starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2019-6976 (published 2019-01-26T23:29Z)

libvips before 8.7.4 generates output images from uninitialized memory locations when processing corrupted input image data because iofuncs/memory.c does not zero out allocated memory. This can result in leaking raw process memory contents through the output image.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-908
cwe_name: Use of Uninitialized Resource
description: The product uses or accesses a resource that has not been initialized.
extended_description: When a resource has not been properly initialized, the product may behave unexpectedly. This may lead to a crash or invalid memory access, but the consequences vary depending on the type of resource and how it is used within the product.
         

Fix information:
repo_url: https://github.com/libvips/libvips
commit_details: repo_url: https://github.com/libvips/libvips
author: John Cupitt
author_date: 2019-01-18 10:10:43+00:00
msg: zero memory on malloc

to prevent write of uninit memory under some error conditions

thanks Balint
repository: repo_url: https://github.com/libvips/libvips
repo_name: libvips/libvips
description: A fast image processing library with low memory needs.
repo_language: C
owner: libvips
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,8 @@
 4/1/19 started 8.7.4
-- magicksave with magick6 API did not chain exceptions correctly [kleisauke]
+- magicksave with magick6 API did not chain exceptions correctly causing a
+  memory leak under some conditions [kleisauke]
+- zero memory on allocate to prevent write of uninitialized memory under some 
+  error conditions [Balint Varga-Perke]
 
 21/11/18 started 8.7.3
 - fix infinite loop for autofit with non-scaleable font 

programming_language: Markdown
filename: memory.c
change_type: ModificationType.MODIFY
diff: @@ -173,7 +173,7 @@ vips_malloc( VipsObject *object, size_t size )
 {
 	void *buf;
 
-	buf = g_malloc( size );
+	buf = g_malloc0( size );
 
         if( object ) {
 		g_signal_connect( object, "postclose", 
@@ -317,7 +317,7 @@ vips_tracked_malloc( size_t size )
 	 */
 	size += 16;
 
-        if( !(buf = g_try_malloc( size )) ) {
+        if( !(buf = g_try_malloc0( size )) ) {
 #ifdef DEBUG
 		g_assert_not_reached();
 #endif /*DEBUG*/

programming_language: C
CVE-2015-2830 (published 2015-05-27T10:59Z)

arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrated by an attack against seccomp before 3.16.

Severity: LOW
CVSS v2 base score: 1.9 (AV:L/AC:M/Au:N/C:N/I:P/A:N)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Andy Lutomirski
author_date: 2015-03-05 01:09:44+01:00
msg: x86/asm/entry/64: Remove a bogus 'ret_from_fork' optimization

'ret_from_fork' checks TIF_IA32 to determine whether 'pt_regs' and
the related state make sense for 'ret_from_sys_call'.  This is
entirely the wrong check.  TS_COMPAT would make a little more
sense, but there's really no point in keeping this optimization
at all.

This fixes a return to the wrong user CS if we came from int
0x80 in a 64-bit task.

Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: <stable@vger.kernel.org>
Link: http://lkml.kernel.org/r/4710be56d76ef994ddf59087aad98c000fbab9a4.1424989793.git.luto@amacapital.net
[ Backported from tip:x86/asm. ]
Signed-off-by: Ingo Molnar <mingo@kernel.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: entry_64.S
change_type: ModificationType.MODIFY
diff: @@ -269,11 +269,14 @@ ENTRY(ret_from_fork)
 	testl $3, CS-ARGOFFSET(%rsp)		# from kernel_thread?
 	jz   1f
 
-	testl $_TIF_IA32, TI_flags(%rcx)	# 32-bit compat task needs IRET
-	jnz  int_ret_from_sys_call
-
-	RESTORE_TOP_OF_STACK %rdi, -ARGOFFSET
-	jmp ret_from_sys_call			# go to the SYSRET fastpath
+	/*
+	 * By the time we get here, we have no idea whether our pt_regs,
+	 * ti flags, and ti status came from the 64-bit SYSCALL fast path,
+	 * the slow path, or one of the ia32entry paths.
+	 * Use int_ret_from_sys_call to return, since it can safely handle
+	 * all of the above.
+	 */
+	jmp  int_ret_from_sys_call
 
 1:
 	subq $REST_SKIP, %rsp	# leave space for volatiles

programming_language: C
CVE-2022-3256 (published 2022-09-22T13:15Z)

Use After Free in GitHub repository vim/vim prior to 9.0.0530.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2022-09-21 13:07:22+01:00
msg: patch 9.0.0530: using freed memory when autocmd changes mark

Problem:    Using freed memory when autocmd changes mark.
Solution:   Copy the mark before editing another buffer.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: mark.c
change_type: ModificationType.MODIFY
diff: @@ -221,17 +221,19 @@ movemark(int count)
 	    fname2fnum(jmp);
 	if (jmp->fmark.fnum != curbuf->b_fnum)
 	{
-	    // jump to other file
-	    if (buflist_findnr(jmp->fmark.fnum) == NULL)
+	    // Make a copy, an autocommand may make "jmp" invalid.
+	    fmark_T fmark = jmp->fmark;
+
+	    // jump to the file with the mark
+	    if (buflist_findnr(fmark.fnum) == NULL)
 	    {					     // Skip this one ..
 		count += count < 0 ? -1 : 1;
 		continue;
 	    }
-	    if (buflist_getfile(jmp->fmark.fnum, jmp->fmark.mark.lnum,
-							    0, FALSE) == FAIL)
+	    if (buflist_getfile(fmark.fnum, fmark.mark.lnum, 0, FALSE) == FAIL)
 		return (pos_T *)NULL;
 	    // Set lnum again, autocommands my have changed it
-	    curwin->w_cursor = jmp->fmark.mark;
+	    curwin->w_cursor = fmark.mark;
 	    pos = (pos_T *)-1;
 	}
 	else

programming_language: C
filename: test_marks.vim
change_type: ModificationType.MODIFY
diff: @@ -305,4 +305,17 @@ func Test_getmarklist()
   close!
 endfunc
 
+" This was using freed memory
+func Test_jump_mark_autocmd()
+  next 00
+  edit 0
+  sargument
+  au BufEnter 0 all
+  sil norm 
+
+  au! BufEnter
+  bwipe!
+endfunc
+
+
 " vim: shiftwidth=2 sts=2 expandtab

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -699,6 +699,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    530,
 /**/
     529,
 /**/

programming_language: Ruby
CVE-2015-10060 (published 2023-01-17T13:15Z)

A vulnerability was found in MNBikeways database and classified as critical. This issue affects some unknown processing of the file Data/views.py. The manipulation of the argument id1/id2 leads to sql injection. The identifier of the patch is 829a027aca7c17f5a7ec1addca8dd5d5542f86ac. It is recommended to apply a patch to fix this issue. The identifier VDB-218417 was assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/MNBikeways/database
commit_details: repo_url: https://github.com/MNBikeways/database
author: boydjohnson
author_date: 2015-06-22 10:14:53-05:00
msg: Get rid of SQL injection possibility on /router http url
repository: repo_url: https://github.com/MNBikeways/database
repo_name: MNBikeways/database
description: Searching, Routing Biketrails app with Python, Django, Postgres, Postgis, and pgRouting.
repo_language: HTML
owner: MNBikeways
file_changes: filename: views.py
change_type: ModificationType.MODIFY
diff: @@ -51,7 +51,7 @@ class RouterAjax(View):
         sql_function = "select ccp_name, the_geom from pgr_dijkstra(\'"
 
         cursor = connection.cursor()
-        cursor.execute(sql_function+sql_inside_of_function+","+str(id1)+","+str(id2)+", true,true) join \"Data_minnesotabiketrails\" as bt on bt.id=id2")
+        cursor.execute(sql_function+sql_inside_of_function+", %s , %s , true,true) join \"Data_minnesotabiketrails\" as bt on bt.id=id2",(str(id1),str(id2),))
         all = cursor.fetchall()
         names = []
         gj = []

programming_language: Python
CVE-2021-43800 (published 2021-12-06T19:15Z)

Wiki.js is a wiki app built on Node.js. Prior to version 2.5.254, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled on a Windows host. A malicious user can potentially read any file on the file system by crafting a special URL that allows for directory traversal. This is only possible on a Wiki.js server running on Windows, when a storage module implementing local asset cache (e.g Local File System or Git) is enabled and that no web application firewall solution (e.g. cloudflare) strips potentially malicious URLs. Commit number 414033de9dff66a327e3f3243234852f468a9d85 fixes this vulnerability by sanitizing the path before it is passed on to the storage module. The sanitization step removes any windows directory traversal sequences from the path. As a workaround, disable any storage module with local asset caching capabilities (Local File System, Git).

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/Requarks/wiki
commit_details: repo_url: https://github.com/Requarks/wiki
author: NGPixel
author_date: 2021-12-03 22:30:22-05:00
msg: fix: asset path traversal on windows
repository: repo_url: https://github.com/Requarks/wiki
repo_name: requarks/wiki
description: Wiki.js | A modern and powerful wiki app built on Node.js
repo_language: Vue
owner: Requarks
file_changes: filename: page.js
change_type: ModificationType.MODIFY
diff: @@ -35,6 +35,8 @@ module.exports = {
     rawPath = rawPath.replace(unsafeCharsRegex, '')
     if (rawPath === '') { rawPath = 'home' }
 
+    rawPath = rawPath.replaceAll('\\', '').replaceAll('//', '').replaceAll(/\.\.+/ig, '')
+
     // Extract Info
     let pathParts = _.filter(_.split(rawPath, '/'), p => {
       p = _.trim(p)

programming_language: JavaScript
CVE-2020-14400 (published 2020-06-17T16:15Z)

An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. NOTE: Third parties do not consider this to be a vulnerability as there is no known path of exploitation or cross of a trust boundary

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/LibVNC/libvncserver
commit_details: repo_url: https://github.com/LibVNC/libvncserver
author: Tobias Junghans
author_date: 2020-05-27 12:22:05+02:00
msg: libvncserver: fix pointer aliasing/alignment issue

Accessing byte-aligned data through uint16_t pointers can cause crashes
on some platforms or reduce the performance. Therefore ensure a proper
stack alignment.
repository: repo_url: https://github.com/LibVNC/libvncserver
repo_name: LibVNC/libvncserver
description: LibVNCServer/LibVNCClient are cross-platform C libraries that allow you to easily implement VNC server or client functionality in your program.
repo_language: C
owner: LibVNC
file_changes: filename: translate.c
change_type: ModificationType.MODIFY
diff: @@ -360,9 +360,12 @@ rfbSetTranslateFunction(rfbClientPtr cl)
 static rfbBool
 rfbSetClientColourMapBGR233(rfbClientPtr cl)
 {
-    char buf[sz_rfbSetColourMapEntriesMsg + 256 * 3 * 2];
-    rfbSetColourMapEntriesMsg *scme = (rfbSetColourMapEntriesMsg *)buf;
-    uint16_t *rgb = (uint16_t *)(&buf[sz_rfbSetColourMapEntriesMsg]);
+    union {
+        char bytes[sz_rfbSetColourMapEntriesMsg + 256 * 3 * 2];
+        rfbSetColourMapEntriesMsg msg;
+    } buf;
+    rfbSetColourMapEntriesMsg *scme = &buf.msg;
+    uint16_t *rgb = (uint16_t *)(&buf.bytes[sz_rfbSetColourMapEntriesMsg]);
     int i, len;
     int r, g, b;
 
@@ -394,7 +397,7 @@ rfbSetClientColourMapBGR233(rfbClientPtr cl)
 
     len += 256 * 3 * 2;
 
-    if (rfbWriteExact(cl, buf, len) < 0) {
+    if (rfbWriteExact(cl, buf.bytes, len) < 0) {
         rfbLogPerror("rfbSetClientColourMapBGR233: write");
         rfbCloseClient(cl);
         return FALSE;

programming_language: C
CVE-2022-0362 (published 2022-01-26T13:15Z)

SQL Injection in Packagist showdoc/showdoc prior to 2.10.3.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/star7th/showdoc
commit_details: repo_url: https://github.com/star7th/showdoc
author: star7th
author_date: 2022-01-25 20:34:52+08:00
msg: bug
repository: repo_url: https://github.com/star7th/showdoc
repo_name: star7th/showdoc
description: ShowDoc is a tool greatly applicable for an IT team to share documents online一个非常适合IT团队的在线API文档、技术文档工具
repo_language: JavaScript
owner: star7th
file_changes: filename: AdminUserController.class.php
change_type: ModificationType.MODIFY
diff: @@ -76,7 +76,7 @@ class AdminUserController extends BaseController {
         $this->checkAdmin();
         $username = I("post.username");
         $password = I("post.password");
-        $uid = I("post.uid");
+        $uid = I("post.uid/d");
         $name = I("post.name");
         if(!$username){
             $this->sendError(10101,'用户名不允许为空');

programming_language: PHP
CVE-2016-3140 (published 2016-05-02T10:59Z)

The digi_port_init function in drivers/usb/serial/digi_acceleport.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 4.6, MEDIUM (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Oliver Neukum
author_date: 2016-03-31 12:04:26-04:00
msg: USB: digi_acceleport: do sanity checking for the number of ports

The driver can be crashed with devices that expose crafted descriptors
with too few endpoints.

See: http://seclists.org/bugtraq/2016/Mar/61

Signed-off-by: Oliver Neukum <ONeukum@suse.com>
[johan: fix OOB endpoint check and add error messages ]
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: digi_acceleport.c
change_type: ModificationType.MODIFY
diff: @@ -1251,8 +1251,27 @@ static int digi_port_init(struct usb_serial_port *port, unsigned port_num)
 
 static int digi_startup(struct usb_serial *serial)
 {
+	struct device *dev = &serial->interface->dev;
 	struct digi_serial *serial_priv;
 	int ret;
+	int i;
+
+	/* check whether the device has the expected number of endpoints */
+	if (serial->num_port_pointers < serial->type->num_ports + 1) {
+		dev_err(dev, "OOB endpoints missing\n");
+		return -ENODEV;
+	}
+
+	for (i = 0; i < serial->type->num_ports + 1 ; i++) {
+		if (!serial->port[i]->read_urb) {
+			dev_err(dev, "bulk-in endpoint missing\n");
+			return -ENODEV;
+		}
+		if (!serial->port[i]->write_urb) {
+			dev_err(dev, "bulk-out endpoint missing\n");
+			return -ENODEV;
+		}
+	}
 
 	serial_priv = kzalloc(sizeof(*serial_priv), GFP_KERNEL);
 	if (!serial_priv)

programming_language: C
CVE-2021-40985 (published 2021-11-03T17:15Z)

A stack-based buffer under-read in htmldoc before 1.9.12, allows attackers to cause a denial of service via a crafted BMP image to image_load_bmp.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/michaelrsweet/htmldoc
commit_details: repo_url: https://github.com/michaelrsweet/htmldoc
author: Michael R Sweet
author_date: 2021-09-11 18:12:33-04:00
msg: Fix BMP crash bug (Issue #444)
repository: repo_url: https://github.com/michaelrsweet/htmldoc
repo_name: michaelrsweet/htmldoc
description: HTML Conversion Software
repo_language: C++
owner: michaelrsweet
file_changes: filename: CHANGES.md
change_type: ModificationType.MODIFY
diff: @@ -5,6 +5,7 @@
   (Issue #433)
 - Fixed a crash bug when a HTML comment contains an invalid nul character
   (Issue #439)
+- Fixed a crash bug with bogus BMP images (Issue #444)
 
 
 # Changes in HTMLDOC v1.9.12

programming_language: Markdown
filename: image.cxx
change_type: ModificationType.MODIFY
diff: @@ -915,6 +915,9 @@ image_load_bmp(image_t *img,	/* I - Image to load into */
   colors_used      = (int)read_dword(fp);
   read_dword(fp);
 
+  if (img->width <= 0 || img->width > 8192 || img->height <= 0 || img->height > 8192)
+    return (-1);
+
   if (info_size > 40)
     for (info_size -= 40; info_size > 0; info_size --)
       getc(fp);
@@ -926,7 +929,7 @@ image_load_bmp(image_t *img,	/* I - Image to load into */
   fread(colormap, (size_t)colors_used, 4, fp);
 
   // Setup image and buffers...
-  img->depth  = gray ? 1 : 3;
+  img->depth = gray ? 1 : 3;
 
   // If this image is indexed and we are writing an encrypted PDF file, bump the use count so
   // we create an image object (Acrobat 6 bug workaround)
@@ -1076,7 +1079,7 @@ image_load_bmp(image_t *img,	/* I - Image to load into */
             if (bit == 0xf0)
 	    {
               if (color < 0)
-		temp = getc(fp);
+		temp = getc(fp) & 255;
 	      else
 		temp = color;
 

programming_language: C
CVE-2023-5520 (published 2023-10-11T12:15Z)

Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.

CVSS v3 base score: 7.1, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: Aurelien David
author_date: 2023-10-11 13:24:46+02:00
msg: ac3dmx: add remain size check (fixes #2627)
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: reframe_ac3.c
change_type: ModificationType.MODIFY
diff: @@ -342,7 +342,7 @@ GF_Err ac3dmx_process(GF_Filter *filter)
 	u8 *start;
 	u32 pck_size, remain, prev_pck_size;
 	u64 cts;
-	
+
 restart:
 	cts = GF_FILTER_NO_TS;
 
@@ -480,10 +480,10 @@ restart:
 			cts = GF_FILTER_NO_TS;
 		}
 
-		if (!ctx->in_seek) {
+		if (!ctx->in_seek && remain >= ctx->hdr.framesize) {
 			dst_pck = gf_filter_pck_new_alloc(ctx->opid, ctx->hdr.framesize, &output);
 			if (!dst_pck) return GF_OUT_OF_MEM;
-			
+
 			if (ctx->src_pck) gf_filter_pck_merge_properties(ctx->src_pck, dst_pck);
 
 			memcpy(output, sync, ctx->hdr.framesize);

programming_language: C