2024-07-19T20:15Z)

A command injection vulnerability was found in the IndieAuth functionality of the Ruby on Rails based Haven blog web application. The affected functionality requires authentication, but an attacker can craft a link that they can pass to a logged in administrator of the blog software. This leads to the immediate execution of the provided commands when the link is accessed by the authenticated administrator. This issue may lead to Remote Code Execution (RCE) and has been addressed by commit `c52f07c`. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/havenweb/haven
commit_details: repo_url: https://github.com/havenweb/haven
author: Matthew Wise
author_date: 2024-07-05 09:18:24-05:00
msg: add URI validation to indieauth flow
repository: repo_url: https://github.com/havenweb/haven
repo_name: havenweb/haven
description: Self-hostable private blogging
repo_language: Ruby
owner: havenweb
file_changes: filename: indie_auth_client.rb
change_type: ModificationType.MODIFY
diff: @@ -28,7 +28,7 @@ class IndieAuthClient
     @redirects = []
     if should_fetch?
       begin
-        URI.open(client_id) do |f|
+        URI(client_id).open do |f|
           doc = Nokogiri::HTML(f.read)
 
           url = ""
@@ -66,6 +66,7 @@ class IndieAuthClient
   def should_fetch?
     clean_host = parse_hostname(@client_id)
     begin
+      client_id_uri = URI.parse(@client_id) #for validation only
       ip = Resolv.getaddress(clean_host)
       return safe_ip? ip
     rescue

programming_language: Ruby
CVE-2023-43669 (published 2023-09-21T06:15Z)

The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service (minutes of CPU consumption) via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted (e.g., thousands of times) and the average amount of data for each parse attempt (e.g., millions of bytes).

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/snapview/tungstenite-rs
commit_details: repo_url: https://github.com/snapview/tungstenite-rs
author: Daniel Abramov
author_date: 2023-09-23 14:10:53+02:00
msg: Update changelog
repository: repo_url: https://github.com/snapview/tungstenite-rs
repo_name: snapview/tungstenite-rs
description: Lightweight stream-based WebSocket implementation for Rust.
repo_language: Rust
owner: snapview
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,7 @@
+# 0.20.1
+
+- Fixes [CVE-2023-43669](https://github.com/snapview/tungstenite-rs/pull/379).
+
 # 0.20.0
 - Remove many implicit flushing behaviours. In general reading and writing messages will no 
   longer flush until calling `flush`. An exception is automatic responses (e.g. pongs) 

programming_language: Markdown
CVE-2023-48294 (published 2023-11-17T22:15Z)

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions of LibreNMS when a user accesses their device dashboard, one request is sent to `graph.php` to access graphs generated on the particular Device. This request can be accessed by a low privilege user and they can enumerate devices on librenms with their id or hostname. Leveraging this vulnerability a low privilege user can see all devices registered by admin users. This vulnerability has been addressed in commit `489978a923` which has been included in release version 23.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/librenms/librenms
commit_details: repo_url: https://github.com/librenms/librenms
author: Tony Murray
author_date: 2023-11-06 09:09:25-06:00
msg: Fix graphs device check before auth (#15551)

It should be after the auth check.
repository: repo_url: https://github.com/librenms/librenms
repo_name: librenms/librenms
description: Community-based GPL-licensed network monitoring system
repo_language: PHP
owner: librenms
file_changes: filename: graph.inc.php
change_type: ModificationType.MODIFY
diff: @@ -9,10 +9,9 @@ try {
         $device = is_numeric($vars['device'])
             ? device_by_id_cache($vars['device'])
             : device_by_name($vars['device']);
-        if (empty($device['device_id'])) {
-            throw new \LibreNMS\Exceptions\RrdGraphException('Device not found');
+        if (isset($device['device_id'])) {
+            DeviceCache::setPrimary($device['device_id']);
         }
-        DeviceCache::setPrimary($device['device_id']);
     }
 
     // variables for included graphs
@@ -59,6 +58,11 @@ try {
         return;
     }
 
+    // check after auth
+    if (isset($vars['device']) && empty($device['device_id'])) {
+        throw new \LibreNMS\Exceptions\RrdGraphException('Device not found');
+    }
+
     $rrd_options = $graph_params . ' ' . $rrd_options;
 
     // command output requested

programming_language: PHP
CVE-2024-31582 (published 2024-04-17T19:15Z)

FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service (DoS) via crafted input.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/ffmpeg/ffmpeg
commit_details: repo_url: https://github.com/ffmpeg/ffmpeg
author: Zhao Zhili
author_date: 2023-12-29 05:56:43+08:00
msg: avfilter/vf_codecview: fix heap buffer overflow

And improve the performance by a little bit.

Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
repository: repo_url: https://github.com/ffmpeg/ffmpeg
repo_name: FFmpeg/FFmpeg
description: Mirror of https://git.ffmpeg.org/ffmpeg.git
repo_language: C
owner: ffmpeg
file_changes: filename: vf_codecview.c
change_type: ModificationType.MODIFY
diff: @@ -216,9 +216,6 @@ static void draw_block_rectangle(uint8_t *buf, int sx, int sy, int w, int h, ptr
         buf[sx + w - 1] = color;
         buf += stride;
     }
-
-    for (int x = sx; x < sx + w; x++)
-        buf[x] = color;
 }
 
 static int filter_frame(AVFilterLink *inlink, AVFrame *frame)

programming_language: C
CVE-2016-9842 (published 2017-05-23T04:29Z)

The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/madler/zlib
commit_details: repo_url: https://github.com/madler/zlib
author: Mark Adler
author_date: 2015-09-05 17:45:55-07:00
msg: Avoid shifts of negative values inflateMark().

The C standard says that bit shifts of negative integers is
undefined.  This casts to unsigned values to assure a known
result.
repository: repo_url: https://github.com/madler/zlib
repo_name: madler/zlib
description: A massively spiffy yet delicately unobtrusive compression library.
repo_language: C
owner: madler
file_changes: filename: inflate.c
change_type: ModificationType.MODIFY
diff: @@ -1506,9 +1506,10 @@ z_streamp strm;
 {
     struct inflate_state FAR *state;
 
-    if (strm == Z_NULL || strm->state == Z_NULL) return -1L << 16;
+    if (strm == Z_NULL || strm->state == Z_NULL)
+        return (long)(((unsigned long)0 - 1) << 16);
     state = (struct inflate_state FAR *)strm->state;
-    return ((long)(state->back) << 16) +
+    return (long)(((unsigned long)((long)state->back)) << 16) +
         (state->mode == COPY ? state->length :
             (state->mode == MATCH ? state->was - state->length : 0));
 }

programming_language: C
CVE-2018-19360 (published 2019-01-02T18:29Z)

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-502
cwe_name: Deserialization of Untrusted Data
description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
extended_description: 
            It is often convenient to serialize objects for communication or to save them for later use. However, deserialized data or code can often be modified without using the provided accessor functions if it does not use cryptography to protect itself. Furthermore, any cryptography would still be client-side security -- which is a dangerous security assumption.
            Data that is untrusted can not be trusted to be well-formed.
            When developers place no restrictions on "gadget chains," or series of instances and method invocations that can self-execute during the deserialization process (i.e., before the object is returned to the caller), it is sometimes possible for attackers to leverage them to perform unauthorized actions, like generating a shell.
         
         

Fix information:
repo_url: https://github.com/FasterXML/jackson-databind
commit_details: repo_url: https://github.com/FasterXML/jackson-databind
author: Tatu Saloranta
author_date: 2018-11-23 10:33:23-08:00
msg: Backport #2186 to 2.7.9[.5]
repository: repo_url: https://github.com/FasterXML/jackson-databind
repo_name: FasterXML/jackson-databind
description: General data-binding package for Jackson (2.x): works on streaming API (core) implementation(s)
repo_language: Java
owner: FasterXML
file_changes: filename: VERSION
change_type: ModificationType.MODIFY
diff: @@ -10,6 +10,9 @@ Project: jackson-databind
  (reported by OneSourceCat@github)
 #2097: Block more classes from polymorphic deserialization (CVE-2018-14718
   - CVE-2018-14721)
+#2186: Block more classes from polymorphic deserialization (CVE-2018-19360,
+  CVE-2018-19361, CVE-2018-19362)
+ (reported by Guixiong Wu)
 
 2.7.9.4 (08-Jun-2018)
 

programming_language: Markdown
filename: SubTypeValidator.java
change_type: ModificationType.MODIFY
diff: @@ -73,6 +73,11 @@ public class SubTypeValidator
         s.add("com.sun.deploy.security.ruleset.DRSHelper");
         s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
 
+        // [databind#2186]: yet more 3rd party gadgets
+        s.add("org.jboss.util.propertyeditor.DocumentEditor");
+        s.add("org.apache.openjpa.ee.RegistryManagedRuntime");
+        s.add("org.apache.openjpa.ee.JNDIManagedRuntime");
+        s.add("org.apache.axis2.transport.jms.JMSOutTransportInfo");        
         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
     }
 

programming_language: Java
CVE-2019-19051 (published 2019-11-18T06:15Z)

A memory leak in the i2400m_op_rfkill_sw_toggle() function in drivers/net/wimax/i2400m/op-rfkill.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-6f3ef5c25cc7.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Navid Emamdoost
author_date: 2019-10-25 23:53:30-05:00
msg: wimax: i2400: Fix memory leak in i2400m_op_rfkill_sw_toggle

In the implementation of i2400m_op_rfkill_sw_toggle() the allocated
buffer for cmd should be released before returning. The
documentation for i2400m_msg_to_dev() says when it returns the buffer
can be reused. Meaning cmd should be released in either case. Move
kfree(cmd) before return to be reached by all execution paths.

Fixes: 2507e6ab7a9a ("wimax: i2400: fix memory leak")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: op-rfkill.c
change_type: ModificationType.MODIFY
diff: @@ -127,12 +127,12 @@ int i2400m_op_rfkill_sw_toggle(struct wimax_dev *wimax_dev,
 			"%d\n", result);
 	result = 0;
 error_cmd:
-	kfree(cmd);
 	kfree_skb(ack_skb);
 error_msg_to_dev:
 error_alloc:
 	d_fnend(4, dev, "(wimax_dev %p state %d) = %d\n",
 		wimax_dev, state, result);
+	kfree(cmd);
 	return result;
 }
 

programming_language: C
CVE-2020-25427 (published 2022-01-10T22:15Z)

A Null pointer dereference vulnerability exits in MP4Box - GPAC version 0.8.0-rev177-g51a8ef874-master via the gf_isom_get_track_id function, which causes a denial of service.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2020-06-11 19:28:51+02:00
msg: fixed potential crash - cf #1406
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: box_funcs.c
change_type: ModificationType.MODIFY
diff: @@ -205,17 +205,11 @@ retry_unknown_box:
 
 	newBox->size = size - hdr_size;
 
-	if (newBox->size) {
-		e = gf_isom_full_box_read(newBox, bs);
-		if (!e) e = gf_isom_box_read(newBox, bs);
-		newBox->size = size;
-		end = gf_bs_get_position(bs);
-	} else {
-		newBox->size = size;
-		//empty box
-		e = GF_OK;
-		end = gf_bs_get_position(bs);
-	}
+	//parse even if size is 0 - this makes sure that we perform box parsing (usually in box->read)
+	e = gf_isom_full_box_read(newBox, bs);
+	if (!e) e = gf_isom_box_read(newBox, bs);
+	newBox->size = size;
+	end = gf_bs_get_position(bs);
 
 	if (e && (e != GF_ISOM_INCOMPLETE_FILE)) {
 		gf_isom_box_del(newBox);

programming_language: C