com php-src: Fixed Bug #66987 Memory corruption in fileinfo ext (bigendian): ext/fileinfo/libmagic/apprentice.c

Commit: 2c204a55af9b903b3db48dd5a75d492dbf1b387d Author: Remi Collet <remi@php.net> Mon, 31 Mar 2014 16:50:47 +0200 Parents: 1283722589a8cccd6c49aa9d9c78edeec43f094e Branches: PHP-5.4 PHP-5.5 PHP-5.6 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=2c204a55af9b903b3db48dd5a75d492dbf1b387d Log: Fixed Bug #66987 Memory corruption in fileinfo ext (bigendian) On little endian: map->p == php_magic_database map->magic[i] = pointer into the map map->p == NULL map->magic[i] = pointer to allocated memory On big endian (ppc64, s390x, ...): map->p != php_magic_database and map->p != NULL map->magic[i] = pointer into a copy of the map Trying to efree pointer in the later cause memory corruption Thanks to dkatulek / Red Hat for the report. Bugs: https://bugs.php.net/66987 Changed paths: M ext/fileinfo/libmagic/apprentice.c Diff: diff --git a/ext/fileinfo/libmagic/apprentice.c b/ext/fileinfo/libmagic/apprentice.c index 11920e6..fd82564 100644 --- a/ext/fileinfo/libmagic/apprentice.c +++ b/ext/fileinfo/libmagic/apprentice.c @@ -493,12 +493,14 @@ apprentice_unmap(struct magic_map *map) if (map == NULL) return; if (map->p != php_magic_database) { - int j; - for (j = 0; j < MAGIC_SETS; j++) { - if (map->magic[j]) - efree(map->magic[j]); - } - if (map->p != NULL) { + if (map->p == NULL) { + int j; + for (j = 0; j < MAGIC_SETS; j++) { + if (map->magic[j]) { + efree(map->magic[j]); + } + } + } else { efree(map->p); } }