starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2022-23220 (published 2022-01-21T16:15Z)

USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit settings (e.g., allow_any=yes) for pkexec disable the authentication requirement. Code execution can, for example, use the --gtk-module option. This affects Ubuntu, Debian, and Gentoo.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-306
cwe_name: Missing Authentication for Critical Function
description: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/gregkh/usbview
commit_details: repo_url: https://github.com/gregkh/usbview
author: Greg Kroah-Hartman
author_date: 2022-01-20 13:04:39+01:00
msg: org.freedesktop.pkexec.usbview.policy: fix a local root privilege escalation issue via pkexec (CVE-2022-23220).

The polkit policy allowed unprivileged users to run usbview as root with
arbitrary command line arguments, allowing a local root exploit.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
repository: repo_url: https://github.com/gregkh/usbview
repo_name: gregkh/usbview
description: usb viewer for Linux
repo_language: C
owner: gregkh
file_changes: filename: org.freedesktop.pkexec.usbview.policy
change_type: ModificationType.MODIFY
diff: @@ -8,8 +8,8 @@
     <message>Authentication is required to view USB bus</message>
     <icon_name>usbview_icon</icon_name>
     <defaults>
-      <allow_any>yes</allow_any>
-      <allow_inactive>yes</allow_inactive>
+      <allow_any>no</allow_any>
+      <allow_inactive>no</allow_inactive>
       <allow_active>auth_admin_keep</allow_active>
     </defaults>
     <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/usbview</annotate>

programming_language: HTML
CVE-2020-22784 (published 2021-04-28T21:15Z)

In Etherpad UeberDB < 0.4.4, due to MySQL omitting trailing spaces on char / varchar columns during comparisons, retrieving database records using UeberDB's MySQL connector could allow bypassing access controls enforced on key names.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-697
cwe_name: Incorrect Comparison
description: The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
extended_description: 
            This Pillar covers several possibilities:
               
                  the comparison checks one factor incorrectly;
                  the comparison should consider multiple factors, but it does not check at least one of those factors at all;
                  the comparison checks the wrong factor.
               
         
         

Fix information:
repo_url: https://github.com/ether/ueberDB
commit_details: repo_url: https://github.com/ether/ueberDB
author: John McLear
author_date: 2020-04-01 18:05:33+00:00
msg: go go gadget mysql fix for 2877
repository: repo_url: https://github.com/ether/ueberDB
repo_name: ether/ueberDB
description: Abstract your databases, make datababies.  Transforms every database into a object key value store.
repo_language: TypeScript
owner: ether
file_changes: filename: mysql_db.js
change_type: ModificationType.MODIFY
diff: @@ -129,7 +129,7 @@ exports.database.prototype.init = function(callback)
 
 exports.database.prototype.get = function (key, callback)
 {
-  this.db.query("SELECT `value` FROM `store` WHERE  `key` = ?", [key], function(err,results)
+  this.db.query("SELECT `value` FROM `store` WHERE BINARY `key` = ?", [key], function(err,results)
   {
     var value = null;
     
@@ -146,7 +146,7 @@ exports.database.prototype.get = function (key, callback)
 
 exports.database.prototype.findKeys = function (key, notKey, callback)
 {
-  var query="SELECT `key` FROM `store` WHERE  `key` LIKE ?"
+  var query="SELECT `key` FROM `store` WHERE BINARY `key` LIKE ?"
     , params=[]
   ;
   

programming_language: JavaScript
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -43,7 +43,7 @@
     "url": "https://github.com/ether/ueberDB.git"
   },
   "main": "./CloneAndAtomicLayer",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "gitHead": "00cb8c896433922111c12fe9d2a45087fdb11d59",
   "bugs": {
     "url": "https://github.com/ether/ueberDB/issues"

programming_language: TypeScript
CVE-2020-24654 (published 2020-09-02T17:15Z)

In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a user's home directory.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 3.3, LOW (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-59
cwe_name: Improper Link Resolution Before File Access ('Link Following')
description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/KDE/ark
commit_details: repo_url: https://github.com/KDE/ark
author: Fabian Vogt
author_date: 2020-08-25 22:14:37+02:00
msg: Pass the ARCHIVE_EXTRACT_SECURE_SYMLINKS flag to libarchive

There are archive types which allow to first create a symlink and then
later on dereference it. If the symlink points outside of the archive,
this results in writing outside of the destination directory.

With the ARCHIVE_EXTRACT_SECURE_SYMLINKS option set, libarchive avoids
this situation by verifying that none of the target path components are
symlinks before writing.

Remove the commented out code in the method, which would actually
misbehave if enabled again.

Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>
repository: repo_url: https://github.com/KDE/ark
repo_name: KDE/ark
description: File archiver by KDE
repo_language: C++
owner: KDE
file_changes: filename: libarchiveplugin.cpp
change_type: ModificationType.MODIFY
diff: @@ -509,21 +509,9 @@ void LibarchivePlugin::emitEntryFromArchiveEntry(struct archive_entry *aentry)
 
 int LibarchivePlugin::extractionFlags() const
 {
-    int result = ARCHIVE_EXTRACT_TIME;
-    result |= ARCHIVE_EXTRACT_SECURE_NODOTDOT;
-
-    // TODO: Don't use arksettings here
-    /*if ( ArkSettings::preservePerms() )
-    {
-        result &= ARCHIVE_EXTRACT_PERM;
-    }
-
-    if ( !ArkSettings::extractOverwrite() )
-    {
-        result &= ARCHIVE_EXTRACT_NO_OVERWRITE;
-    }*/
-
-    return result;
+    return ARCHIVE_EXTRACT_TIME
+           | ARCHIVE_EXTRACT_SECURE_NODOTDOT
+           | ARCHIVE_EXTRACT_SECURE_SYMLINKS;
 }
 
 void LibarchivePlugin::copyData(const QString& filename, struct archive *dest, bool partialprogress)

programming_language: C++
CVE-2022-30688 (published 2022-05-17T19:15Z)

needrestart 0.8 through 3.5 before 3.6 is prone to local privilege escalation. Regexes to detect the Perl, Python, and Ruby interpreters are not anchored, allowing a local user to escalate privileges when needrestart tries to detect if interpreters are using old source files.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/liske/needrestart
commit_details: repo_url: https://github.com/liske/needrestart
author: Thomas Liske
author_date: 2022-05-17 16:53:14+02:00
msg: [Interp] CVE-2022-30688: Anchor interpreter regex to prevent local privilege escalation (reported by Jakub Wilk).
repository: repo_url: https://github.com/liske/needrestart
repo_name: liske/needrestart
description: Restart daemons after library updates.
repo_language: Perl
owner: liske
file_changes: filename: Perl.pm
change_type: ModificationType.MODIFY
diff: @@ -43,7 +43,7 @@ sub isa {
     my $pid = shift;
     my $bin = shift;
 
-    return 1 if($bin =~ m@/usr/(local/)?bin/perl@);
+    return 1 if($bin =~ m@^/usr/(local/)?bin/perl(5[.\d]*)?$@);
 
     return 0;
 }

programming_language: Perl
filename: Python.pm
change_type: ModificationType.MODIFY
diff: @@ -42,7 +42,7 @@ sub isa {
     my $pid = shift;
     my $bin = shift;
 
-    return 1 if($bin =~ m@/usr/(local/)?bin/python@);
+    return 1 if($bin =~ m@^/usr/(local/)?bin/python([23][.\d]*)?$@);
 
     return 0;
 }

programming_language: Perl
filename: Ruby.pm
change_type: ModificationType.MODIFY
diff: @@ -42,7 +42,7 @@ sub isa {
     my $pid = shift;
     my $bin = shift;
 
-    return 1 if($bin =~ m@/usr/(local/)?bin/ruby@);
+    return 1 if($bin =~ m@^/usr/(local/)?bin/ruby$@);
 
     return 0;
 }

programming_language: Perl
CVE-2022-23492 (published 2022-12-08T01:15Z)

go-libp2p is the offical libp2p implementation in the Go programming language. Version `0.18.0` and older of go-libp2p are vulnerable to targeted resource exhaustion attacks. These attacks target libp2p’s connection, stream, peer, and memory management. An attacker can cause the allocation of large amounts of memory, ultimately leading to the process getting killed by the host’s operating system. While a connection manager tasked with keeping the number of connections within manageable limits has been part of go-libp2p, this component was designed to handle the regular churn of peers, not a targeted resource exhaustion attack. Users are advised to upgrade their version of go-libp2p to version `0.18.1` or newer. Users unable to upgrade may consult the denial of service (dos) mitigation page for more information on how to incorporate mitigation strategies, monitor your application, and respond to attacks.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-770
cwe_name: Allocation of Resources Without Limits or Throttling
description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
extended_description: Code frequently has to work with limited resources, so programmers must be careful to ensure that resources are not consumed too quickly, or too easily.  Without use of quotas, resource limits, or other protection mechanisms, it can be easy for an attacker to consume many resources by rapidly making many requests, or causing larger resources to be used than is needed. When too many resources are allocated, or if a single resource is too large, then it can prevent the code from working correctly, possibly leading to a denial of service.
         

Fix information:
repo_url: https://github.com/libp2p/go-libp2p
commit_details: repo_url: https://github.com/libp2p/go-libp2p
author: Marten Seemann
author_date: 2022-01-18 01:25:41-08:00
msg: Merge pull request #1275 from libp2p/rcmgr

use the resource manager
repository: repo_url: https://github.com/libp2p/go-libp2p
repo_name: libp2p/go-libp2p
description: libp2p implementation in Go
repo_language: Go
owner: libp2p
CVE-2024-32658 (published 2024-04-23T18:15Z)

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. Version 3.5.1 contains a patch for the issue. No known workarounds are available.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/FreeRDP/FreeRDP
commit_details: repo_url: https://github.com/FreeRDP/FreeRDP
author: akallabeth
author_date: 2024-04-20 17:59:49+02:00
msg: [codec,interleaved] fix offset error
repository: repo_url: https://github.com/FreeRDP/FreeRDP
repo_name: FreeRDP/FreeRDP
description: FreeRDP is a free remote desktop protocol library and clients
repo_language: C
owner: FreeRDP
file_changes: filename: interleaved.c
change_type: ModificationType.MODIFY
diff: @@ -212,7 +212,7 @@ static UINT ExtractRunLengthRegularFgBg(const BYTE* pbOrderHdr, const BYTE* pbEn
 	runLength = (*pbOrderHdr) & g_MaskRegularRunLength;
 	if (runLength == 0)
 	{
-		if (!buffer_within_range(pbOrderHdr, 1, pbEnd))
+		if (!buffer_within_range(pbOrderHdr, 2, pbEnd))
 		{
 			*advance = 0;
 			return 0;
@@ -282,7 +282,7 @@ static UINT ExtractRunLengthMegaMega(const BYTE* pbOrderHdr, const BYTE* pbEnd,
 	WINPR_ASSERT(pbEnd);
 	WINPR_ASSERT(advance);
 
-	if (!buffer_within_range(pbOrderHdr, 2, pbEnd))
+	if (!buffer_within_range(pbOrderHdr, 3, pbEnd))
 	{
 		*advance = 0;
 		return 0;

programming_language: C
CVE-2016-7520 (published 2017-04-20T18:59Z)

Heap-based buffer overflow in coders/hdr.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted HDR file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2016-01-22 19:39:55-05:00
msg: https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1537213
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: hdr.c
change_type: ModificationType.MODIFY
diff: @@ -723,7 +723,8 @@ static MagickBooleanType WriteHDRImage(const ImageInfo *image_info,Image *image,
     }
   if (image->gamma != 0.0)
     {
-      count=FormatLocaleString(header,MagickPathExtent,"GAMMA=%g\n",image->gamma);
+      count=FormatLocaleString(header,MagickPathExtent,"GAMMA=%g\n",
+        image->gamma);
       (void) WriteBlob(image,(size_t) count,(unsigned char *) header);
     }
   count=FormatLocaleString(header,MagickPathExtent,
@@ -741,10 +742,11 @@ static MagickBooleanType WriteHDRImage(const ImageInfo *image_info,Image *image,
   /*
     Write HDR pixels.
   */
-  pixels=(unsigned char *) AcquireQuantumMemory(image->columns,4*
+  pixels=(unsigned char *) AcquireQuantumMemory(image->columns+128,4*
     sizeof(*pixels));
   if (pixels == (unsigned char *) NULL)
     ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+  (void) ResetMagickMemory(pixels,0,4*(image->columns+128)*sizeof(*pixels));
   for (y=0; y < (ssize_t) image->rows; y++)
   {
     p=GetVirtualPixels(image,0,y,image->columns,1,exception);

programming_language: Objective-C
CVE-2016-3689 (published 2016-05-02T10:59Z)

The ims_pcu_parse_cdc_data function in drivers/input/misc/ims-pcu.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (system crash) via a USB device without both a master and a slave interface.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 4.6, MEDIUM (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Oliver Neukum
author_date: 2016-03-17 14:00:17-07:00
msg: Input: ims-pcu - sanity check against missing interfaces

A malicious device missing interface can make the driver oops.
Add sanity checking.

Signed-off-by: Oliver Neukum <ONeukum@suse.com>
CC: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: ims-pcu.c
change_type: ModificationType.MODIFY
diff: @@ -1663,6 +1663,8 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc
 
 	pcu->ctrl_intf = usb_ifnum_to_if(pcu->udev,
 					 union_desc->bMasterInterface0);
+	if (!pcu->ctrl_intf)
+		return -EINVAL;
 
 	alt = pcu->ctrl_intf->cur_altsetting;
 	pcu->ep_ctrl = &alt->endpoint[0].desc;
@@ -1670,6 +1672,8 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc
 
 	pcu->data_intf = usb_ifnum_to_if(pcu->udev,
 					 union_desc->bSlaveInterface0);
+	if (!pcu->data_intf)
+		return -EINVAL;
 
 	alt = pcu->data_intf->cur_altsetting;
 	if (alt->desc.bNumEndpoints != 2) {

programming_language: C
CVE-2019-15642 (published 2019-08-26T18:15Z)

rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call. NOTE: the Webmin_Servers_Index documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must not be granted to un-trusted Webmin users."

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-94
cwe_name: Improper Control of Generation of Code ('Code Injection')
description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
extended_description: 
            When a product allows a user's input to contain code syntax, it might be possible for an attacker to craft the code in such a way that it will alter the intended control flow of the product. Such an alteration could lead to arbitrary code execution.
            Injection problems encompass a wide variety of issues -- all mitigated in very different ways. For this reason, the most effective way to discuss these weaknesses is to note the distinct features which classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common -- i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed. The most classic instantiations of this category of weakness are SQL injection and format string vulnerabilities.
         
         

Fix information:
repo_url: https://github.com/webmin/webmin
commit_details: repo_url: https://github.com/webmin/webmin
author: Jamie Cameron
author_date: 2019-08-03 22:41:37-07:00
msg: Object names cannot contact special characters
repository: repo_url: https://github.com/webmin/webmin
repo_name: webmin/webmin
description: Powerful and flexible web-based server management control panel
repo_language: HTML
owner: webmin
file_changes: filename: web-lib-funcs.pl
change_type: ModificationType.MODIFY
diff: @@ -7307,7 +7307,7 @@ elsif ($v[0] eq 'REF') {
 elsif ($v[0] eq 'UNDEF') {
 	$rv = undef;
 	}
-elsif ($v[0] =~ /^OBJECT\s+(.*)$/) {
+elsif ($v[0] =~ /^OBJECT\s+([A-Za-z0-9_:]+)$/) {
 	# An object hash that we have to re-bless
 	my $cls = $1;
 	$rv = { };

programming_language: Perl
CVE-2015-9542 (published 2020-02-24T15:15Z)

add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could send a crafted password to an application (loading the pam_radius library) and crash it. Arbitrary code execution might be possible, depending on the application, C library, compiler, and other factors.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/FreeRADIUS/pam_radius
commit_details: repo_url: https://github.com/FreeRADIUS/pam_radius
author: Alan T. DeKok
author_date: 2015-05-21 15:40:11-04:00
msg: Use "length", which has been limited in size
repository: repo_url: https://github.com/FreeRADIUS/pam_radius
repo_name: FreeRADIUS/pam_radius
description: This is the PAM to RADIUS authentication module.  It allows any Linux, OSX or Solaris machine to become a RADIUS client for authentication and password change requests.
repo_language: C
owner: FreeRADIUS
file_changes: filename: pam_radius_auth.c
change_type: ModificationType.MODIFY
diff: @@ -536,7 +536,7 @@ static void add_password(AUTH_HDR *request, unsigned char type, CONST char *pass
 	}						/* 16*N maps to itself */
 
 	memset(hashed, 0, length);
-	memcpy(hashed, password, strlen(password));
+	memcpy(hashed, password, length);
 
 	attr = find_attribute(request, PW_PASSWORD);
 

programming_language: C
CVE-2017-16358 (published 2017-11-01T17:29Z)

In radare 2.0.1, an out-of-bounds read vulnerability exists in string_scan_range() in libr/bin/bin.c when doing a string search.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/radare/radare2
commit_details: repo_url: https://github.com/radare/radare2
author: pancake
author_date: 2017-10-31 13:08:52+01:00
msg: Fix #8748 - Fix oobread on string search
repository: repo_url: https://github.com/radare/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radare
file_changes: filename: bin.c
change_type: ModificationType.MODIFY
diff: @@ -352,16 +352,16 @@ static int string_scan_range(RList *list, const ut8 *buf, int min,
 				// TODO: move into adjust_offset
 				switch (str_type) {
 				case R_STRING_TYPE_WIDE:
-					{
-						const ut8 *p = buf  + str_start - 2;
+					if (str_start > 1) {
+						const ut8 *p = buf + str_start - 2;
 						if (p[0] == 0xff && p[1] == 0xfe) {
 							str_start -= 2; // \xff\xfe
 						}
 					}
 					break;
 				case R_STRING_TYPE_WIDE32:
-					{
-						const ut8 *p = buf  + str_start - 4;
+					if (str_start > 3) {
+						const ut8 *p = buf + str_start - 4;
 						if (p[0] == 0xff && p[1] == 0xfe) {
 							str_start -= 4; // \xff\xfe\x00\x00
 						}

programming_language: C