starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2020-10966 (published 2020-03-25T23:15Z)

In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/serghey-rodin/vesta
commit_details: repo_url: https://github.com/serghey-rodin/vesta
author: dpeca
author_date: 2020-03-23 17:28:55+01:00
msg: Preventing manipulation with $_SERVER['HTTP_HOST']
repository: repo_url: https://github.com/serghey-rodin/vesta
repo_name: outroll/vesta
description: VESTA Control Panel
repo_language: PHP
owner: serghey-rodin
file_changes: filename: index.php
change_type: ModificationType.MODIFY
diff: @@ -30,7 +30,7 @@ if ((!empty($_POST['user'])) && (empty($_POST['code']))) {
         } else {
             $mailtext = __('GREETINGS');
         }
-        $mailtext .= __('PASSWORD_RESET_REQUEST',$_SERVER['HTTP_HOST'],$user,$rkey,$_SERVER['HTTP_HOST'],$user,$rkey);
+        $mailtext .= __('PASSWORD_RESET_REQUEST',$hostname,$user,$rkey,$hostname,$user,$rkey);
         if (!empty($rkey)) send_email($to, $subject, $mailtext, $from);
         unset($output);
     }

programming_language: PHP
CVE-2021-30124 (published 2021-07-30T14:15Z)

The unofficial vscode-phpmd (aka PHP Mess Detector) extension before 1.3.0 for Visual Studio Code allows remote attackers to execute arbitrary code via a crafted phpmd.command value in a workspace folder.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/sandhje/vscode-phpmd
commit_details: repo_url: https://github.com/sandhje/vscode-phpmd
author: Sandhjé Bouw
author_date: 2021-04-06 22:49:38+02:00
msg: Fix remote code execution  

See CVE ID CVE-2021-30124
repository: repo_url: https://github.com/sandhje/vscode-phpmd
repo_name: sandhje/vscode-phpmd
description: VSCode PHP Mess Detector extension
repo_language: TypeScript
owner: sandhje
file_changes: filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -40,6 +40,7 @@ Or to use your own PHPMD PHAR on a custom location:
 ```
 "phpmd.command": "php C:/path/to/phpmd.phar"`
 ```
+***Security fix in version 1.3.0:*** *Before version 1.3.0 it was possible to set `phpmd.command` through workspace settings. This unfortunately opened possibilities for a remote code execution attack. Although I recognize that some users used this workspace setting in their day to day work I feel it is more important that anyone can use this extension without worrying about their system's security. As such, since version 1.3.0, this setting is disabled at workspace level to address this issue.* 
 
 ### phpmd.rules: 
 
@@ -112,3 +113,4 @@ See client/CHANGELOG.md
 * The Microsoft VSCode team for [VSCode](https://code.visualstudio.com/) and [vscode-languageserver-node](https://github.com/Microsoft/vscode-languageserver-node).
 * Quentin Dreyer for his OS homedir replacement solution (https://github.com/qkdreyer)
 * Shane Smith for his spelling fixes (https://github.com/shane-smith)
+* Ryotek for reporting the phpmd.command security issue (https://twitter.com/ryotkak)
\ No newline at end of file

programming_language: Markdown
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -44,6 +44,7 @@
         },
         "phpmd.command": {
           "type": "string",
+          "scope": "machine",
           "default": "",
           "description": "The phpmd command. Leave empty to use the shipped phpmd phar (local php executable is required)"
         },

programming_language: CoffeeScript
CVE-2019-20909 (published 2020-07-16T18:15Z)

An issue was discovered in GNU LibreDWG through 0.9.3. There is a NULL pointer dereference in the function dwg_encode_LWPOLYLINE in dwg.spec.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/LibreDWG/libredwg
commit_details: repo_url: https://github.com/LibreDWG/libredwg
author: Reini Urban
author_date: 2019-12-31 08:52:11+01:00
msg: encode: fix empty FIELD_2DD_VECTOR

Fixes GH #178 null_pointer1 case
repository: repo_url: https://github.com/LibreDWG/libredwg
repo_name: LibreDWG/libredwg
description: Official mirror of libredwg. With CI hooks and nightly releases. PR's ok
repo_language: C
owner: LibreDWG
file_changes: filename: encode.c
change_type: ModificationType.MODIFY
diff: @@ -281,7 +281,8 @@ static bool env_var_checked_p;
 
 #define FIELD_2DD_VECTOR(nam, size, dxf)                                      \
   OVERFLOW_CHECK (nam, _obj->size)                                            \
-  FIELD_2RD (nam[0], dxf);                                                    \
+  if (_obj->size)                                                             \
+    FIELD_2RD (nam[0], dxf);                                                  \
   for (vcount = 1; vcount < (BITCODE_BL)_obj->size; vcount++)                 \
     {                                                                         \
       FIELD_2DD (nam[vcount], FIELD_VALUE (nam[vcount - 1].x),                \

programming_language: C
CVE-2020-35963 (published 2021-01-03T19:15Z)

flb_gzip_compress in flb_gzip.c in Fluent Bit before 1.6.4 has an out-of-bounds write because it does not use the correct calculation of the maximum gzip data-size expansion.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/fluent/fluent-bit
commit_details: repo_url: https://github.com/fluent/fluent-bit
author: davkor
author_date: 2020-11-07 13:59:02+00:00
msg: gzip: fix compression size calculation (oss-fuzz 27261)

Signed-off-by: davkor <david@adalogics.com>
repository: repo_url: https://github.com/fluent/fluent-bit
repo_name: fluent/fluent-bit
description: Fast and Lightweight Logs and Metrics processor for Linux, BSD, OSX and Windows
repo_language: C
owner: fluent
file_changes: filename: flb_gzip.c
change_type: ModificationType.MODIFY
diff: @@ -77,8 +77,25 @@ int flb_gzip_compress(void *in_data, size_t in_len,
     z_stream strm;
     mz_ulong crc;
 
-    out_size = in_len + 32;
+
+    /*
+     * GZIP relies on an algorithm with worst-case expansion
+     * of 5 bytes per 32KB data. This means we need to create a variable
+     * length output, that depends on the input length.
+     * See RFC 1951 for details.
+     */
+    int max_input_expansion = ((int)(in_len / 32000) + 1) * 5;
+
+    /*
+     * Max compressed size is equal to sum of:
+     *   10 byte header
+     *   8 byte foot
+     *   max input expansion
+     *   size of input
+     */
+    out_size = 10 + 8 + max_input_expansion + in_len;
     out_buf = flb_malloc(out_size);
+
     if (!out_buf) {
         flb_errno();
         flb_error("[gzip] could not allocate outgoing buffer");

programming_language: C
CVE-2022-2819 (published 2022-08-15T11:21Z)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0211.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-122
cwe_name: Heap-based Buffer Overflow
description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2022-08-14 21:28:32+01:00
msg: patch 9.0.0211: invalid memory access when compiling :lockvar

Problem:    Invalid memory access when compiling :lockvar.
Solution:   Don't read past the end of the line.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: test_vim9_cmd.vim
change_type: ModificationType.MODIFY
diff: @@ -1737,6 +1737,15 @@ def Test_lockvar()
       UnLockIt()
   END
   v9.CheckScriptFailure(lines, 'E46', 1)
+
+  lines =<< trim END
+      def _()
+        s:0([], s:0)
+        lockv
+      enddef
+      defcomp
+  END
+  v9.CheckScriptFailure(lines, 'E179', 2)
 enddef
 
 def Test_substitute_expr()

programming_language: Python
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -735,6 +735,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    211,
 /**/
     210,
 /**/

programming_language: Ruby
filename: vim9cmds.c
change_type: ModificationType.MODIFY
diff: @@ -188,10 +188,17 @@ compile_lock_unlock(
     size_t	len;
     char_u	*buf;
     isntype_T	isn = ISN_EXEC;
+    char	*cmd = eap->cmdidx == CMD_lockvar ? "lockvar" : "unlockvar";
 
     if (cctx->ctx_skip == SKIP_YES)
 	return OK;
 
+    if (*p == NUL)
+    {
+	semsg(_(e_argument_required_for_str), cmd);
+	return FAIL;
+    }
+
     // Cannot use :lockvar and :unlockvar on local variables.
     if (p[1] != ':')
     {
@@ -223,8 +230,6 @@ compile_lock_unlock(
 	ret = FAIL;
     else
     {
-	char *cmd = eap->cmdidx == CMD_lockvar ? "lockvar" : "unlockvar";
-
 	if (deep < 0)
 	    vim_snprintf((char *)buf, len, "%s! %s", cmd, p);
 	else

programming_language: C
CVE-2023-0311 (published 2023-01-15T22:15Z)

Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/thorsten/phpmyfaq
commit_details: repo_url: https://github.com/thorsten/phpmyfaq
author: Thorsten Rinne
author_date: 2022-12-15 21:42:29+01:00
msg: fix: check captcha length correctly and fix type error
repository: repo_url: https://github.com/thorsten/phpmyfaq
repo_name: thorsten/phpMyFAQ
description: phpMyFAQ - Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases
repo_language: PHP
owner: thorsten
file_changes: filename: Captcha.php
change_type: ModificationType.MODIFY
diff: @@ -434,7 +434,7 @@ class Captcha
         $codeLength = Strings::strlen($this->code);
         $numFonts = count($this->fonts);
         $w1 = 15;
-        $w2 = $this->width / ($codeLength + 1);
+        $w2 = floor($this->width / ($codeLength + 1));
 
         for ($p = 0; $p < $codeLength; ++$p) {
             $letter = $this->code[$p];
@@ -515,7 +515,7 @@ class Captcha
     public function validateCaptchaCode(string $captchaCode): bool
     {
         // Sanity check
-        if (0 === Strings::strlen($captchaCode)) {
+        if (Strings::strlen($captchaCode) !== $this->captchaLength) {
             return false;
         }
 

programming_language: PHP
CVE-2011-1008 (published 2011-02-28T16:00Z)

Scrips_Overlay.pm in Best Practical Solutions RT before 3.8.9 does not properly restrict access to a TicketObj in a Scrip after a CurrentUser change, which allows remote authenticated users to obtain sensitive information via unspecified vectors, as demonstrated by custom-field value information, related to SQL logging.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/bestpractical/rt
commit_details: repo_url: https://github.com/bestpractical/rt
author: sunnavy
author_date: 2010-05-13 20:28:35+08:00
msg: security fix: clone the ticket to set CurrentUser
repository: repo_url: https://github.com/bestpractical/rt
repo_name: bestpractical/rt
description: Request Tracker, an enterprise-grade issue tracking system
repo_language: Perl
owner: bestpractical
file_changes: filename: Scrips_Overlay.pm
change_type: ModificationType.MODIFY
diff: @@ -283,7 +283,10 @@ sub _SetupSourceObjects {
             TransactionObj => undef,
             @_ );
 
-    if ( ( $self->{'TicketObj'} = $args{'TicketObj'} ) ) {
+
+    if ( $args{'TicketObj'} ) {
+        # clone the ticket here as we need to change CurrentUser
+        $self->{'TicketObj'} = bless { %{$args{'TicketObj'} } }, 'RT::Ticket';
         $self->{'TicketObj'}->CurrentUser( $self->CurrentUser );
     }
     else {

programming_language: Perl
CVE-2013-5705 (published 2014-04-15T10:55Z)

apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/SpiderLabs/ModSecurity
commit_details: repo_url: https://github.com/SpiderLabs/ModSecurity
author: Breno Silva
author_date: 2013-09-04 08:57:07-03:00
msg: Fix Chunked string case sensitive issue - CVE-2013-5705
repository: repo_url: https://github.com/SpiderLabs/ModSecurity
repo_name: owasp-modsecurity/ModSecurity
description: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis.
repo_language: C++
owner: SpiderLabs
file_changes: filename: modsecurity.c
change_type: ModificationType.MODIFY
diff: @@ -297,7 +297,7 @@ apr_status_t modsecurity_tx_init(modsec_rec *msr) {
     if (msr->request_content_length == -1) {
         /* There's no C-L, but is chunked encoding used? */
         char *transfer_encoding = (char *)apr_table_get(msr->request_headers, "Transfer-Encoding");
-        if ((transfer_encoding != NULL)&&(strstr(transfer_encoding, "chunked") != NULL)) {
+        if ((transfer_encoding != NULL)&&(m_strcasestr(transfer_encoding, "chunked") != NULL)) {
             msr->reqbody_should_exist = 1;
             msr->reqbody_chunked = 1;
         }

programming_language: C
CVE-2020-27387 (published 2020-11-05T02:15Z)

An unrestricted file upload issue in HorizontCMS through 1.0.0-beta allows an authenticated remote attacker (with access to the FileManager) to upload and execute arbitrary PHP code by uploading a PHP payload, and then using the FileManager's rename function to provide the payload (which will receive a random name on the server) with the PHP extension, and finally executing the PHP file via an HTTP GET request to /storage/<php_file_name>. NOTE: the vendor has patched this while leaving the version number at 1.0.0-beta.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/ttimot24/HorizontCMS
commit_details: repo_url: https://github.com/ttimot24/HorizontCMS
author: Timot Tarjani
author_date: 2020-10-23 19:58:00+02:00
msg: Security bug fix.
repository: repo_url: https://github.com/ttimot24/HorizontCMS
repo_name: ttimot24/HorizontCMS
description: Lightweight CMS built on Laravel 9, VueJs 2.6 and Bootstrap 5.3. An alternative platform to OctoberCMS
repo_language: JavaScript
owner: ttimot24
file_changes: filename: FileManagerController.php
change_type: ModificationType.MODIFY
diff: @@ -10,6 +10,10 @@ use \Illuminate\Http\File;
 class FileManagerController extends Controller{
  
 
+    private function validationRegex(){
+        return '/^.*\.('.implode('|',["php","php5","php7"]).')$/i';
+    }
+
 
     /**
      * Display a listing of the resource.
@@ -60,7 +64,10 @@ class FileManagerController extends Controller{
             if ($this->request->hasFile('up_file')){
 
                 foreach($this->request->up_file as $file){
-                   $images[] = $file->store(str_replace("storage/", "", $this->request->input('dir_path')));
+                    
+                    if(!preg_match($this->validationRegex(), strtolower($file))){
+                        $images[] = $file->store(str_replace("storage/", "", $this->request->input('dir_path')));
+                    }
                 }
 
                 if($this->request->ajax()){
@@ -223,7 +230,9 @@ class FileManagerController extends Controller{
 
         if($this->request->isMethod('POST')){
 
-            if(\Storage::move($this->request->input('old_file'), $this->request->input('new_file'))){
+            $new_file = $this->request->input('new_file');
+
+            if(!preg_match($this->validationRegex(), strtolower($new_file)) && \Storage::move($this->request->input('old_file'), $new_file)){
                 if($this->request->ajax()){
                     return response()->json(['success' => trans('File successfully renamed!')]);
                 }

programming_language: PHP
CVE-2019-16317 (published 2019-09-14T18:15Z)

In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uploads are not blocked and are reachable within the phar://../../../../../../../../var/www/html/web/var/assets/ directory, a different vulnerability than CVE-2019-10867 and CVE-2019-16318.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-502
cwe_name: Deserialization of Untrusted Data
description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
extended_description: 
            It is often convenient to serialize objects for communication or to save them for later use. However, deserialized data or code can often be modified without using the provided accessor functions if it does not use cryptography to protect itself. Furthermore, any cryptography would still be client-side security -- which is a dangerous security assumption.
            Data that is untrusted can not be trusted to be well-formed.
            When developers place no restrictions on "gadget chains," or series of instances and method invocations that can self-execute during the deserialization process (i.e., before the object is returned to the caller), it is sometimes possible for attackers to leverage them to perform unauthorized actions, like generating a shell.
         
         

Fix information:
repo_url: https://github.com/pimcore/pimcore
commit_details: repo_url: https://github.com/pimcore/pimcore
author: Bernhard Rusch
author_date: 2019-03-19 14:59:24+01:00
msg: [Asset] do not allow PHAR upload
repository: repo_url: https://github.com/pimcore/pimcore
repo_name: pimcore/pimcore
description: Core Framework for the Open Source Data & Experience Management Platform (PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce)
repo_language: PHP
owner: pimcore
file_changes: filename: Asset.php
change_type: ModificationType.MODIFY
diff: @@ -619,7 +619,7 @@ class Asset extends Element\AbstractElement
         }
 
         // do not allow PHP and .htaccess files
-        if (preg_match("@\.ph(p[\d+]?|t|tml|ps)$@i", $this->getFilename()) || $this->getFilename() == '.htaccess') {
+        if (preg_match("@\.ph(p[\d+]?|t|tml|ps|ar)$@i", $this->getFilename()) || $this->getFilename() == '.htaccess') {
             $this->setFilename($this->getFilename() . '.txt');
         }
 

programming_language: PHP
CVE-2017-12662 (published 2017-08-07T21:29Z)

ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePDFImage in coders/pdf.c.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-772
cwe_name: Missing Release of Resource after Effective Lifetime
description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
extended_description: When a resource is not released after use, it can allow attackers to cause a denial of service by causing the allocation of resources without triggering their release. Frequently-affected resources include memory, CPU, disk space, power or battery, etc.
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2017-07-17 19:15:49-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/576
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: pdf.c
change_type: ModificationType.MODIFY
diff: @@ -1989,7 +1989,11 @@ RestoreMSCWarning
             length*=image->colorspace == CMYKColorspace ? 4UL : 3UL;
             pixel_info=AcquireVirtualMemory(length,sizeof(*pixels));
             if (pixel_info == (MemoryInfo *) NULL)
-              ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+              {
+                xref=(MagickOffsetType *) RelinquishMagickMemory(xref);
+                ThrowWriterException(ResourceLimitError,
+                  "MemoryAllocationFailed");
+              }
             pixels=(unsigned char *) GetVirtualMemoryBlob(pixel_info);
             /*
               Dump runoffset encoded pixels.
@@ -2086,8 +2090,11 @@ RestoreMSCWarning
               length=(size_t) number_pixels;
               pixel_info=AcquireVirtualMemory(length,sizeof(*pixels));
               if (pixel_info == (MemoryInfo *) NULL)
-                ThrowWriterException(ResourceLimitError,
-                  "MemoryAllocationFailed");
+                {
+                  xref=(MagickOffsetType *) RelinquishMagickMemory(xref);
+                  ThrowWriterException(ResourceLimitError,
+                    "MemoryAllocationFailed");
+                }
               pixels=(unsigned char *) GetVirtualMemoryBlob(pixel_info);
               /*
                 Dump Runlength encoded pixels.

programming_language: Objective-C