com php-src: Fixed Bug #67413 fileinfo: cdf_read_pro perty_info insufficient boundary chec: ext/fileinfo /libmagic/cdf.c

Commit: 2fe5bcbeb58bb1088f9fcdb9f02599880454b602 Author: Remi Collet <remi@php.net> Tue, 10 Jun 2014 14:33:37 +0200 Committer: Stanislav Malyshev <stas@php.net> Fri, 18 Jul 2014 16:21:01 -0700 Parents: 892def5f12716c9f926588bd2190acd6ea99a3a0 Branches: PHP-5.3 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=2fe5bcbeb58bb1088f9fcdb9f02599880454b602 Log: Fixed Bug #67413 fileinfo: cdf_read_property_info insufficient boundary chec Upstream: https://github.com/file/file/commit/93e063ee374b6a75729df9e7201fb511e47e259d Adapted for C standard. Bugs: https://bugs.php.net/67413 Changed paths: M ext/fileinfo/libmagic/cdf.c Diff: diff --git a/ext/fileinfo/libmagic/cdf.c b/ext/fileinfo/libmagic/cdf.c index 3b6f488..958cf82 100644 --- a/ext/fileinfo/libmagic/cdf.c +++ b/ext/fileinfo/libmagic/cdf.c @@ -812,7 +812,11 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h, if (cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1) goto out; for (i = 0; i < sh.sh_properties; i++) { - size_t ofs = CDF_GETUINT32(p, (i << 1) + 1); + size_t ofs, tail = (i << 1) + 1; + if (cdf_check_stream_offset(sst, h, p, tail * sizeof(uint32_t), + __LINE__) == -1) + goto out; + ofs = CDF_GETUINT32(p, tail); q = (const uint8_t *)(const void *) ((const char *)(const void *)p + ofs - 2 * sizeof(uint32_t));