starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2021-41093 (published 2021-10-04T19:15Z)

Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they can take over an account by changing the email. This issue has been resolved in version 3.86 which uses a new endpoint which additionally requires an authentication cookie. See wire-ios-sync-engine and wire-ios-transport references. This is the root advisory that pulls the changes together.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/wireapp/wire-ios
commit_details: repo_url: https://github.com/wireapp/wire-ios
author: John Nguyen
author_date: 2021-08-02 11:19:06+02:00
msg: Merge pull request from GHSA-6f4c-phfj-m255

* Pin components

* Bump components
repository: repo_url: https://github.com/wireapp/wire-ios
repo_name: wireapp/wire-ios
description: 📱 Wire for iOS (iPhone and iPad)
repo_language: Swift
owner: wireapp
file_changes: filename: Cartfile.resolved
change_type: ModificationType.MODIFY
diff: @@ -22,9 +22,9 @@ github "wireapp/wire-ios-link-preview" "31.0.4"
 github "wireapp/wire-ios-protos" "28.0.1"
 github "wireapp/wire-ios-request-strategy" "237.0.0"
 github "wireapp/wire-ios-share-engine" "222.0.0"
-github "wireapp/wire-ios-sync-engine" "385.0.0"
+github "wireapp/wire-ios-sync-engine" "385.0.1"
+github "wireapp/wire-ios-transport" "77.1.0"
 github "wireapp/wire-ios-system" "34.1.1"
 github "wireapp/wire-ios-testing" "25.1.1"
-github "wireapp/wire-ios-transport" "77.0.4"
 github "wireapp/wire-ios-utilities" "41.0.6"
 github "wireapp/wire-ios-ziphy" "16.0.3"

programming_language: Batchfile
CVE-2023-35849 (published 2023-06-19T03:15Z)

VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not properly check whether header sizes would result in accessing data outside of a packet.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-754
cwe_name: Improper Check for Unusual or Exceptional Conditions
description: The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
extended_description: 
            The programmer may assume that certain events or conditions will never occur or do not need to be worried about, such as low memory conditions, lack of access to resources due to restrictive permissions, or misbehaving clients or components. However, attackers may intentionally trigger these unusual conditions, thus violating the programmer's assumptions, possibly introducing instability, incorrect behavior, or a vulnerability.
            Note that this entry is not exclusively about the use of exceptions and exception handling, which are mechanisms for both checking and handling unusual or unexpected conditions.
         
         

Fix information:
repo_url: https://github.com/virtualsquare/picotcp
commit_details: repo_url: https://github.com/virtualsquare/picotcp
author: Daniele Lacamera
author_date: 2023-05-12 22:24:28+02:00
msg: More checks for correct header sizes

Reported-by: "P. Amsuo, Purdue University"
repository: repo_url: https://github.com/virtualsquare/picotcp
repo_name: virtualsquare/picotcp
repo_language: C
owner: virtualsquare
file_changes: filename: pico_ipv4.c
change_type: ModificationType.MODIFY
diff: @@ -668,6 +668,11 @@ static int pico_ipv4_process_in(struct pico_stack *S, struct pico_protocol *self
     f->transport_hdr = ((uint8_t *)f->net_hdr) + PICO_SIZE_IP4HDR + option_len;
     f->transport_len = (uint16_t)(short_be(hdr->len) - PICO_SIZE_IP4HDR - option_len);
     f->net_len = (uint16_t)(PICO_SIZE_IP4HDR + option_len);
+
+    if ((f->net_hdr + f->net_len) > (f->buffer + f->buffer_len)) {
+        pico_frame_discard(f);
+        return 0;
+    }
 #if defined(PICO_SUPPORT_IPV4FRAG) || defined(PICO_SUPPORT_IPV6FRAG)
     f->frag = short_be(hdr->frag);
 #endif

programming_language: C
filename: pico_tcp.c
change_type: ModificationType.MODIFY
diff: @@ -868,6 +868,9 @@ static inline void tcp_parse_option_mss(struct pico_socket_tcp *t, uint8_t len,
     if (tcpopt_len_check(idx, len, PICO_TCPOPTLEN_MSS) < 0)
         return;
 
+    if ((*idx + PICO_TCPOPTLEN_MSS) > len)
+        return;
+
     t->mss_ok = 1;
     mss = short_from(opt + *idx);
     *idx += (uint32_t)sizeof(uint16_t);
@@ -896,6 +899,10 @@ static int tcp_parse_options(struct pico_frame *f)
     uint8_t *opt = f->transport_hdr + PICO_SIZE_TCPHDR;
     uint32_t i = 0;
     f->timestamp = 0;
+
+    if (f->buffer + f->buffer_len > f->transport_hdr + f->transport_len)
+        return -1;
+
     while (i < (f->transport_len - PICO_SIZE_TCPHDR)) {
         uint8_t type =  opt[i++];
         uint8_t len;

programming_language: C
CVE-2014-9628 (published 2020-01-24T22:15Z)

The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote attackers to trigger an unintended zero-size malloc and conduct buffer overflow attacks, and consequently execute arbitrary code, via a box size of 7.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-120
cwe_name: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
extended_description: A buffer overflow condition exists when a product attempts to put more data in a buffer than it can hold, or when it attempts to put data in a memory area outside of the boundaries of a buffer. The simplest type of error, and the most common cause of buffer overflows, is the "classic" case in which the product copies the buffer without restricting how much is copied. Other variants exist, but the existence of a classic overflow strongly suggests that the programmer is not considering even the most basic of security protections.
         

Fix information:
repo_url: https://github.com/videolan/vlc
commit_details: repo_url: https://github.com/videolan/vlc
author: Fabian Yamaguchi
author_date: 2014-12-05 13:52:42+01:00
msg: demux: mp4: fix buffer overflow in parsing of string boxes.

We ensure that pbox->i_size is never smaller than 8 to avoid an
integer underflow in the third argument of the subsequent call to
memcpy. We also make sure no truncation occurs when passing values
derived from the 64 bit integer p_box->i_size to arguments of malloc
and memcpy that may be 32 bit integers on 32 bit platforms.

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
repository: repo_url: https://github.com/videolan/vlc
repo_name: videolan/vlc
description: VLC media player - All pull requests are ignored, please use MRs on https://code.videolan.org/videolan/vlc
repo_language: C
owner: videolan
file_changes: filename: libmp4.c
change_type: ModificationType.MODIFY
diff: @@ -2858,6 +2858,9 @@ static int MP4_ReadBox_String( stream_t *p_stream, MP4_Box_t *p_box )
 {
     MP4_READBOX_ENTER( MP4_Box_data_string_t );
 
+    if( p_box->i_size < 8 || p_box->i_size > SIZE_MAX )
+        MP4_READBOX_EXIT( 0 );
+
     p_box->data.p_string->psz_text = malloc( p_box->i_size + 1 - 8 ); /* +\0, -name, -size */
     if( p_box->data.p_string->psz_text == NULL )
         MP4_READBOX_EXIT( 0 );

programming_language: C
CVE-2024-38532 (published 2024-06-28T22:15Z)

The NXP Data Co-Processor (DCP) is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryption operations. The dcp_tool reference implementation included in the repository selected the test key, regardless of its `-t` argument. This issue has been patched in commit 26a7.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/usbarmory/mxs-dcp
commit_details: repo_url: https://github.com/usbarmory/mxs-dcp
author: Andrea Barisani
author_date: 2024-06-27 10:13:57+02:00
msg: Merge pull request #7 from dress-code-IT-GmbH/master

load empty key to activate DCP internal key
repository: repo_url: https://github.com/usbarmory/mxs-dcp
repo_name: usbarmory/mxs-dcp
description: NXP Data Co-Processor (DCP) - Linux driver
repo_language: C
owner: usbarmory
CVE-2014-9730 (published 2015-08-31T10:59Z)

The udf_pc_to_char function in fs/udf/symlink.c in the Linux kernel before 3.18.2 relies on component lengths that are unused, which allows local users to cause a denial of service (system crash) via a crafted UDF filesystem image.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Jan Kara
author_date: 2014-12-19 14:27:55+01:00
msg: udf: Check component length before reading it

Check that length specified in a component of a symlink fits in the
input buffer we are reading. Also properly ignore component length for
component types that do not use it. Otherwise we read memory after end
of buffer for corrupted udf image.

Reported-by: Carl Henrik Lunde <chlunde@ping.uio.no>
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: symlink.c
change_type: ModificationType.MODIFY
diff: @@ -42,14 +42,17 @@ static int udf_pc_to_char(struct super_block *sb, unsigned char *from,
 	tolen--;
 	while (elen < fromlen) {
 		pc = (struct pathComponent *)(from + elen);
+		elen += sizeof(struct pathComponent);
 		switch (pc->componentType) {
 		case 1:
 			/*
 			 * Symlink points to some place which should be agreed
  			 * upon between originator and receiver of the media. Ignore.
 			 */
-			if (pc->lengthComponentIdent > 0)
+			if (pc->lengthComponentIdent > 0) {
+				elen += pc->lengthComponentIdent;
 				break;
+			}
 			/* Fall through */
 		case 2:
 			if (tolen == 0)
@@ -74,6 +77,9 @@ static int udf_pc_to_char(struct super_block *sb, unsigned char *from,
 			/* that would be . - just ignore */
 			break;
 		case 5:
+			elen += pc->lengthComponentIdent;
+			if (elen > fromlen)
+				return -EIO;
 			comp_len = udf_get_filename(sb, pc->componentIdent,
 						    pc->lengthComponentIdent,
 						    p, tolen);
@@ -85,7 +91,6 @@ static int udf_pc_to_char(struct super_block *sb, unsigned char *from,
 			tolen--;
 			break;
 		}
-		elen += sizeof(struct pathComponent) + pc->lengthComponentIdent;
 	}
 	if (p > to + 1)
 		p[-1] = '\0';

programming_language: C
CVE-2023-37624 (published 2023-07-26T20:15Z)

Netdisco before v2.063000 was discovered to contain an open redirect vulnerability. An attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.

CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-601
cwe_name: URL Redirection to Untrusted Site ('Open Redirect')
description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
extended_description: An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance. Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs.
         

Fix information:
repo_url: https://github.com/netdisco/netdisco
commit_details: repo_url: https://github.com/netdisco/netdisco
author: Oliver Gorwits
author_date: 2023-06-28 16:56:04+01:00
msg: avoid open redirect vulnerability with return_url login helper
repository: repo_url: https://github.com/netdisco/netdisco
repo_name: netdisco/netdisco
description: A web-based network management tool.
repo_language: Perl
owner: netdisco
file_changes: filename: AuthN.pm
change_type: ModificationType.MODIFY
diff: @@ -8,6 +8,7 @@ use Dancer::Plugin::Swagger;
 use App::Netdisco; # a safe noop but needed for standalone testing
 use App::Netdisco::Util::Web 'request_is_api';
 use MIME::Base64;
+use URI::Based;
 
 # ensure that regardless of where the user is redirected, we have a link
 # back to the page they requested.
@@ -162,7 +163,7 @@ post '/login' => sub {
             return to_json { api_key => $user->token };
         }
 
-        redirect param('return_url');
+        redirect ((scalar URI::Based->new(param('return_url'))->path_query) || '/');
     }
     else {
         # invalidate session cookie

programming_language: Perl
CVE-2022-2845 (published 2022-08-17T15:15Z)

Improper Validation of Specified Quantity in Input in GitHub repository vim/vim prior to 9.0.0218.\n\n

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-1284
cwe_name: Improper Validation of Specified Quantity in Input
description: The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
extended_description: 
				Specified quantities include size, length, frequency, price, rate, number of operations, time, and others. Code may rely on specified quantities to allocate resources, perform calculations, control iteration, etc. When the quantity is not properly validated, then attackers can specify malicious quantities to cause excessive resource allocation, trigger unexpected failures, enable buffer overflows, etc.
			
			

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2022-08-16 14:51:53+01:00
msg: patch 9.0.0218: reading before the start of the line

Problem:    Reading before the start of the line.
Solution:   When displaying "$" check the column is not negative.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: edit.c
change_type: ModificationType.MODIFY
diff: @@ -1746,8 +1746,9 @@ edit_unputchar(void)
  * Only works when cursor is in the line that changes.
  */
     void
-display_dollar(colnr_T col)
+display_dollar(colnr_T col_arg)
 {
+    colnr_T col = col_arg < 0 ? 0 : col_arg;
     colnr_T save_col;
 
     if (!redrawing())

programming_language: C
filename: edit.pro
change_type: ModificationType.MODIFY
diff: @@ -5,7 +5,7 @@ void ins_redraw(int ready);
 void edit_putchar(int c, int highlight);
 void set_insstart(linenr_T lnum, int col);
 void edit_unputchar(void);
-void display_dollar(colnr_T col);
+void display_dollar(colnr_T col_arg);
 void undisplay_dollar(void);
 void truncate_spaces(char_u *line);
 void backspace_until_column(int col);

programming_language: C
filename: test_cmdwin.vim
change_type: ModificationType.MODIFY
diff: @@ -365,5 +365,13 @@ func Test_cant_open_cmdwin_in_cmdwin()
   call assert_match('E1292:', caught)
 endfunc
 
+func Test_cmdwin_virtual_edit()
+  enew!
+  set ve=all cpo+=$
+  silent normal q/s
+
+  set ve= cpo-=$
+endfunc
+
 
 " vim: shiftwidth=2 sts=2 expandtab

programming_language: Lua
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -735,6 +735,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    218,
 /**/
     217,
 /**/

programming_language: Ruby
CVE-2020-7762 (published 2020-11-05T13:15Z)

This affects the package jsreport-chrome-pdf before 1.10.0.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/jsreport/jsreport-chrome-pdf
commit_details: repo_url: https://github.com/jsreport/jsreport-chrome-pdf
author: BJR Matos
author_date: 2020-10-30 11:09:42-05:00
msg: block file requests
repository: repo_url: https://github.com/jsreport/jsreport-chrome-pdf
repo_name: jsreport/jsreport-chrome-pdf
description: jsreport recipe using headless chrome for the pdf rendering
repo_language: JavaScript
owner: jsreport
file_changes: filename: conversion.js
change_type: ModificationType.MODIFY
diff: @@ -38,6 +38,12 @@ module.exports = async ({ reporter, getBrowser, htmlUrl, strategy, timeout, req,
       return
     }
 
+    await page.setRequestInterception(true)
+
+    if (executionInfo.error) {
+      return
+    }
+
     page.on('pageerror', (err) => {
       pageLog('warn', `Page error: ${err.message}${err.stack ? ` , stack: ${err.stack}` : ''}`)
     })
@@ -64,6 +70,19 @@ module.exports = async ({ reporter, getBrowser, htmlUrl, strategy, timeout, req,
       }
 
       pageLog('debug', `Page request: ${r.method()} (${r.resourceType()}) ${trimUrl(r.url())}${detail}`)
+
+      const isRelativeToHtmlUrl = r.url().lastIndexOf(htmlUrl, 0) === 0
+
+      if (
+        !isRelativeToHtmlUrl &&
+        // potentially dangerous request to local file
+        r.url().lastIndexOf('file:///', 0) === 0
+      ) {
+        r.abort('accessdenied')
+        return
+      }
+
+      r.continue()
     })
 
     page.on('requestfinished', (r) => {

programming_language: TypeScript
CVE-2014-125026 (published 2022-12-27T22:15Z)

LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/cloudflare/golz4
commit_details: repo_url: https://github.com/cloudflare/golz4
author: John Graham-Cumming
author_date: 2014-07-11 08:47:35-07:00
msg: Use LZ4_decompress_safe instead of LZ4_uncompress

LZ4_uncompress is deprecated and has security problems.
repository: repo_url: https://github.com/cloudflare/golz4
repo_name: cloudflare/golz4
description: Golang interface to LZ4 compression
repo_language: C
owner: cloudflare
file_changes: filename: lz4.go
change_type: ModificationType.MODIFY
diff: @@ -6,6 +6,7 @@ package lz4
 import "C"
 
 import (
+	"errors"
 	"fmt"
 	"unsafe"
 )
@@ -25,14 +26,12 @@ func clen(s []byte) C.int {
 
 // Uncompress with a known output size. len(out) should be equal to
 // the length of the uncompressed out.
-func Uncompress(in, out []byte) (err error) {
-	read := int(C.LZ4_uncompress(p(in), p(out), clen(out)))
-
-	if read != len(in) {
-		err = fmt.Errorf("uncompress read %d bytes should have read %d",
-			read, len(in))
+func Uncompress(in, out []byte) (error) {
+	if int(C.LZ4_decompress_safe(p(in), p(out), clen(in), clen(out))) < 0 {
+		return errors.New("Malformed compression stream")
 	}
-	return
+
+	return nil
 }
 
 // CompressBound calculates the size of the output buffer needed by

programming_language: Go
CVE-2019-19050 (published 2019-11-18T06:15Z)

A memory leak in the crypto_reportstat() function in crypto/crypto_user_stat.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering crypto_reportstat_alg() failures, aka CID-c03b04dcdba1.

Severity: HIGH
CVSS v2 base score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Navid Emamdoost
author_date: 2019-10-04 14:34:54-05:00
msg: crypto: user - fix memory leak in crypto_reportstat

In crypto_reportstat, a new skb is created by nlmsg_new(). This skb is
leaked if crypto_reportstat_alg() fails. Required release for skb is
added.

Fixes: cac5818c25d0 ("crypto: user - Implement a generic crypto statistics")
Cc: <stable@vger.kernel.org>
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: crypto_user_stat.c
change_type: ModificationType.MODIFY
diff: @@ -328,8 +328,10 @@ int crypto_reportstat(struct sk_buff *in_skb, struct nlmsghdr *in_nlh,
 drop_alg:
 	crypto_mod_put(alg);
 
-	if (err)
+	if (err) {
+		kfree_skb(skb);
 		return err;
+	}
 
 	return nlmsg_unicast(net->crypto_nlsk, skb, NETLINK_CB(in_skb).portid);
 }

programming_language: C