starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2017-12643 (published 2017-08-07T15:29Z)

ImageMagick 7.0.6-1 has a memory exhaustion vulnerability in ReadOneJNGImage in coders\\png.c.

Severity: HIGH
CVSS v2 base score: 7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-770
cwe_name: Allocation of Resources Without Limits or Throttling
description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
extended_description: Code frequently has to work with limited resources, so programmers must be careful to ensure that resources are not consumed too quickly, or too easily.  Without use of quotas, resource limits, or other protection mechanisms, it can be easy for an attacker to consume many resources by rapidly making many requests, or causing larger resources to be used than is needed. When too many resources are allocated, or if a single resource is too large, then it can prevent the code from working correctly, possibly leading to a denial of service.
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2017-07-08 08:16:22-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/549
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: png.c
change_type: ModificationType.MODIFY
diff: @@ -4384,6 +4384,8 @@ static Image *ReadOneJNGImage(MngInfo *mng_info,
 
     if (length != 0)
       {
+        if (length > GetBlobSize(image))
+          ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
         chunk=(unsigned char *) AcquireQuantumMemory(length+MagickPathExtent,
           sizeof(*chunk));
 
@@ -5260,12 +5262,14 @@ static Image *ReadOneMNGImage(MngInfo* mng_info, const ImageInfo *image_info,
 
         if (length != 0)
           {
+            if (length > GetBlobSize(image))
+              ThrowReaderException(CorruptImageError,
+                "InsufficientImageDataInFile");
             chunk=(unsigned char *) AcquireQuantumMemory(length+
              MagickPathExtent,sizeof(*chunk));
 
             if (chunk == (unsigned char *) NULL)
-              ThrowReaderException(ResourceLimitError,
-                "MemoryAllocationFailed");
+              ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
 
             for (i=0; i < (ssize_t) length; i++)
             {

programming_language: C
CVE-2017-12871 (published 2017-09-01T21:29Z)

The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.x through 1.14.11 makes it easier for context-dependent attackers to bypass the encryption protection mechanism by leveraging use of the first 16 bytes of the secret key as the initialization vector (IV).

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.9, MEDIUM (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-326
cwe_name: Inadequate Encryption Strength
description: The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
extended_description: A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.
         

Fix information:
repo_url: https://github.com/simplesamlphp/simplesamlphp
commit_details: repo_url: https://github.com/simplesamlphp/simplesamlphp
author: Jaime Pérez Crespo
author_date: 2017-03-30 10:51:00+02:00
msg: Fix an issue with IV generation in SimpleSAML\Utils\Crypto::aesEncrypt().

IVs must be random and one-time (never reused). Additionally, by deriving it from the key, the key length was effectively reduced to 128 bits.
repository: repo_url: https://github.com/simplesamlphp/simplesamlphp
repo_name: simplesamlphp/simplesamlphp
description: SimpleSAMLphp is an application written in native PHP that deals with authentication.
repo_language: PHP
owner: simplesamlphp
file_changes: filename: Crypto.php
change_type: ModificationType.MODIFY
diff: @@ -86,7 +86,7 @@ class Crypto
         $key    = openssl_digest($secret, 'sha256');
         $method = 'AES-256-CBC';
         $ivSize = 16;
-        $iv     = substr($key, 0, $ivSize);
+        $iv     = openssl_random_pseudo_bytes($ivSize);
 
         return $iv.openssl_encrypt($data, $method, $key, $raw, $iv);
     }

programming_language: PHP
CVE-2018-11382 (published 2018-05-22T19:29Z)

The _inst__sts() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/radare/radare2
commit_details: repo_url: https://github.com/radare/radare2
author: pancake
author_date: 2018-05-15 14:44:47+02:00
msg: Fix #10091 - crash in AVR analysis
repository: repo_url: https://github.com/radare/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radare
file_changes: filename: anal_avr.c
change_type: ModificationType.MODIFY
diff: @@ -925,6 +925,9 @@ INST_HANDLER (lds) {	// LDS Rd, k
 }
 
 INST_HANDLER (sts) {	// STS k, Rr
+	if (len < 4) {
+		return;
+	}
 	int r = ((buf[0] >> 4) & 0xf) | ((buf[1] & 0x1) << 4);
 	int k = (buf[3] << 8) | buf[2];
 	op->ptr = k;

programming_language: C
CVE-2015-10086 (published 2023-02-28T00:15Z)

A vulnerability, which was classified as critical, was found in OpenCycleCompass server-php. Affected is an unknown function of the file api1/login.php. The manipulation of the argument user leads to sql injection. It is possible to launch the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is fa0d9bcf81c711a88172ad0d37a842f029ac3782. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-221808.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/OpenCycleCompass/server-php
commit_details: repo_url: https://github.com/OpenCycleCompass/server-php
author: Raphael Lehmann
author_date: 2015-02-03 20:58:20+01:00
msg: login.php sql injection prevention
repository: repo_url: https://github.com/OpenCycleCompass/server-php
repo_name: OpenCycleCompass/server-php
description: Server for the iBis App
repo_language: PHP
owner: OpenCycleCompass
file_changes: filename: login.php
change_type: ModificationType.MODIFY
diff: @@ -21,7 +21,7 @@ if(isset($_GET["login"]) && isset($_GET["user"]) && !empty($_GET["user"]) && (is
 		$pw = $my->real_escape_string($_GET["password"]);
 	}
 	$success = false;
-	$query = "SELECT `password` FROM `admin_users` WHERE `name` = '".$_GET["user"]."';";
+	$query = "SELECT `password` FROM `admin_users` WHERE `name` = '".$my->real_escape_string($_GET["user"])."';";
 	$result = $my->query($query);
 	if($result->num_rows >= 1){
 		// possible multiple users with same name but different password -> multiple rows in MySQL db

programming_language: PHP
CVE-2014-4978 (published 2017-12-29T22:29Z)

The rs_filter_graph function in librawstudio/rs-filter.c in rawstudio might allow local users to truncate arbitrary files via a symlink attack on (1) /tmp/rs-filter-graph.png or (2) /tmp/rs-filter-graph.

Severity: LOW
CVSS v2 base score: 3.6 (AV:L/AC:L/Au:N/C:N/I:P/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-59
cwe_name: Improper Link Resolution Before File Access ('Link Following')
description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/rawstudio/rawstudio
commit_details: repo_url: https://github.com/rawstudio/rawstudio
author: Anders Brander
author_date: 2014-12-03 08:01:28+01:00
msg: Fixes insecure use of temporary file (CVE-2014-4978).
repository: repo_url: https://github.com/rawstudio/rawstudio
repo_name: rawstudio/rawstudio
description: Rawstudio is an open-source program to read and manipulate RAW images from digital cameras.
repo_language: C
owner: rawstudio
file_changes: filename: rs-filter.c
change_type: ModificationType.MODIFY
diff: @@ -772,17 +772,32 @@ void
 rs_filter_graph(RSFilter *filter)
 {
 	g_return_if_fail(RS_IS_FILTER(filter));
+	gchar *dot_filename;
+	gchar *png_filename;
+	gchar *command_line;
 	GString *str = g_string_new("digraph G {\n");
 
 	rs_filter_graph_helper(str, filter);
 
 	g_string_append_printf(str, "}\n");
-	g_file_set_contents("/tmp/rs-filter-graph", str->str, str->len, NULL);
 
-	if (0 != system("dot -Tpng >/tmp/rs-filter-graph.png </tmp/rs-filter-graph"))
+	/* Here we would like to use g_mkdtemp(), but due to a bug in upstream, that's impossible */
+	dot_filename = g_strdup_printf("/tmp/rs-filter-graph.%u", g_random_int());
+	png_filename = g_strdup_printf("%s.%u.png", dot_filename, g_random_int());
+
+	g_file_set_contents(dot_filename, str->str, str->len, NULL);
+
+	command_line = g_strdup_printf("dot -Tpng >%s <%s", png_filename, dot_filename);
+	if (0 != system(command_line))
 		g_warning("Calling dot failed");
-	if (0 != system("gnome-open /tmp/rs-filter-graph.png"))
+	g_free(command_line);
+
+	command_line = g_strdup_printf("gnome-open %s", png_filename);
+	if (0 != system(command_line))
 		g_warning("Calling gnome-open failed.");
+	g_free(command_line);
 
+	g_free(dot_filename);
+	g_free(png_filename);
 	g_string_free(str, TRUE);
 }

programming_language: C
CVE-2023-2675 (published 2023-11-07T04:13Z)

Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 2023.Q1.1223.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-307
cwe_name: Improper Restriction of Excessive Authentication Attempts
description: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/linagora/twake
commit_details: repo_url: https://github.com/linagora/twake
author: Romaric Mourgues
author_date: 2023-04-05 20:11:30+02:00
msg: 🩹 Patch 4 - Fix guest invitation with new console documentation (#2791)
repository: repo_url: https://github.com/linagora/twake
repo_name: linagora/Twake
description: Twake is a secure open source collaboration platform to improve organizational productivity. 
repo_language: TypeScript
owner: linagora
file_changes: filename: remote.ts
change_type: ModificationType.MODIFY
diff: @@ -57,15 +57,28 @@ export class ConsoleRemoteClient implements ConsoleServiceClient {
 
     if (user.skipInvite && user.name && user.email && user.password) {
       return this.client
-        .post(`/api/companies/${company.code}/users`, user, {
-          auth: this.auth(),
-          headers: {
-            "Content-Type": "application/json",
+        .post(
+          `/api/companies/${company.code}/users`,
+          {
+            ...user,
+            ...(isNewConsole
+              ? {
+                  name: user.lastName ? user.firstName : user.name,
+                  surname: user.lastName,
+                  applicationCodes: ["twake"],
+                }
+              : {}),
           },
-          params: {
-            skipInvite: user.skipInvite,
+          {
+            auth: this.auth(),
+            headers: {
+              "Content-Type": "application/json",
+            },
+            params: {
+              skipInvite: user.skipInvite,
+            },
           },
-        })
+        )
         .then(({ data }) => data);
     } else {
       const invitationData = {

programming_language: TypeScript
CVE-2017-5506 (published 2017-03-24T15:59Z)

Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-415
cwe_name: Double Free
description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
extended_description: When a program calls free() twice with the same argument, the program's memory management data structures become corrupted. This corruption can cause the program to crash or, in some circumstances, cause two later calls to malloc() to return the same pointer. If malloc() returns the same value twice and the program later gives the attacker control over the data that is written into this doubly-allocated memory, the program becomes vulnerable to a buffer overflow attack.
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2017-01-12 12:51:57-05:00
msg: https://github.com/ImageMagick/ImageMagick/issues/354
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: profile.c
change_type: ModificationType.MODIFY
diff: @@ -2043,7 +2043,7 @@ MagickBooleanType SyncExifProfile(Image *image,StringInfo *profile)
             The directory entry contains an offset.
           */
           offset=(ssize_t)  ReadProfileLong(endian,q+8);
-          if ((size_t) (offset+number_bytes) > length)
+          if ((offset < 0) || ((size_t) (offset+number_bytes) > length))
             continue;
           if (~length < number_bytes)
             continue;  /* prevent overflow */

programming_language: Objective-C
CVE-2020-8936 (published 2020-12-15T15:15Z)

An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allows an attacker to make a host call to UntrustedCall. UntrustedCall failed to validate the buffer range within sgx_params and allowed the host to return a pointer that was an address within the enclave memory. This allowed an attacker to read memory values from within the enclave.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/google/asylo
commit_details: repo_url: https://github.com/google/asylo
author: Chong Cai
author_date: 2020-09-25 12:10:12-07:00
msg: Verify UntrustedCall output is outside enclave

PiperOrigin-RevId: 333781703
Change-Id: I9df55c04dc8b04f4bf0bda8e68cc32bca81b933a
repository: repo_url: https://github.com/google/asylo
repo_name: google/asylo
description: An open and flexible framework for developing enclave applications
repo_language: C++
owner: google
file_changes: filename: trusted_sgx.cc
change_type: ModificationType.MODIFY
diff: @@ -288,6 +288,11 @@ PrimitiveStatus TrustedPrimitives::UntrustedCall(uint64_t untrusted_selector,
   if (sgx_params->input) {
     untrusted_cache->Free(const_cast<void *>(sgx_params->input));
   }
+  if (!TrustedPrimitives::IsOutsideEnclave(sgx_params->output,
+                                           sgx_params->output_size)) {
+    TrustedPrimitives::BestEffortAbort(
+        "UntrustedCall: sgx_param output should be in untrusted memory");
+  }
   if (sgx_params->output) {
     // For the results obtained in |output_buffer|, copy them to |output|
     // before freeing the buffer.

programming_language: C++
CVE-2016-6823 (published 2017-01-18T17:59Z)

Integer overflow in the BMP coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (crash) via crafted height and width values, which triggers an out-of-bounds write.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2016-08-15 15:54:42-04:00
msg: Prevent buffer overflow in BMP coder (bug report from pwchen of tencent).
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,6 @@
+2016-08-15  7.0.2-10 Cristy  <quetzlzacatenango@image...>
+  * Prevent buffer overflow in BMP coder (bug report from pwchen of tencent).
+
 2016-08-14  7.0.2-9 Cristy  <quetzlzacatenango@image...>
   * Release ImageMagick version 7.0.2-9, GIT revision 18707:2c02f09:20160814.
 

programming_language: Markdown
filename: bmp.c
change_type: ModificationType.MODIFY
diff: @@ -1682,10 +1682,13 @@ static MagickBooleanType WriteBMPImage(const ImageInfo *image_info,Image *image,
           bmp_info.file_size+=extra_size;
           bmp_info.offset_bits+=extra_size;
         }
+    if ((image->columns != (signed int) image->columns) ||
+        (image->rows != (signed int) image->rows))
+      ThrowWriterException(ImageError,"WidthOrHeightExceedsLimit");
     bmp_info.width=(ssize_t) image->columns;
     bmp_info.height=(ssize_t) image->rows;
     bmp_info.planes=1;
-    bmp_info.image_size=(unsigned int) (bytes_per_line*image->rows);
+    bmp_info.image_size=(unsigned long) (bytes_per_line*image->rows);
     bmp_info.file_size+=bmp_info.image_size;
     bmp_info.x_pixels=75*39;
     bmp_info.y_pixels=75*39;

programming_language: Objective-C
CVE-2023-44379 (published 2024-02-22T15:15Z)

baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in the site search feature. Version 5.0.9 contains a fix for this vulnerability.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/baserproject/basercms
commit_details: repo_url: https://github.com/baserproject/basercms
author: sakaguchi
author_date: 2024-02-22 15:20:39+09:00
msg: Merge pull request from GHSA-66c2-p8rh-qx87
repository: repo_url: https://github.com/baserproject/basercms
repo_name: baserproject/basercms
description: baserCMS :  Based Website Development Project
repo_language: PHP
owner: baserproject
file_changes: filename: site_search_form.php
change_type: ModificationType.MODIFY
diff: @@ -16,7 +16,7 @@ if(!isset($searchIndexesFront)) $searchIndexesFront = null;
 
 <div class="section search-box">
 	<?php echo $this->BcForm->create($searchIndexesFront, array('type' => 'get', 'url' => $url)) ?>
-	<?php echo $this->BcForm->control('q', ['escape' => false]) ?>
+	<?php echo $this->BcForm->control('q') ?>
 	<?php echo $this->BcForm->hidden('site_id', ['value' => $this->getRequest()->getAttribute('currentSite')->id]) ?>
 	<?php echo $this->BcForm->submit('検索', array('div' => false, 'class' => 'submit_button bs-button')) ?>
 	<?php echo $this->BcForm->end() ?>

programming_language: PHP
filename: search.php
change_type: ModificationType.MODIFY
diff: @@ -32,7 +32,7 @@ $this->BcBaser->setTitle(__d('baser_core', '検索結果一覧'));
     <?php if ($contentFolders): ?>
         <?php echo $this->BcBaser->formControl('f', ['type' => 'select', 'options' => $contentFolders, 'empty' => __d('baser_core', 'カテゴリ')]) ?>
     <?php endif ?>
-    <?php echo $this->BcBaser->formControl('q', ['placeholder' => __d('baser_core', 'キーワード'), 'escape' => false, 'div' => false]) ?>
+    <?php echo $this->BcBaser->formControl('q', ['placeholder' => __d('baser_core', 'キーワード'), 'div' => false]) ?>
     <?php echo $this->BcBaser->formHidden('s') ?>
     <?php echo $this->BcBaser->formSubmit(__d('baser_core', '検索'), ['div' => false, 'class' => 'bs-button-small']) ?>
     <?php echo $this->BcBaser->endForm() ?>

programming_language: PHP
CVE-2022-3178 (published 2022-09-12T17:15Z)

Buffer Over-read in GitHub repository gpac/gpac prior to 2.1.0-DEV.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2022-09-12 11:46:55+02:00
msg: fixed #2255
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: box_code_base.c
change_type: ModificationType.MODIFY
diff: @@ -12886,11 +12886,12 @@ GF_Err xtra_box_read(GF_Box *s, GF_BitStream *bs)
 			prop_type = gf_bs_read_u16(bs);
 			prop_size -= 6;
 			ISOM_DECREASE_SIZE_NO_ERR(ptr, prop_size)
-			//add 2 extra bytes for UTF16 case string dump
-			data2 = gf_malloc(sizeof(char) * (prop_size+2));
+			//add 3 extra bytes for UTF16 case string dump (3 because we need 0-aligned short value)
+			data2 = gf_malloc(sizeof(char) * (prop_size+3));
 			gf_bs_read_data(bs, data2, prop_size);
 			data2[prop_size] = 0;
 			data2[prop_size+1] = 0;
+			data2[prop_size+2] = 0;
 			tag_size-=prop_size;
 		} else {
 			prop_size = 0;

programming_language: C