starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2016-9566 (published 2016-12-15T22:59Z)

base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file.  NOTE: this can be leveraged by remote attackers using CVE-2016-9565.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.8, HIGH (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
cwe_id: CWE-59
cwe_name: Improper Link Resolution Before File Access ('Link Following')
description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/NagiosEnterprises/nagioscore
commit_details: repo_url: https://github.com/NagiosEnterprises/nagioscore
author: John C. Frickson
author_date: 2016-12-07 10:28:50-06:00
msg: Merge branch 'maint'
repository: repo_url: https://github.com/NagiosEnterprises/nagioscore
repo_name: NagiosEnterprises/nagioscore
description: Nagios Core
repo_language: C
owner: NagiosEnterprises
CVE-2020-15476 (published 2020-07-01T11:15Z)

In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpi_search_oracle in lib/protocols/oracle.c.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ntop/nDPI
commit_details: repo_url: https://github.com/ntop/nDPI
author: Philippe Antoine
author_date: 2020-05-10 15:04:23+02:00
msg: Adds bound check in oracle protocol

Found by oss-fuzz
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21780
repository: repo_url: https://github.com/ntop/nDPI
repo_name: ntop/nDPI
description: Open Source Deep Packet Inspection Software Toolkit
repo_language: C
owner: ntop
file_changes: filename: oracle.c
change_type: ModificationType.MODIFY
diff: @@ -43,7 +43,7 @@ void ndpi_search_oracle(struct ndpi_detection_module_struct *ndpi_struct, struct
     NDPI_LOG_DBG2(ndpi_struct, "calculating ORACLE over tcp\n");
     /* Oracle Database 9g,10g,11g */
     if ((dport == 1521 || sport == 1521)
-	&&  (((packet->payload[0] == 0x07) && (packet->payload[1] == 0xff) && (packet->payload[2] == 0x00))
+	&&  (((packet->payload_packet_len >= 3 && packet->payload[0] == 0x07) && (packet->payload[1] == 0xff) && (packet->payload[2] == 0x00))
 	     || ((packet->payload_packet_len >= 232) && ((packet->payload[0] == 0x00) || (packet->payload[0] == 0x01)) 
 	     && (packet->payload[1] != 0x00)
 	     && (packet->payload[2] == 0x00)

programming_language: C
CVE-2013-7436 (published 2015-04-10T14:59Z)

noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)

Weakness information:
cwe_id: CWE-310
cwe_name: Cryptographic Issues
description: Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

Fix information:
repo_url: https://github.com/kanaka/noVNC
commit_details: repo_url: https://github.com/kanaka/noVNC
author: Takashi Natsume
author_date: 2013-10-28 12:02:30+00:00
msg: Adds support for secure attribute on token cookie

This patch adds support for the secure attribute on token
cookies (sent by nova-novncproxy). If the https is used
to transfer the cookie, the secure attribute is set thus
restricting server requestes to secure conections only.
This should prevent man-in-the-middle attacks.
repository: repo_url: https://github.com/kanaka/noVNC
repo_name: novnc/noVNC
description: VNC client web application
repo_language: JavaScript
owner: kanaka
file_changes: filename: webutil.js
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,7 @@
 /*
  * noVNC: HTML5 VNC client
  * Copyright (C) 2012 Joel Martin
+ * Copyright (C) 2013 NTT corp.
  * Licensed under MPL 2.0 (see LICENSE.txt)
  *
  * See README.md for usage and integration instructions.
@@ -94,16 +95,20 @@ WebUtil.getQueryVar = function(name, defVal) {
 
 // No days means only for this browser session
 WebUtil.createCookie = function(name,value,days) {
-    var date, expires;
+    var date, expires, secure;
     if (days) {
         date = new Date();
         date.setTime(date.getTime()+(days*24*60*60*1000));
         expires = "; expires="+date.toGMTString();
-    }
-    else {
+    } else {
         expires = "";
     }
-    document.cookie = name+"="+value+expires+"; path=/";
+    if (document.location.protocol === "https:") {
+        secure = "; secure";
+    } else {
+        secure = "";
+    }
+    document.cookie = name+"="+value+expires+"; path=/"+secure;
 };
 
 WebUtil.readCookie = function(name, defaultValue) {

programming_language: JavaScript
CVE-2022-36752 (published 2022-07-28T23:15Z)

png2webp v1.0.4 was discovered to contain an out-of-bounds write via the function w2p. This vulnerability is exploitable via a crafted png file.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/landfillbaby/png2webp
commit_details: repo_url: https://github.com/landfillbaby/png2webp
author: Lucy Phipps
author_date: 2022-07-23 21:18:44+01:00
msg: v1.0.5: fix buffer overrun when reading bad WebPs
repository: repo_url: https://github.com/landfillbaby/png2webp
repo_name: landfillbaby/png2webp
description: Simple command-line batch PNG to WebP converter (and vice versa).
repo_language: C
owner: landfillbaby
file_changes: filename: png2webp.c
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 // anti-copyright Lucy Phipps 2022
 // vi: sw=2 tw=80
-#define VERSION "v1.0.4"
+#define VERSION "v1.0.5"
 #include <errno.h>
 #include <inttypes.h>
 #include <limits.h>
@@ -319,6 +319,14 @@ static bool w2p(char *ip, char *op) {
   }
   size_t l = ((uint32_t)(i[4] | (i[5] << 8) | (i[6] << 16) | (i[7] << 24))) + 8;
   // ^ RIFF header size
+  if(l <= 12
+#ifdef SSIZE_MAX
+    || l - 12 > SSIZE_MAX
+#endif
+  ) {
+    PF("ERROR reading %s: %s", IP, k[2]);
+    goto w2p_close;
+  }
   x = malloc(l);
   if(!x) {
     PF("ERROR reading %s: %s", IP, *k);

programming_language: C
CVE-2023-43641 (published 2023-10-09T22:15Z)

libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array access. A user of the GNOME desktop environment can be exploited by downloading a cue sheet from a malicious webpage. Because the file is saved to `~/Downloads`, it is then automatically scanned by tracker-miners. And because it has a .cue filename extension, tracker-miners use libcue to parse the file. The file exploits the vulnerability in libcue to gain code execution. This issue is patched in version 2.3.0.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/lipnitsk/libcue
commit_details: repo_url: https://github.com/lipnitsk/libcue
author: Ilya Lipnitskiy
author_date: 2023-10-10 13:37:46-07:00
msg: Changelog, CMakeLists.txt: Release 2.3.0

Signed-off-by: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
repository: repo_url: https://github.com/lipnitsk/libcue
repo_name: lipnitsk/libcue
description: CUE Sheet Parser Library
repo_language: C
owner: lipnitsk
file_changes: filename: CMakeLists.txt
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 SET(PACKAGE libcue)
 SET(PACKAGE_NAME libcue)
-SET(PACKAGE_VERSION 2.2.1)
+SET(PACKAGE_VERSION 2.3.0)
 SET(PACKAGE_SOVERSION 2)
 
 CMAKE_MINIMUM_REQUIRED(VERSION 2.8 FATAL_ERROR)

programming_language: Shell
filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,9 @@
+libcue (2.3.0)
+	[Vlad Stulikov, Vasiliy Sazonov]
+	* Bug fix - no EOF handling
+
+	[Kevin Backhouse]
+	* Fix CVE-2023-43641
 libcue (2.2.1)
 	[Ilya Lipnitskiy]
 	* cmake: Check for __attribute__ format

programming_language: Markdown
repo_url: https://github.com/lipnitsk/libcue
commit_details: repo_url: https://github.com/lipnitsk/libcue
author: Kevin Backhouse
author_date: 2023-09-27 20:22:43+01:00
msg: Check that the array index isn't negative. This fixes CVE-2023-43641.

Signed-off-by: Kevin Backhouse <kevinbackhouse@github.com>
repository: repo_url: https://github.com/lipnitsk/libcue
repo_name: lipnitsk/libcue
description: CUE Sheet Parser Library
repo_language: C
owner: lipnitsk
file_changes: filename: cd.c
change_type: ModificationType.MODIFY
diff: @@ -339,7 +339,7 @@ track_get_rem(const Track* track)
 
 void track_set_index(Track *track, int i, long ind)
 {
-	if (i > MAXINDEX) {
+	if (i < 0 || i > MAXINDEX) {
 		fprintf(stderr, "too many indexes\n");
                 return;
         }

programming_language: C
CVE-2018-18313 (published 2018-12-07T21:29Z)

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/Perl/perl5
commit_details: repo_url: https://github.com/Perl/perl5
author: Karl Williamson
author_date: 2017-03-25 15:00:22-06:00
msg: regcomp.c: Convert some strchr to memchr

This allows things to work properly in the face of embedded NULs.
See the branch merge message for more information.
repository: repo_url: https://github.com/Perl/perl5
repo_name: Perl/perl5
description: 🐪 The Perl programming language
repo_language: Perl
owner: Perl
file_changes: filename: regcomp.c
change_type: ModificationType.MODIFY
diff: @@ -12056,7 +12056,7 @@ S_grok_bslash_N(pTHX_ RExC_state_t *pRExC_state,
 
     RExC_parse++;	/* Skip past the '{' */
 
-    endbrace = strchr(RExC_parse, '}');
+    endbrace = (char *) memchr(RExC_parse, '}', RExC_end - RExC_parse);
     if (! endbrace) { /* no trailing brace */
         vFAIL2("Missing right brace on \\%c{}", 'N');
     }
@@ -12773,9 +12773,11 @@ S_regatom(pTHX_ RExC_state_t *pRExC_state, I32 *flagp, U32 depth)
             else {
                 STRLEN length;
                 char name = *RExC_parse;
-                char * endbrace;
+                char * endbrace = NULL;
                 RExC_parse += 2;
-                endbrace = strchr(RExC_parse, '}');
+                if (RExC_parse < RExC_end) {
+                    endbrace = (char *) memchr(RExC_parse, '}', RExC_end - RExC_parse);
+                }
 
                 if (! endbrace) {
                     vFAIL2("Missing right brace on \\%c{}", name);
@@ -16312,7 +16314,7 @@ S_regclass(pTHX_ RExC_state_t *pRExC_state, I32 *flagp, U32 depth,
 		    vFAIL2("Empty \\%c", (U8)value);
 		if (*RExC_parse == '{') {
 		    const U8 c = (U8)value;
-		    e = strchr(RExC_parse, '}');
+		    e = (char *) memchr(RExC_parse, '}', RExC_end - RExC_parse);
                     if (!e) {
                         RExC_parse++;
                         vFAIL2("Missing right brace on \\%c{}", c);

programming_language: C
CVE-2023-32312 (published 2023-06-09T20:15Z)

UmbracoIdentityExtensions is an Umbraco add-on package that enables easy extensibility points for ASP.Net Identity integration. In affected versions client secrets are not required which may expose some endpoints to untrusted actors. Since Umbraco is not a single-page application, the implicit flow is not safe. For traditional MVC applications, it is recommended to use the authorization code flow, which requires the client to authenticate with the authorization server using a client secret. This flow provides better security, as it involves exchanging an authorization code for an access token and/or ID token, rather than directly returning tokens in the URL fragment. This issue has been patched in commit `e792429f9` and a release to Nuget is pending. Users are advised to upgrade when possible.

CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/umbraco/UmbracoIdentityExtensions
commit_details: repo_url: https://github.com/umbraco/UmbracoIdentityExtensions
author: Darek Szatkowski
author_date: 2023-06-09 13:48:09+02:00
msg: Merge pull request from GHSA-f2rf-8mwf-6jfh

ClientSecret for Azure AD Auth for release/v2.0
repository: repo_url: https://github.com/umbraco/UmbracoIdentityExtensions
repo_name: umbraco/UmbracoIdentityExtensions
description: Code files & installation that enables easy extensibility points for ASP.Net Identity and the Umbraco back office
repo_language: C#
owner: umbraco
CVE-2018-10940 (published 2018-05-09T17:29Z)

The cdrom_ioctl_media_changed function in drivers/cdrom/cdrom.c in the Linux kernel before 4.16.6 allows local attackers to use a incorrect bounds check in the CDROM driver CDROM_MEDIA_CHANGED ioctl to read out kernel memory.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Dan Carpenter
author_date: 2018-04-18 12:51:31+03:00
msg: cdrom: information leak in cdrom_ioctl_media_changed()

This cast is wrong.  "cdi->capacity" is an int and "arg" is an unsigned
long.  The way the check is written now, if one of the high 32 bits is
set then we could read outside the info->slots[] array.

This bug is pretty old and it predates git.

Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: cdrom.c
change_type: ModificationType.MODIFY
diff: @@ -2371,7 +2371,7 @@ static int cdrom_ioctl_media_changed(struct cdrom_device_info *cdi,
 	if (!CDROM_CAN(CDC_SELECT_DISC) || arg == CDSL_CURRENT)
 		return media_changed(cdi, 1);
 
-	if ((unsigned int)arg >= cdi->capacity)
+	if (arg >= cdi->capacity)
 		return -EINVAL;
 
 	info = kmalloc(sizeof(*info), GFP_KERNEL);

programming_language: Markdown
CVE-2024-29033 (published 2024-03-20T21:15Z)

OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's own Authenticators with any OAuth 2.0 provider. `GoogleOAuthenticator.hosted_domain` is used to restrict what Google accounts can be authorized access to a JupyterHub. The restriction is intented to be to Google accounts part of one or more Google organization verified to control specified domain(s). Prior to version 16.3.0, the actual restriction has been to Google accounts with emails ending with the domain. Such accounts could have been created by anyone which at one time was able to read an email associated with the domain. This was described by Dylan Ayrey (@dxa4481) in this [blog post] from 15th December 2023). OAuthenticator 16.3.0 contains a patch for this issue. As a workaround, restrict who can login another way, such as `allowed_users` or `allowed_google_groups`.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/jupyterhub/oauthenticator
commit_details: repo_url: https://github.com/jupyterhub/oauthenticator
author: Erik Sundell
author_date: 2024-03-20 07:40:59+01:00
msg: Merge pull request from GHSA-55m3-44xf-hg4h

GoogleOAuthenticator.hosted_domain: check against hd, not email's domain
repository: repo_url: https://github.com/jupyterhub/oauthenticator
repo_name: jupyterhub/oauthenticator
description: OAuth + JupyterHub Authenticator = OAuthenticator
repo_language: Python
owner: jupyterhub
CVE-2023-28434 (published 2023-03-22T21:15Z)

Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`. \n

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/minio/minio
commit_details: repo_url: https://github.com/minio/minio
author: Aditya Manthramurthy
author_date: 2023-03-19 21:15:20-07:00
msg: fix: post policy request security bypass (#16849)
repository: repo_url: https://github.com/minio/minio
repo_name: minio/minio
description: The Object Store for AI Data Infrastructure
repo_language: Go
owner: minio
file_changes: filename: api-router.go
change_type: ModificationType.MODIFY
diff: @@ -434,8 +434,9 @@ func registerAPIRouter(router *mux.Router) {
 		router.Methods(http.MethodHead).HandlerFunc(
 			collectAPIStats("headbucket", maxClients(gz(httpTraceAll(api.HeadBucketHandler)))))
 		// PostPolicy
-		router.Methods(http.MethodPost).HeadersRegexp(xhttp.ContentType, "multipart/form-data*").HandlerFunc(
-			collectAPIStats("postpolicybucket", maxClients(gz(httpTraceHdrs(api.PostPolicyBucketHandler)))))
+		router.Methods(http.MethodPost).MatcherFunc(func(r *http.Request, _ *mux.RouteMatch) bool {
+			return isRequestPostPolicySignatureV4(r)
+		}).HandlerFunc(collectAPIStats("postpolicybucket", maxClients(gz(httpTraceHdrs(api.PostPolicyBucketHandler)))))
 		// DeleteMultipleObjects
 		router.Methods(http.MethodPost).HandlerFunc(
 			collectAPIStats("deletemultipleobjects", maxClients(gz(httpTraceAll(api.DeleteMultipleObjectsHandler))))).Queries("delete", "")

programming_language: Go
filename: auth-handler.go
change_type: ModificationType.MODIFY
diff: @@ -25,6 +25,7 @@ import (
 	"encoding/hex"
 	"errors"
 	"io"
+	"mime"
 	"net/http"
 	"net/url"
 	"strconv"
@@ -74,8 +75,11 @@ func isRequestPresignedSignatureV2(r *http.Request) bool {
 
 // Verify if request has AWS Post policy Signature Version '4'.
 func isRequestPostPolicySignatureV4(r *http.Request) bool {
-	return strings.Contains(r.Header.Get(xhttp.ContentType), "multipart/form-data") &&
-		r.Method == http.MethodPost
+	mediaType, _, err := mime.ParseMediaType(r.Header.Get(xhttp.ContentType))
+	if err != nil {
+		return false
+	}
+	return mediaType == "multipart/form-data" && r.Method == http.MethodPost
 }
 
 // Verify if the request has AWS Streaming Signature Version '4'. This is only valid for 'PUT' operation.

programming_language: Go
CVE-2018-11363 (published 2018-05-22T04:29Z)

jpeg_size in pdfgen.c in PDFGen before 2018-04-09 has a heap-based buffer over-read.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/AndreRenaud/PDFGen
commit_details: repo_url: https://github.com/AndreRenaud/PDFGen
author: Andre Renaud
author_date: 2018-04-10 09:21:34+12:00
msg: jpeg: Fix another possible buffer overrun

Found via the clang libfuzzer
repository: repo_url: https://github.com/AndreRenaud/PDFGen
repo_name: AndreRenaud/PDFGen
description: Simple C PDF Writer/Generation library
repo_language: C
owner: AndreRenaud
file_changes: filename: pdfgen.c
change_type: ModificationType.MODIFY
diff: @@ -2036,7 +2036,8 @@ static int jpeg_size(unsigned char* data, unsigned int data_size,
                     return 0;
                 }
                 i+=2;
-                block_length = data[i] * 256 + data[i+1];
+                if (i + 1 < data_size)
+                    block_length = data[i] * 256 + data[i+1];
             }
         }
     }

programming_language: C