Re: com php-src: Fixed Bug #66987 Memory corruption in fileinfo ext (bigendian): ext/fileinfo/libmagic/apprentice.c

Le 31/03/2014 16:50, Remi Collet a écrit : > Commit: 2c204a55af9b903b3db48dd5a75d492dbf1b387d > Author: Remi Collet <remi@php.net> Mon, 31 Mar 2014 16:50:47 +0200 > Parents: 1283722589a8cccd6c49aa9d9c78edeec43f094e > Branches: PHP-5.4 PHP-5.5 PHP-5.6 master > > Link: > http://git.php.net/?p=php-src.git;a=commitdiff;h=2c204a55af9b903b3db48dd5a75d492dbf1b387d The patch for memory leak have never been upstreamed :( And this patch cause the memory corruption. Now, the new patch is upstreamed :) https://github.com/file/file/commit/a66e366b6af0679577c84f20e36086cfd098d11d Remi. > Log: > Fixed Bug #66987 Memory corruption in fileinfo ext (bigendian) > > On little endian: > map->p == php_magic_database > map->magic[i] = pointer into the map > > map->p == NULL > map->magic[i] = pointer to allocated memory > > On big endian (ppc64, s390x, ...): > map->p != php_magic_database and map->p != NULL > map->magic[i] = pointer into a copy of the map > > Trying to efree pointer in the later cause memory corruption > Thanks to dkatulek / Red Hat for the report. > > Bugs: > https://bugs.php.net/66987 > > Changed paths: > M ext/fileinfo/libmagic/apprentice.c > > > Diff: > diff --git a/ext/fileinfo/libmagic/apprentice.c b/ext/fileinfo/libmagic/apprentice.c > index 11920e6..fd82564 100644 > --- a/ext/fileinfo/libmagic/apprentice.c > +++ b/ext/fileinfo/libmagic/apprentice.c > @@ -493,12 +493,14 @@ apprentice_unmap(struct magic_map *map) > if (map == NULL) > return; > if (map->p != php_magic_database) { > - int j; > - for (j = 0; j < MAGIC_SETS; j++) { > - if (map->magic[j]) > - efree(map->magic[j]); > - } > - if (map->p != NULL) { > + if (map->p == NULL) { > + int j; > + for (j = 0; j < MAGIC_SETS; j++) { > + if (map->magic[j]) { > + efree(map->magic[j]); > + } > + } > + } else { > efree(map->p); > } > } > >