starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-46729 (published 2023-11-10T01:15Z)

sentry-javascript provides Sentry SDKs for JavaScript. An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This issue only affects users who have Next.js SDK tunneling feature enabled. The problem has been fixed in version 7.77.0.

CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-918
cwe_name: Server-Side Request Forgery (SSRF)
description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
extended_description: By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.
         

Fix information:
repo_url: https://github.com/getsentry/sentry-javascript
commit_details: repo_url: https://github.com/getsentry/sentry-javascript
author: Luca Forstner
author_date: 2023-10-31 09:11:01+01:00
msg: fix(nextjs): Strictly validate tunnel target parameters (#9415)
repository: repo_url: https://github.com/getsentry/sentry-javascript
repo_name: getsentry/sentry-javascript
description: Official Sentry SDKs for JavaScript
repo_language: TypeScript
owner: getsentry
file_changes: filename: withSentryConfig.ts
change_type: ModificationType.MODIFY
diff: @@ -104,12 +104,12 @@ function setUpTunnelRewriteRules(userNextConfig: NextConfigObject, tunnelPath: s
         {
           type: 'query',
           key: 'o', // short for orgId - we keep it short so matching is harder for ad-blockers
-          value: '(?<orgid>.*)',
+          value: '(?<orgid>[a-fA-F0-9]*)',
         },
         {
           type: 'query',
           key: 'p', // short for projectId - we keep it short so matching is harder for ad-blockers
-          value: '(?<projectid>.*)',
+          value: '(?<projectid>\\d*)',
         },
       ],
       destination: 'https://o:orgid.ingest.sentry.io/api/:projectid/envelope/?hsts=0',

programming_language: TypeScript
CVE-2014-125044 (published 2023-01-05T20:15Z)

A vulnerability, which was classified as critical, was found in soshtolsus wing-tight. This affects an unknown part of the file index.php. The manipulation of the argument p leads to file inclusion. It is possible to initiate the attack remotely. Upgrading to version 1.0.0 is able to address this issue. The patch is named 567bc33e6ed82b0d0179c9add707ac2b257aeaf2. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217515.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-610
cwe_name: Externally Controlled Reference to a Resource in Another Sphere
description: The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/soshtolsus/wing-tight
commit_details: repo_url: https://github.com/soshtolsus/wing-tight
author: arha
author_date: 2014-10-28 00:36:21-05:00
msg: hardened index against malicious ?p= attacks
repository: repo_url: https://github.com/soshtolsus/wing-tight
repo_name: soshtolsus/wing-tight
repo_language: CSS
owner: soshtolsus
file_changes: filename: index.php
change_type: ModificationType.MODIFY
diff: @@ -8,7 +8,18 @@
 		</div>
 		<div class="center hflex">
 			<div class="page">
-				<?php include('pages/' . array_merge(array('p'=>'home'), $_GET)['p'] . '.html.part'); ?>
+				<?php
+					$page_spec = array_merge(array('p'=>'home'), $_GET)['p'];
+					
+					if (strpos($page_spec, '/') === false)
+					{
+						include("{$_SERVER['DOCUMENT_ROOT']}/pages/$page_spec.html.part");
+					}
+					else
+					{
+						echo 'no one here but us chickens';
+					}
+				?>
 			</div>
 			<div class="sidebar">
 				<?php include('parts/sidebar.html.part'); ?>

programming_language: PHP
CVE-2018-15120 (published 2018-08-24T19:29Z)

libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted text with invalid Unicode sequences.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/GNOME/pango
commit_details: repo_url: https://github.com/GNOME/pango
author: Matthias Clasen
author_date: 2018-08-17 22:29:36-04:00
msg: Prevent an assertion with invalid Unicode sequences

Invalid Unicode sequences, such as 0x2665 0xfe0e 0xfe0f,
can trick the Emoji iter code into returning an empty
segment, which then triggers an assertion in the itemizer.

Prevent this by ensuring that we make progress.

This issue was reported by Jeffrey M.
repository: repo_url: https://github.com/GNOME/pango
repo_name: GNOME/pango
description: Read-only mirror of https://gitlab.gnome.org/GNOME/pango
repo_language: C
owner: GNOME
file_changes: filename: pango-emoji.c
change_type: ModificationType.MODIFY
diff: @@ -253,6 +253,12 @@ _pango_emoji_iter_next (PangoEmojiIter *iter)
     if (iter->is_emoji == PANGO_EMOJI_TYPE_IS_EMOJI (current_emoji_type))
     {
       iter->is_emoji = !PANGO_EMOJI_TYPE_IS_EMOJI (current_emoji_type);
+
+      /* Make sure we make progress.  Weird sequences, like a VC15 followed
+       * by VC16, can trick us into stalling otherwise. */
+      if (iter->start == iter->end)
+        iter->end = g_utf8_next_char (iter->end);
+
       return TRUE;
     }
   }

programming_language: C
CVE-2022-0714 (published 2022-02-22T20:15Z)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-122
cwe_name: Heap-based Buffer Overflow
description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2022-02-21 19:36:12+00:00
msg: patch 8.2.4436: crash with weird 'vartabstop' value

Problem:    Crash with weird 'vartabstop' value.
Solution:   Check for running into the end of the line.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: indent.c
change_type: ModificationType.MODIFY
diff: @@ -1338,6 +1338,8 @@ change_indent(
 		new_cursor_col += (*mb_ptr2len)(ptr + new_cursor_col);
 	    else
 		++new_cursor_col;
+	    if (ptr[new_cursor_col] == NUL)
+		break;
 	    vcol += lbr_chartabsize(ptr, ptr + new_cursor_col, (colnr_T)vcol);
 	}
 	vcol = last_vcol;

programming_language: C
filename: test_vartabs.vim
change_type: ModificationType.MODIFY
diff: @@ -442,4 +442,16 @@ func Test_shiftwidth_vartabstop()
   setlocal shiftwidth& vartabstop& tabstop&
 endfunc
 
+func Test_vartabstop_latin1()
+  let save_encoding = &encoding
+  new
+  set encoding=iso8859
+  silent norm :se 
+  set vartabstop=400
+  norm i00	
+  bwipe!
+  let &encoding = save_encoding
+endfunc
+
+
 " vim: shiftwidth=2 sts=2 expandtab

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -750,6 +750,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4436,
 /**/
     4435,
 /**/

programming_language: Ruby
CVE-2023-50248 (published 2023-12-13T21:15Z)

CKAN is an open-source data management system for powering data hubs and data portals. Starting in version 2.0.0 and prior to versions 2.9.10 and 2.10.3, when submitting a POST request to the `/dataset/new` endpoint (including either the auth cookie or the `Authorization` header) with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error, the attacker need to have permissions to create or edit datasets. This vulnerability has been patched in CKAN 2.10.3 and 2.9.10.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-130
cwe_name: Improper Handling of Length Parameter Inconsistency
description: The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
extended_description: If an attacker can manipulate the length parameter associated with an input such that it is inconsistent with the actual length of the input, this can be leveraged to cause the target application to behave in unexpected, and possibly, malicious ways. One of the possible motives for doing so is to pass in arbitrarily large input to the application. Another possible motivation is the modification of application state by including invalid data for subsequent properties of the application. Such weaknesses commonly lead to attacks such as buffer overflows and execution of arbitrary code.
         

Fix information:
repo_url: https://github.com/ckan/ckan
commit_details: repo_url: https://github.com/ckan/ckan
author: Adrià Mercader
author_date: 2023-12-13 14:12:02+01:00
msg: Merge pull request from GHSA-7fgc-89cx-w8j5

Sanitize indexes in tuple keys when flattening dicts
repository: repo_url: https://github.com/ckan/ckan
repo_name: ckan/ckan
description: CKAN is an open-source DMS (data management system) for powering data hubs and data portals. CKAN makes it easy to publish, share and use data. It powers catalog.data.gov, open.canada.ca/data, data.humdata.org among many other sites.
repo_language: Python
owner: ckan
CVE-2022-23467 (published 2022-12-05T20:15Z)

OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. Using a modified USB device an attacker can leak stack addresses of the `razer_attr_read_dpi_stages`, potentially bypassing KASLR. To exploit this vulnerability an attacker would need to access to a users keyboard or mouse or would need to convince a user to use a modified device. The issue has been patched in v3.5.1. Users are advised to upgrade and should be reminded not to plug in unknown USB devices.

CVSS v3 base score: 4.6, MEDIUM (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/openrazer/openrazer
commit_details: repo_url: https://github.com/openrazer/openrazer
author: Luca Weiss
author_date: 2022-12-04 12:45:07+01:00
msg: driver: Sanitize data_size value returned from devices

We're using this value for some bounds checks and we should ensure that
we don't potentially get a data_size that's bigger than the arguments
array to avoid out of bounds reads.
repository: repo_url: https://github.com/openrazer/openrazer
repo_name: openrazer/openrazer
description: Open source driver and user-space daemon to control Razer lighting and other features on GNU/Linux
repo_language: C
owner: openrazer
file_changes: filename: razercommon.c
change_type: ModificationType.MODIFY
diff: @@ -107,6 +107,14 @@ int razer_get_usb_response(struct usb_device *usb_dev, uint report_index, struct
         result = 1;
     }
 
+    if (WARN_ONCE(response_report->data_size > ARRAY_SIZE(response_report->arguments),
+                  "Field data_size %d in response is bigger than arguments\n",
+                  response_report->data_size)) {
+        /* Sanitize the value since at the moment callers don't respect the return code */
+        response_report->data_size = ARRAY_SIZE(response_report->arguments);
+        return -EINVAL;
+    }
+
     return result;
 }
 

programming_language: C
CVE-2017-9991 (published 2017-06-28T06:29Z)

Heap-based buffer overflow in the xwd_decode_frame function in libavcodec/xwddec.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/FFmpeg/FFmpeg
commit_details: repo_url: https://github.com/FFmpeg/FFmpeg
author: Michael Niedermayer
author_date: 2017-05-07 18:50:49+02:00
msg: avcodec/xwddec: Check bpp more completely

Fixes out of array access
Fixes: 1399/clusterfuzz-testcase-minimized-4866094172995584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
repository: repo_url: https://github.com/FFmpeg/FFmpeg
repo_name: FFmpeg/FFmpeg
description: Mirror of https://git.ffmpeg.org/ffmpeg.git
repo_language: C
owner: FFmpeg
file_changes: filename: xwddec.c
change_type: ModificationType.MODIFY
diff: @@ -157,9 +157,9 @@ static int xwd_decode_frame(AVCodecContext *avctx, void *data,
     case XWD_GRAY_SCALE:
         if (bpp != 1 && bpp != 8)
             return AVERROR_INVALIDDATA;
-        if (pixdepth == 1) {
+        if (bpp == 1 && pixdepth == 1) {
             avctx->pix_fmt = AV_PIX_FMT_MONOWHITE;
-        } else if (pixdepth == 8) {
+        } else if (bpp == 8 && pixdepth == 8) {
             avctx->pix_fmt = AV_PIX_FMT_GRAY8;
         }
         break;

programming_language: C
CVE-2023-4738 (published 2023-09-02T20:15Z)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Christian Brabandt
author_date: 2023-09-02 21:15:52+02:00
msg: patch 9.0.1848: [security] buffer-overflow in vim_regsub_both()

Problem:  buffer-overflow in vim_regsub_both()
Solution: Check remaining space

Signed-off-by: Christian Brabandt <cb@256bit.org>
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: ex_cmds.c
change_type: ModificationType.MODIFY
diff: @@ -4651,6 +4651,9 @@ ex_substitute(exarg_T *eap)
 		mch_memmove(new_end, sub_firstline + copycol, (size_t)copy_len);
 		new_end += copy_len;
 
+		if (new_start_len - copy_len < sublen)
+		    sublen = new_start_len - copy_len - 1;
+
 #ifdef FEAT_EVAL
 		++textlock;
 #endif

programming_language: C
filename: regexp.c
change_type: ModificationType.MODIFY
diff: @@ -2051,7 +2051,8 @@ vim_regsub_both(
 	// "flags & REGSUB_COPY" != 0.
 	if (copy)
 	{
-	    if (eval_result[nested] != NULL)
+	    if (eval_result[nested] != NULL &&
+		    STRLEN(eval_result[nested]) < destlen)
 	    {
 		STRCPY(dest, eval_result[nested]);
 		dst += STRLEN(eval_result[nested]);

programming_language: C
filename: vim_regsub_both
change_type: ModificationType.ADD
diff: @@ -0,0 +1,10 @@
+fu R()
+sil!norm0z=
+endf
+cal R()
+s/\%')/\=R()
+d
+no0 normyynore sm:vs0@vvvvvvvvvvse()dir(Xtest=csd{so88
+vs
+0scr
+so

programming_language: Batchfile
filename: test_crash.vim
change_type: ModificationType.MODIFY
diff: @@ -6,7 +6,7 @@ CheckScreendump
 
 func Test_crash1()
   " The following used to crash Vim
-  let opts = #{wait_for_ruler: 0}
+  let opts = #{wait_for_ruler: 0, rows: 20}
   let args = ' -u NONE -i NONE -n -e -s -S '
   let buf = RunVimInTerminal(args .. ' crash/poc_huaf1', opts)
   call VerifyScreenDump(buf, 'Test_crash_01', {})
@@ -22,4 +22,13 @@ func Test_crash1()
 
 endfunc
 
+func Test_crash2()
+  " The following used to crash Vim
+  let opts = #{wait_for_ruler: 0, rows: 20}
+  let args = ' -u NONE -i NONE -n -e -s -S '
+  let buf = RunVimInTerminal(args .. ' crash/vim_regsub_both', opts)
+  call VerifyScreenDump(buf, 'Test_crash_01', {})
+  exe buf .. "bw!"
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab

programming_language: Shell
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -699,6 +699,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1848,
 /**/
     1847,
 /**/

programming_language: Ruby
CVE-2015-10069 (published 2023-01-19T08:15Z)

A vulnerability was found in viakondratiuk cash-machine. It has been declared as critical. This vulnerability affects the function is_card_pin_at_session/update_failed_attempts of the file machine.py. The manipulation leads to sql injection. The name of the patch is 62a6e24efdfa195b70d7df140d8287fdc38eb66d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218896.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/viakondratiuk/cash-machine
commit_details: repo_url: https://github.com/viakondratiuk/cash-machine
author: Vyacheslav Kondratyuk
author_date: 2015-03-22 22:50:58+02:00
msg: Prevent sql injection, refresh db.
repository: repo_url: https://github.com/viakondratiuk/cash-machine
repo_name: viakondratiuk/cash-machine
repo_language: Python
owner: viakondratiuk
file_changes: filename: machine.py
change_type: ModificationType.MODIFY
diff: @@ -151,8 +151,7 @@ def is_card_pin_at_session(request):
     return 'card' in request.session and request.session['card']['valid_pin'] is True
 
 def get_card(request, cc_number):
-    q = "select * from cards where cc_number = '%s'" % cc_number.replace('-', '')
-    row = request.db.execute(q).fetchone()
+    row = request.db.execute("select * from cards where cc_number = ?", (cc_number.replace('-', ''),)).fetchone()
     if row is not None:
         return dict(
             id = row[0],
@@ -172,7 +171,7 @@ def update_failed_attempts(request, failed_attempts):
 
 def block_card(request):
     card = request.session['card']
-    request.db.execute("update cards set status = 'blocked' where id = %s" % card['id'])
+    request.db.execute("update cards set status = 'blocked' where id = ?", (card['id'],))
     request.db.commit()
 
 def save_balance_check(request):

programming_language: Python
CVE-2016-7528 (published 2017-04-19T14:59Z)

The ReadVIFFImage function in coders/viff.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via a crafted VIFF file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2016-01-24 17:43:46-05:00
msg: https://github.com/ImageMagick/ImageMagick/issues/99
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: viff.c
change_type: ModificationType.MODIFY
diff: @@ -502,8 +502,8 @@ static Image *ReadVIFFImage(const ImageInfo *image_info,
       max_packets=((image->columns+7UL) >> 3UL)*image->rows;
     else
       max_packets=(size_t) (number_pixels*viff_info.number_data_bands);
-    pixels=(unsigned char *) AcquireQuantumMemory(max_packets,
-      bytes_per_pixel*sizeof(*pixels));
+    pixels=(unsigned char *) AcquireQuantumMemory(MagickMax(number_pixels,
+      max_packets),bytes_per_pixel*sizeof(*pixels));
     if (pixels == (unsigned char *) NULL)
       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
     count=ReadBlob(image,bytes_per_pixel*max_packets,pixels);

programming_language: Objective-C