starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2019-13303 (published 2019-07-05T01:15Z)

ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/composite.c in CompositeImage.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2019-06-18 14:13:42-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/1603
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: composite.c
change_type: ModificationType.MODIFY
diff: @@ -654,18 +654,19 @@ MagickExport MagickBooleanType CompositeImage(Image *image,
               q+=GetPixelChannels(image);
               continue;
             }
-          for (i=0; i < (ssize_t) GetPixelChannels(image); i++)
+          for (i=0; i < (ssize_t) GetPixelChannels(source_image); i++)
           {
-            PixelChannel channel = GetPixelChannelChannel(image,i);
-            PixelTrait traits = GetPixelChannelTraits(image,channel);
-            PixelTrait source_traits=GetPixelChannelTraits(source_image,
+            PixelChannel channel = GetPixelChannelChannel(source_image,i);
+            PixelTrait source_traits = GetPixelChannelTraits(source_image,
               channel);
-            if (traits == UndefinedPixelTrait)
+            PixelTrait traits = GetPixelChannelTraits(image,channel);
+            if (source_traits == UndefinedPixelTrait)
               continue;
-            if (source_traits != UndefinedPixelTrait)
+            if (traits != UndefinedPixelTrait)
               SetPixelChannel(image,channel,p[i],q);
-            else if (channel == AlphaPixelChannel)
-              SetPixelChannel(image,channel,OpaqueAlpha,q);
+            else
+              if (channel == AlphaPixelChannel)
+                SetPixelChannel(image,channel,OpaqueAlpha,q);
           }
           p+=GetPixelChannels(source_image);
           q+=GetPixelChannels(image);

programming_language: Objective-C
CVE-2021-29516 (published 2021-05-14T20:15Z)

TensorFlow is an end-to-end open source platform for machine learning. Calling `tf.raw_ops.RaggedTensorToVariant` with arguments specifying an invalid ragged tensor results in a null pointer dereference. The implementation of `RaggedTensorToVariant` operations(https://github.com/tensorflow/tensorflow/blob/904b3926ed1c6c70380d5313d282d248a776baa1/tensorflow/core/kernels/ragged_tensor_to_variant_op.cc#L39-L40) does not validate that the ragged tensor argument is non-empty. Since `batched_ragged` contains no elements, `batched_ragged.splits` is a null vector, thus `batched_ragged.splits(0)` will result in dereferencing `nullptr`. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Amit Patankar
author_date: 2021-04-13 14:49:50-07:00
msg: Fix `tf.raw_ops.RaggedTensorToVariant` invalid resize.

PiperOrigin-RevId: 368299574
Change-Id: I751c186325aa0bab397928845e790e60c2d90918
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: ragged_tensor_to_variant_op.cc
change_type: ModificationType.MODIFY
diff: @@ -159,6 +159,11 @@ class RaggedTensorToVariantOp : public OpKernel {
 
     // Unbatch the Ragged Tensor and encode the components.
     std::vector<RaggedTensorVariant> unbatched_ragged_input;
+    auto batched_splits_top_vec =
+        batched_ragged_input.splits(0).vec<SPLIT_TYPE>();
+    int num_components = batched_splits_top_vec.size() - 1;
+    OP_REQUIRES(context, num_components >= 0,
+                errors::Internal("Invalid split argument."));
     OP_REQUIRES_OK(context, UnbatchRaggedZerothDim<VALUE_TYPE, SPLIT_TYPE>(
                                 batched_ragged_input, &unbatched_ragged_input));
 

programming_language: C++
CVE-2023-0398 (published 2023-01-19T09:15Z)

Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/modoboa/modoboa
commit_details: repo_url: https://github.com/modoboa/modoboa
author: Antoine Nguyen
author_date: 2023-01-19 09:05:00+01:00
msg: Merge pull request #2752 from modoboa/fix/delete_domain_post

Enforce POST methods for delete domain view.
repository: repo_url: https://github.com/modoboa/modoboa
repo_name: modoboa/modoboa
description: Mail hosting made simple
repo_language: Python
owner: modoboa
CVE-2014-2527 (published 2014-08-26T14:55Z)

kcleanup.cpp in KDirStat 2.7.0 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a " (double quote) character in the directory name, a different vulnerability than CVE-2014-2528.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://bitbucket.org/jeromerobert/k4dirstat
commit_details: repo_url: https://bitbucket.org/jeromerobert/k4dirstat
author: Jerome Robert
author_date: 2014-03-15 16:54:34+01:00
msg: Properly escape %p and %n in cleaning actions
repository: repo_url: https://bitbucket.org/jeromerobert/k4dirstat
repo_name: visit repo url
description: visit repo url
repo_language: visit repo url
owner: jeromerobert
file_changes: filename: kcleanup.cpp
change_type: ModificationType.MODIFY
diff: @@ -318,11 +318,10 @@ KCleanup::expandVariables( const KFileInfo *	item,
 			   const QString &	unexpanded ) const
 {
     QString expanded = unexpanded;
-
-    expanded.replace( QRegExp( "%p" ),
-		      "'" + QString::fromLocal8Bit( item->url() )  + "'" );
-    expanded.replace( QRegExp( "%n" ),
-		      "'" + QString::fromLocal8Bit( item->name() ) + "'" );
+    QString url = QString::fromLocal8Bit( item->url() ).replace("'", "'\\''");
+    expanded.replace( QRegExp( "%p" ), "'" + url + "'" );
+    QString name = QString::fromLocal8Bit( item->name() ).replace("'", "'\\''");
+    expanded.replace( QRegExp( "%n" ), "'" + name + "'" );
 
    // if ( KDE::versionMajor() >= 3 && KDE::versionMinor() >= 4 )
 	expanded.replace( QRegExp( "%t" ), "trash:/" );

programming_language: C++
CVE-2022-0968 (published 2022-03-15T16:15Z)

The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in GitHub repository microweber/microweber prior to 1.2.12.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/microweber/microweber
commit_details: repo_url: https://github.com/microweber/microweber
author: Bozhidar Slaveykov
author_date: 2022-03-14 17:37:21+02:00
msg: user update requrest validation
repository: repo_url: https://github.com/microweber/microweber
repo_name: microweber/microweber
description: Drag and Drop Website Builder and CMS with E-commerce
repo_language: HTML
owner: microweber
file_changes: filename: UserCreateRequest.php
change_type: ModificationType.MODIFY
diff: @@ -14,8 +14,11 @@ class UserCreateRequest extends FormRequest
     public function rules()
     {
         $rules = [
-             'username' => 'required|unique:users,username',
-             'email' => 'unique:users,email',
+             'first_name'=>'max:500',
+             'last_name'=>'max:500',
+             'phone'=>'max:500',
+             'username' => 'required|unique:users,username|max:500',
+             'email' => 'unique:users,email|max:500',
         ];
 
         return $rules;

programming_language: PHP
filename: UserUpdateRequest.php
change_type: ModificationType.MODIFY
diff: @@ -19,13 +19,17 @@ class UserUpdateRequest extends FormRequest
         $ignore = Rule::unique('users')->ignore($this->id ?? 0, 'id');
 
         return [
+            'first_name'=>'max:500',
+            'last_name'=>'max:500',
+            'phone'=>'max:500',
             'email' => [
                 $ignore,
+                'max:500'
             ],
             'username' => [
                 $ignore,
+                'max:500'
             ],
-
         ];
 
     }

programming_language: PHP
CVE-2021-21239 (published 2021-01-21T15:15Z)

PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. Users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. PySAML2 does not ensure that a signed SAML document is correctly signed. The default CryptoBackendXmlSec1 backend is using the xmlsec1 binary to verify the signature of signed SAML documents, but by default xmlsec1 accepts any type of key found within the given document. xmlsec1 needs to be configured explicitly to only use only _x509 certificates_ for the verification process of the SAML document signature. This is fixed in PySAML2 6.5.0.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-347
cwe_name: Improper Verification of Cryptographic Signature
description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/IdentityPython/pysaml2
commit_details: repo_url: https://github.com/IdentityPython/pysaml2
author: Ivan Kanakarakis
author_date: 2021-01-20 14:33:19+02:00
msg: Merge pull request from GHSA-5p3x-r448-pc62

Restrict the key data that xmlsec1 accepts to only x509 certs
repository: repo_url: https://github.com/IdentityPython/pysaml2
repo_name: IdentityPython/pysaml2
description: Python implementation of SAML2
repo_language: Python
owner: IdentityPython
CVE-2013-6383 (published 2013-11-27T04:43Z)

The aac_compat_ioctl function in drivers/scsi/aacraid/linit.c in the Linux kernel before 3.11.8 does not require the CAP_SYS_RAWIO capability, which allows local users to bypass intended access restrictions via a crafted ioctl call.

Severity: MEDIUM
CVSS v2 base score: 6.9 (AV:L/AC:M/Au:N/C:C/I:C/A:C)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Dan Carpenter
author_date: 2013-10-29 22:11:06+03:00
msg: aacraid: missing capable() check in compat ioctl

In commit d496f94d22d1 ('[SCSI] aacraid: fix security weakness') we
added a check on CAP_SYS_RAWIO to the ioctl.  The compat ioctls need the
check as well.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: linit.c
change_type: ModificationType.MODIFY
diff: @@ -771,6 +771,8 @@ static long aac_compat_do_ioctl(struct aac_dev *dev, unsigned cmd, unsigned long
 static int aac_compat_ioctl(struct scsi_device *sdev, int cmd, void __user *arg)
 {
 	struct aac_dev *dev = (struct aac_dev *)sdev->host->hostdata;
+	if (!capable(CAP_SYS_RAWIO))
+		return -EPERM;
 	return aac_compat_do_ioctl(dev, cmd, (unsigned long)arg);
 }
 

programming_language: C
CVE-2020-36660 (published 2023-02-06T17:15Z)

A vulnerability was found in paxswill EVE Ship Replacement Program 0.12.11. It has been rated as problematic. This issue affects some unknown processing of the file src/evesrp/views/api.py of the component User Information Handler. The manipulation leads to information disclosure. The attack may be initiated remotely. Upgrading to version 0.12.12 is able to address this issue. The patch is named 9e03f68e46e85ca9c9694a6971859b3ee66f0240. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220211.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/paxswill/evesrp
commit_details: repo_url: https://github.com/paxswill/evesrp
author: Will Ross
author_date: 2020-10-13 13:42:55-04:00
msg: Security Vuln: Check API access to entity details

Access through the /api/user/<id> and /api/group/<id> routes were not
properly being checked. This meant that anyone could easily enumerate
users and groups.

User information disclosed would include which SRP groups a user is
in, whether they are an admin, which permissions a user has been
granted, as well as the details for every SRP request that user has
submitted, including the character name for the loss. The authentication
source (Test Auth, EVE SSO, etc) for the user would also be disclosed
through the requests, along with the ID associated with that
authentication method.

Group information disclosed would include the group name, permissions
granted within that group, as well as all members of the group.

v0.12.2 is going to be released shortly addressing this vulnerability.
A large thank you to the individual who brought this to my attention.
repository: repo_url: https://github.com/paxswill/evesrp
repo_name: paxswill/evesrp
description: EVE Ship Replacement Program (SRP) webapp
repo_language: Python
owner: paxswill
file_changes: filename: api.py
change_type: ModificationType.MODIFY
diff: @@ -57,7 +57,11 @@ def list_entities():
 
 
 @api.route('/user/<int:user_id>/')
+@login_required
 def user_detail(user_id):
+    if not current_user.admin and not \
+            current_user.has_permission(PermissionType.admin):
+        abort(403)
     user = User.query.get_or_404(user_id)
     # Set up divisions
     submit = map(lambda p: p.division,
@@ -84,7 +88,11 @@ def user_detail(user_id):
 
 
 @api.route('/group/<int:group_id>/')
+@login_required
 def group_detail(group_id):
+    if not current_user.admin and not \
+            current_user.has_permission(PermissionType.admin):
+        abort(403)
     group = Group.query.get_or_404(group_id)
     submit = map(lambda p: p.division,
             filter(lambda p: p.permission == PermissionType.submit,

programming_language: Python
CVE-2024-28185 (published 2024-04-18T15:15Z)

Judge0 is an open-source online code execution system. The application does not account for symlinks placed inside the sandbox directory, which can be leveraged by an attacker to write to arbitrary files and gain code execution outside of the sandbox. When executing a submission, Judge0 writes a `run_script` to the sandbox directory. The security issue is that an attacker can create a symbolic link (symlink) at the path `run_script` before this code is executed, resulting in the `f.write` writing to an arbitrary file on the unsandboxed system. An attacker can leverage this vulnerability to overwrite scripts on the system and gain code execution outside of the sandbox.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/judge0/judge0
commit_details: repo_url: https://github.com/judge0/judge0
author: Herman Zvonimir Došilović
author_date: 2024-03-06 13:37:11+01:00
msg: Use user judge0
repository: repo_url: https://github.com/judge0/judge0
repo_name: judge0/judge0
description: 🔥 The most advanced open-source online code execution system in the world.
repo_language: HTML
owner: judge0
file_changes: filename: Dockerfile
change_type: ModificationType.MODIFY
diff: @@ -38,22 +38,16 @@ COPY . .
 ENTRYPOINT ["/api/docker-entrypoint.sh"]
 CMD ["/api/scripts/server"]
 
+RUN useradd -u 1000 -m -r judge0 && \
+    echo "judge0 ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers && \
+    chown -R judge0: /api
+
+USER judge0
+
 ENV JUDGE0_VERSION "1.13.0"
 LABEL version=$JUDGE0_VERSION
 
 
 FROM production AS development
 
-ARG DEV_USER=judge0
-ARG DEV_USER_ID=1000
-
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
-        tmux \
-        vim && \
-    useradd -u $DEV_USER_ID -m -r $DEV_USER && \
-    echo "$DEV_USER ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers
-
-USER $DEV_USER
-
 CMD ["sleep", "infinity"]

programming_language: Shell
CVE-2014-125029 (published 2023-01-07T22:15Z)

A vulnerability was found in ttskch PaginationServiceProvider up to 0.x. It has been declared as critical. This vulnerability affects unknown code of the file demo/index.php of the component demo. The manipulation of the argument sort/id leads to sql injection. Upgrading to version 1.0.0 is able to address this issue. The patch is identified as 619de478efce17ece1a3b913ab16e40651e1ea7b. It is recommended to upgrade the affected component. VDB-217150 is the identifier assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/ttskch/PaginationServiceProvider
commit_details: repo_url: https://github.com/ttskch/PaginationServiceProvider
author: Takashi Kanemoto
author_date: 2014-11-04 17:22:58+09:00
msg: avoid sql injection on demo code
repository: repo_url: https://github.com/ttskch/PaginationServiceProvider
repo_name: ttskch/PaginationServiceProvider
description: Wrapper of KnpPaginatorBundle as service provider for the Silex microframework.
repo_language: PHP
owner: ttskch
file_changes: filename: index.php
change_type: ModificationType.MODIFY
diff: @@ -35,10 +35,10 @@ $app->get('/', function (Request $request) use ($app) {
 
     $page = $request->get('page', 1);
     $limit = $request->get('limit', 10);
-    $sort = $request->get('sort', 'id');
-    $direction = $request->get('direction', 'asc');
+    $sort = $app['db']->quoteIdentifier($request->get('sort', 'id'));
+    $direction = $request->get('direction') === 'desc' ? 'DESC' : 'ASC';
 
-    $sql = "select * from sample order by \"{$sort}\" {$direction}";
+    $sql = "select * from sample order by {$sort} {$direction}";
     $array = $app['db']->fetchAll($sql);
 
     $pagination = $app['knp_paginator']->paginate($array, $page, $limit);

programming_language: PHP
CVE-2021-32268 (published 2021-09-20T16:15Z)

Buffer overflow vulnerability in function gf_fprintf in os_file.c in gpac before 1.0.1 allows attackers to execute arbitrary code. The fixed version is 1.0.1.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2020-09-07 09:20:37+02:00
msg: fixed #1587
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: box_code_base.c
change_type: ModificationType.MODIFY
diff: @@ -580,6 +580,10 @@ GF_Err url_box_read(GF_Box *s, GF_BitStream *bs)
 		ptr->location = (char*)gf_malloc((u32) ptr->size);
 		if (! ptr->location) return GF_OUT_OF_MEM;
 		gf_bs_read_data(bs, ptr->location, (u32)ptr->size);
+		if (ptr->location[ptr->size-1]) {
+			GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[iso file] url box location is not 0-terminated\n" ));
+			return GF_ISOM_INVALID_FILE;
+		}
 	}
 	return GF_OK;
 }

programming_language: C