starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2020-13848 (published 2020-06-04T20:15Z)

Portable UPnP SDK (aka libupnp) 1.12.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted SSDP message due to a NULL pointer dereference in the functions FindServiceControlURLPath and FindServiceEventURLPath in genlib/service_table/service_table.c.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/pupnp/pupnp
commit_details: repo_url: https://github.com/pupnp/pupnp
author: Marcelo Roberto Jimenez
author_date: 2020-06-04 12:03:03-03:00
msg: Fixes #177: NULL pointer dereference in FindServiceControlURLPath

Also fixes its dual bug in FindServiceEventURLPath.
repository: repo_url: https://github.com/pupnp/pupnp
repo_name: pupnp/pupnp
description: libupnp: Build UPnP-compliant control points, devices, and bridges on several operating systems.
repo_language: C
owner: pupnp
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -2,6 +2,12 @@
 Version 1.12.2
 *******************************************************************************
 
+2020-06-04 Patrik Lantz pjlantz(at)github
+
+        Fixes #177
+
+        NULL pointer dereference in FindServiceControlURLPath
+
 *******************************************************************************
 Version 1.12.1
 *******************************************************************************

programming_language: C++
filename: service_table.c
change_type: ModificationType.MODIFY
diff: @@ -282,9 +282,11 @@ service_info *FindServiceEventURLPath(
 	uri_type parsed_url;
 	uri_type parsed_url_in;
 
-	if (table &&
-		parse_uri(eventURLPath, strlen(eventURLPath), &parsed_url_in) ==
-			HTTP_SUCCESS) {
+	if (!table || !eventURLPath) {
+		return NULL;
+	}
+	if (parse_uri(eventURLPath, strlen(eventURLPath), &parsed_url_in) ==
+		HTTP_SUCCESS) {
 		finger = table->serviceList;
 		while (finger) {
 			if (finger->eventURL) {
@@ -327,9 +329,11 @@ service_info *FindServiceControlURLPath(
 	uri_type parsed_url;
 	uri_type parsed_url_in;
 
-	if (table && parse_uri(controlURLPath,
-			     strlen(controlURLPath),
-			     &parsed_url_in) == HTTP_SUCCESS) {
+	if (!table || !controlURLPath) {
+		return NULL;
+	}
+	if (parse_uri(controlURLPath, strlen(controlURLPath), &parsed_url_in) ==
+		HTTP_SUCCESS) {
 		finger = table->serviceList;
 		while (finger) {
 			if (finger->controlURL) {

programming_language: C
CVE-2017-12476 (published 2017-09-06T08:29Z)

The AP4_AvccAtom::InspectFields function in Core/Ap4AvccAtom.cpp in Bento4 mp4dump before 1.5.0-616 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted mp4 file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/axiomatic-systems/Bento4
commit_details: repo_url: https://github.com/axiomatic-systems/Bento4
author: Gilles Boccon-Gibod
author_date: 2017-07-30 15:29:24-07:00
msg: fixed possible crashes on malformed inputs.
repository: repo_url: https://github.com/axiomatic-systems/Bento4
repo_name: axiomatic-systems/Bento4
description: Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
repo_language: C++
owner: axiomatic-systems
file_changes: filename: Ap4AtomSampleTable.cpp
change_type: ModificationType.MODIFY
diff: @@ -87,6 +87,11 @@ AP4_AtomSampleTable::GetSample(AP4_Ordinal index,
 {
     AP4_Result result;
 
+    // check that we have an stsc atom
+    if (!m_StscAtom) {
+        return AP4_ERROR_INVALID_FORMAT;
+    }
+    
     // check that we have a chunk offset table
     if (m_StcoAtom == NULL && m_Co64Atom == NULL) {
         return AP4_ERROR_INVALID_FORMAT;

programming_language: C++
filename: Ap4AvccAtom.cpp
change_type: ModificationType.MODIFY
diff: @@ -270,7 +270,7 @@ AP4_AvccAtom::InspectFields(AP4_AtomInspector& inspector)
     for (unsigned int i=0; i<m_SequenceParameters.ItemCount(); i++) {
         inspector.AddField("Sequence Parameter", m_SequenceParameters[i].GetData(), m_SequenceParameters[i].GetDataSize());
     }
-    for (unsigned int i=0; i<m_SequenceParameters.ItemCount(); i++) {
+    for (unsigned int i=0; i<m_PictureParameters.ItemCount(); i++) {
         inspector.AddField("Picture Parameter", m_PictureParameters[i].GetData(), m_PictureParameters[i].GetDataSize());
     }
     return AP4_SUCCESS;

programming_language: C++
filename: Ap4Processor.cpp
change_type: ModificationType.MODIFY
diff: @@ -554,6 +554,7 @@ AP4_Processor::Process(AP4_ByteStream&   input,
             int cursor = -1;
             for (unsigned int i=0; i<track_count; i++) {
                 if (!cursors[i].m_EndReached &&
+                    cursors[i].m_Locator.m_SampleTable &&
                     cursors[i].m_Locator.m_Sample.GetOffset() <= min_offset) {
                     min_offset = cursors[i].m_Locator.m_Sample.GetOffset();
                     cursor = i;

programming_language: C++
filename: Ap4Version.h
change_type: ModificationType.MODIFY
diff: @@ -37,7 +37,7 @@
 /**
  * Version number of the SDK
  */
-#define AP4_VERSION        0x01050000
-#define AP4_VERSION_STRING "1.5.0.0"
+#define AP4_VERSION        0x01050001
+#define AP4_VERSION_STRING "1.5.0.1"
 
 #endif // _AP4_VERSION_H_

programming_language: C
CVE-2023-23006 (published 2023-03-01T20:15Z)

In the Linux kernel before 5.15.13, drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c misinterprets the mlx5_get_uars_page return value (expects it to be NULL in the error case, whereas it is actually an error pointer).

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Miaoqian Lin
author_date: 2021-12-22 06:54:53+00:00
msg: net/mlx5: DR, Fix NULL vs IS_ERR checking in dr_domain_init_resources

The mlx5_get_uars_page() function  returns error pointers.
Using IS_ERR() to check the return value to fix this.

Fixes: 4ec9e7b02697 ("net/mlx5: DR, Expose steering domain functionality")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: dr_domain.c
change_type: ModificationType.MODIFY
diff: @@ -2,6 +2,7 @@
 /* Copyright (c) 2019 Mellanox Technologies. */
 
 #include <linux/mlx5/eswitch.h>
+#include <linux/err.h>
 #include "dr_types.h"
 
 #define DR_DOMAIN_SW_STEERING_SUPPORTED(dmn, dmn_type)	\
@@ -72,9 +73,9 @@ static int dr_domain_init_resources(struct mlx5dr_domain *dmn)
 	}
 
 	dmn->uar = mlx5_get_uars_page(dmn->mdev);
-	if (!dmn->uar) {
+	if (IS_ERR(dmn->uar)) {
 		mlx5dr_err(dmn, "Couldn't allocate UAR\n");
-		ret = -ENOMEM;
+		ret = PTR_ERR(dmn->uar);
 		goto clean_pd;
 	}
 

programming_language: C
CVE-2022-29779 (published 2022-06-02T14:15Z)

Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_value_own_enumerate at src/njs_value.c.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/nginx/njs
commit_details: repo_url: https://github.com/nginx/njs
author: Dmitry Volyntsev
author_date: 2022-04-22 17:02:36-07:00
msg: Fixed Array.prototype.slice() with slow "this" argument.

Previously, when "this" argument was not a fast array, but the "deleted" array
was a fast array, the "deleted" array may be left in uninitialized state if
"this" argument had gaps.

This fix is to ensure that "deleted" is properly initialized.

This fixes #485 issue on Github.
repository: repo_url: https://github.com/nginx/njs
repo_name: nginx/njs
description: A subset of JavaScript language to use in nginx
repo_language: C
owner: nginx
file_changes: filename: njs_array.c
change_type: ModificationType.MODIFY
diff: @@ -1284,6 +1284,11 @@ njs_array_prototype_splice(njs_vm_t *vm, njs_value_t *args, njs_uint_t nargs,
                 if (njs_slow_path(ret == NJS_ERROR)) {
                     return ret;
                 }
+
+            } else {
+                if (deleted->object.fast_array) {
+                    njs_set_invalid(&deleted->start[i]);
+                }
             }
         }
 

programming_language: C
filename: njs_unit_test.c
change_type: ModificationType.MODIFY
diff: @@ -4869,6 +4869,15 @@ static njs_unit_test_t  njs_test[] =
               "Array.prototype.splice.call(obj, 2**53-2, 0, 'C');"),
       njs_str("TypeError: Invalid length") },
 
+    { njs_str("var a = {1: 'B', length: 2};"
+              "Array.prototype.splice.call(a, 0)"),
+      njs_str(",B") },
+
+    { njs_str("var a = new Uint8Array();"
+              "a.__proto__ = [1,2,3];"
+              "a.splice(0)"),
+      njs_str(",,") },
+
     { njs_str("var a = []; a.reverse()"),
       njs_str("") },
 

programming_language: JavaScript
CVE-2023-4454 (published 2023-08-21T10:15Z)

Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.

CVSS v3 base score: 5.7, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/wallabag/wallabag
commit_details: repo_url: https://github.com/wallabag/wallabag
author: Nicolas Lœuillet
author_date: 2023-08-21 11:08:24+02:00
msg: Merge pull request from GHSA-p8gp-899c-jvq9

Replace GET way to POST way to reset data user
repository: repo_url: https://github.com/wallabag/wallabag
repo_name: wallabag/wallabag
description: wallabag is a self hostable application for saving web pages: Save and classify articles. Read them later. Freely.
repo_language: PHP
owner: wallabag
CVE-2023-22999 (published 2023-02-28T21:15Z)

In the Linux kernel before 5.16.3, drivers/usb/dwc3/dwc3-qcom.c misinterprets the dwc3_qcom_create_urs_usb_platdev return value (expects it to be NULL in the error case, whereas it is actually an error pointer).

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Miaoqian Lin
author_date: 2021-12-22 11:18:23+00:00
msg: usb: dwc3: qcom: Fix NULL vs IS_ERR checking in dwc3_qcom_probe

Since the acpi_create_platform_device() function may return error
pointers, dwc3_qcom_create_urs_usb_platdev() function may return error
pointers too. Using IS_ERR_OR_NULL() to check the return value to fix this.

Fixes: c25c210f590e ("usb: dwc3: qcom: add URS Host support for sdm845 ACPI boot")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Link: https://lore.kernel.org/r/20211222111823.22887-1-linmq006@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: dwc3-qcom.c
change_type: ModificationType.MODIFY
diff: @@ -775,9 +775,12 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
 
 		if (qcom->acpi_pdata->is_urs) {
 			qcom->urs_usb = dwc3_qcom_create_urs_usb_platdev(dev);
-			if (!qcom->urs_usb) {
+			if (IS_ERR_OR_NULL(qcom->urs_usb)) {
 				dev_err(dev, "failed to create URS USB platdev\n");
-				return -ENODEV;
+				if (!qcom->urs_usb)
+					return -ENODEV;
+				else
+					return PTR_ERR(qcom->urs_usb);
 			}
 		}
 	}

programming_language: C
CVE-2021-41167 (published 2021-10-20T19:15Z)

modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they don't. Any code calling these functions will be written thinking they would limit the concurrency but they won't. This could lead to potential security issues in other projects. The problem has been patched in 1.0.4. There is no workaround.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-770
cwe_name: Allocation of Resources Without Limits or Throttling
description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
extended_description: Code frequently has to work with limited resources, so programmers must be careful to ensure that resources are not consumed too quickly, or too easily.  Without use of quotas, resource limits, or other protection mechanisms, it can be easy for an attacker to consume many resources by rapidly making many requests, or causing larger resources to be used than is needed. When too many resources are allocated, or if a single resource is too large, then it can prevent the code from working correctly, possibly leading to a denial of service.
         

Fix information:
repo_url: https://github.com/nicolas-van/modern-async
commit_details: repo_url: https://github.com/nicolas-van/modern-async
author: Nicolas Vanhoren
author_date: 2021-10-19 23:22:02+02:00
msg: Fix #5
repository: repo_url: https://github.com/nicolas-van/modern-async
repo_name: nicolas-van/modern-async
description: A modern JavaScript tooling library for asynchronous operations using async/await, promises and async generators
repo_language: JavaScript
owner: nicolas-van
file_changes: filename: forEachLimit.mjs
change_type: ModificationType.MODIFY
diff: @@ -35,7 +35,7 @@ import mapLimit from './mapLimit.mjs'
  */
 async function forEachLimit (iterable, iteratee, concurrency) {
   await mapLimit(iterable, async (v, i, t) => {
-    iteratee(v, i, t)
+    await iteratee(v, i, t)
   }, concurrency)
 }
 

programming_language: TypeScript
CVE-2017-6890 (published 2017-05-15T18:29Z)

A boundary error within the "foveon_load_camf()" function (dcraw_foveon.c) when initializing a huffman table in LibRaw-demosaic-pack-GPL2 before 0.18.2 can be exploited to cause a stack-based buffer overflow.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/LibRaw/LibRaw-demosaic-pack-GPL2
commit_details: repo_url: https://github.com/LibRaw/LibRaw-demosaic-pack-GPL2
author: Alex Tutubalin
author_date: 2017-03-04 19:55:24+03:00
msg: Fixed possible foveon buffer overrun (Secunia SA750000)
repository: repo_url: https://github.com/LibRaw/LibRaw-demosaic-pack-GPL2
repo_name: LibRaw/LibRaw-demosaic-pack-GPL2
description: Demosaic methods for LibRaw distributed under the terms of GPL2+
repo_language: C
owner: LibRaw
file_changes: filename: dcraw_foveon.c
change_type: ModificationType.MODIFY
diff: @@ -319,7 +319,7 @@ void CLASS foveon_huff (ushort *huff)
 void CLASS foveon_dp_load_raw()
 {
   unsigned c, roff[4], row, col, diff;
-  ushort huff[512], vpred[2][2], hpred[2];
+  ushort huff[1024], vpred[2][2], hpred[2];
 
   fseek (ifp, 8, SEEK_CUR);
   foveon_huff (huff);
@@ -346,12 +346,16 @@ void CLASS foveon_dp_load_raw()
 void CLASS foveon_load_camf()
 {
   unsigned type, wide, high, i, j, row, col, diff;
-  ushort huff[258], vpred[2][2] = {{512,512},{512,512}}, hpred[2];
+  ushort huff[1024], vpred[2][2] = {{512,512},{512,512}}, hpred[2];
 
   fseek (ifp, meta_offset, SEEK_SET);
   type = get4();  get4();  get4();
   wide = get4();
   high = get4();
+#ifdef LIBRAW_LIBRARY_BUILD
+  if(wide>32767 || high > 32767 || wide*high > 20000000)
+     throw LIBRAW_EXCEPTION_IO_CORRUPT;
+#endif
   if (type == 2) {
     fread (meta_data, 1, meta_length, ifp);
     for (i=0; i < meta_length; i++) {

programming_language: C
CVE-2023-47130 (published 2023-11-14T21:15Z)

Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system. A fix has been developed for the 1.1.29 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-502
cwe_name: Deserialization of Untrusted Data
description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
extended_description: 
            It is often convenient to serialize objects for communication or to save them for later use. However, deserialized data or code can often be modified without using the provided accessor functions if it does not use cryptography to protect itself. Furthermore, any cryptography would still be client-side security -- which is a dangerous security assumption.
            Data that is untrusted can not be trusted to be well-formed.
            When developers place no restrictions on "gadget chains," or series of instances and method invocations that can self-execute during the deserialization process (i.e., before the object is returned to the caller), it is sometimes possible for attackers to leverage them to perform unauthorized actions, like generating a shell.
         
         

Fix information:
repo_url: https://github.com/yiisoft/yii
commit_details: repo_url: https://github.com/yiisoft/yii
author: Marco van 't Wout
author_date: 2023-11-14 10:18:46+01:00
msg: Merge pull request from GHSA-mw2w-2hj2-fg8q

Advisory fix
repository: repo_url: https://github.com/yiisoft/yii
repo_name: yiisoft/yii
description: Yii PHP Framework 1.1.x
repo_language: PHP
owner: yiisoft
CVE-2013-0262 (published 2013-02-08T20:55Z)

rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/rack/rack
commit_details: repo_url: https://github.com/rack/rack
author: James Tucker
author_date: 2013-02-06 16:25:22-08:00
msg: Prevent symlink path traversals

 * Closes CVE-2013-0262
repository: repo_url: https://github.com/rack/rack
repo_name: rack/rack
description: A modular Ruby web server interface.
repo_language: Ruby
owner: rack
file_changes: filename: file.rb
change_type: ModificationType.MODIFY
diff: @@ -41,19 +41,14 @@ module Rack
       path_info = Utils.unescape(env["PATH_INFO"])
       parts = path_info.split SEPS
 
-      parts.inject(0) do |depth, part|
-        case part
-        when '', '.'
-          depth
-        when '..'
-          return fail(404, "Not Found") if depth - 1 < 0
-          depth - 1
-        else
-          depth + 1
-        end
+      clean = []
+
+      parts.each do |part|
+        next if part.empty? || part == '.'
+        part == '..' ? clean.pop : clean << part
       end
 
-      @path = F.join(@root, *parts)
+      @path = F.join(@root, *clean)
 
       available = begin
         F.file?(@path) && F.readable?(@path)

programming_language: Ruby